CP Plus DVR and NVR default password, and how to reset a forgotten one

The username on a CP Plus recorder is admin. The password depends on how old the recorder is and how it was set up.

• Newer DVRs and NVRs: no fixed password. The first time you switch the recorder on, a setup screen asks you to create the admin password. CP Plus's manuals ask for 8 to 32 characters with at least two of numbers, letters and special characters. The characters ' " ; : and & are not allowed.
• Newer IP cameras: the username is admin by default, and the camera has to be initialised the first time you use it. You set the password during that step, from the camera's web page, from IP Finder or from a recorder.
• Older DVRs: CP Plus's older DVR manuals list the username admin with the password admin, and tell you to change the password after the first login. If nobody changed the password on an old recorder since it was installed, this may still be the login.
• The same older manuals describe a hidden built-in user, called default, for the system's own use. It cannot be deleted, and it can be given viewing rights so that channels show without a login. Ask your installer what rights it has on your recorder.

A default or weak password is the first thing anyone tries. The UK's National Cyber Security Centre says some cameras are shipped with the maker's default password, which is often well known or guessable, and it advises changing it to a secure one. CP Plus's own manuals say the same: change the password after the first login, and choose a strong one.

On a current CP Plus recorder, with a monitor and mouse connected, the steps are these. Menu names differ a little between series, so look for Account in the Main Menu.

• 1. Right-click on the live view, open Main Menu and log in.
• 2. Go to Account, then User.
• 3. Click the edit icon next to the user you want to change, such as admin.
• 4. Type the new password and confirm it. Use 8 to 32 characters, at least two types, and none of ' " ; : or &.
• 5. Click OK.

Using CP Plus cameras? Get alerts from them, free for 7 days, no card

CP Plus publishes cybersecurity advice for its recorders in the back of its manuals. These are the points that matter most for an owner.

• Use at least 8 characters, with at least two types: upper and lower case letters, numbers and symbols.
• Do not put the account name, or the account name backwards, in the password. Avoid runs such as 123 or abc and repeats such as 111 or aaa.
• Change the password regularly, and give each user only the permissions they need.
• Keep the account lock switched on. CP Plus says it is on by default, and that after several wrong tries it locks the account and the address that tried.
• Set the password reset email and security questions, and update them when they change.
• Keep the recorder's firmware up to date. CP Plus lists security advisories on its website.
• Turn on HTTPS for the web page, and change the default HTTP and other service ports.

Newer CP Plus recorders ask for two recovery options during first setup. They are what make a reset possible later. If you skipped them, add them now under Main Menu, then Account, then Password Reset. CP Plus says the Password Reset function is on by default.

• Reserved email. Enter an email address you control. The recorder sends a security code to it when you reset the password, and the code works for 24 hours.
• Security questions. Choose questions only you can answer. If you never set them, the Security Questions choice does not appear on the reset screen.
• Unlock pattern (optional). A pattern of at least four points can replace typing the password at the recorder. If you forget the pattern, click Forgot Pattern to reach the password login.
• Password hint (optional). A reminder you can show on the login screen.

Which route works depends on what was set up and on the model. You need a monitor and a mouse connected to the recorder. If the recorder says the account is locked, wait it out. The current AI DVR manual lets you set the number of wrong tries and the lock time, with defaults of five tries and five minutes. CP Plus's older manuals say five wrong tries lock the account until you restart the recorder or wait about 30 minutes.

Check three things before you reset anything. You are typing the recorder's admin password, not a password that locks a phone app. The username is spelled admin. Your installer may have written the password down somewhere, so ask them first.

• 1. Reset with the reserved email. At the login screen, click the forgot password icon. If you use an unlock pattern, click Forgot Pattern first. Read the notice and click OK. CP Plus says the recorder collects information for the reset, including your email address and the device serial number. The screen shows a QR code. Scan it with your phone as the screen tells you, and a security code goes to your reserved email. Type it in the Security Code box within 24 hours, then type a new password twice and click Save.
• 2. Reset with security questions. On the same screen, choose Security Questions as the reset type and answer them. This choice only appears if you set the questions up earlier.
• 3. No reserved email set. On some models, CP Plus's own DVR guide says the recorder shows a QR code without an email ID. Scan it with a QR code scanner app to get a string of text, then send the whole string, or a clear picture of the QR code, to support@cpplusworld.com. CP Plus says you will get the password within 24 hours of working days. Have your model number and serial number ready. CP Plus's contact page also has a form with a Technical Support query type, and a technical support phone line, +91-8800952952.
• 4. The reset button on the board. If the Password Reset function is switched off and no security questions were set, CP Plus's manuals say the only route left is the reset button on the mainboard, which restores the recorder to factory defaults. Only some models have it. The steps differ by series, so follow the manual for your model: one CP Plus manual says to disconnect the power, remove the cover and hold the button for 5 to 10 seconds before restarting, and another says to reconnect the power first and then hold it. After the restart you set a new admin password and set the recorder up again. If the recorder is under warranty or a service contract, ask CP Plus or your installer before you open it.
• 5. IP cameras. On the camera's web page, click Forgot password? to reset through the email address set when the camera was initialised.
• 6. Not possible: the phone app. CP Plus's FAQ says you cannot reset a DVR's password through the gCMOB app.

You will find videos, forum posts and download sites that claim to have a master password, a reset code or a cracking tool for CP Plus, Dahua or Hikvision recorders. We do not list any. For the recorders themselves, this guide only uses the makers' own manuals and support pages.

A code or tool from an unofficial source can lock you out for good, wipe your settings or carry malware. Even if one works, someone else has a way into your recorder, and the next person to find the same code can use it too. The official routes above and below do not need one.

If none of them works, the next step is the maker. For CP Plus that is a support request with your model number and serial number. Your installer, or the company that sold you the recorder, may also have the admin password on file.

Dahua's own documents say that on new firmware there is no default password. The first time you use a Dahua device, you set the admin password. Dahua's wiki lists these official routes for a forgotten recorder password.

• Reserved email and QR code. On the login screen choose Forgot Password. If you set an email at setup, the screen shows a QR code. In the DMSS phone app go to Me, then Tool Manager, then Password Resetting and scan it. A security code arrives in your email and works for 24 hours.
• Security questions. On the recorder's own screen, choose Security Question as the reset type. Dahua says this works on NVR and DVR devices only.
• Older recorders with the blue menu. Dahua's wiki describes a support-assisted route: you send Dahua support the recorder's serial number and the date shown on screen. Dahua says it does not work on the newer menus.
• IP cameras. Most Dahua IP cameras have a physical reset button that restores factory defaults. Check the product page for your model. Our Dahua ConfigTool guide and DMSS guide cover the tools and the phone app.

Current Hikvision recorders have no default password either. Hikvision's NVR manual says that on first access you must activate the recorder by setting an admin password, and that no operation is allowed before activation.

• Forgot Password. On the login screen click Forgot Password and follow the wizard. Hikvision's manual says there are three ways to reset on that recorder: a password resetting email, Hik-Connect, or security questions, and that you have to configure at least one. Hikvision's FAQ also lists a GUID file that you export in advance.
• Lock-out. On the recorder in that manual, seven wrong passwords lock the account for 60 seconds.
• If none was set up. Hikvision's FAQ describes exporting a file from the recorder with the SADP tool and sending it to Hikvision support with a photo of the device label. You then enter the code or import the file you get back. Regions handle this differently, and in some your installer or distributor does it for you, so ask them or check Hikvision's site for your country. Our Hikvision SADP tool guide and Hik-Connect guide cover the tools.
• Old methods. Hikvision's own FAQ says its old security-code reset was removed from newer firmware.

• Set a new strong password and write it down somewhere safe, such as a locked drawer or a password manager. Keep a copy with the owner, not only with the installer.
• Set the reserved email and security questions straight away, so the next reset takes minutes.
• If you have IP cameras, the recorder may ask whether to sync the new password with them. Dahua's wiki advises choosing yes so the cameras keep the same password as the recorder and stay connected.
• Check the user list under Main Menu, then Account, then User. Remove accounts you do not recognise.
• Update the firmware, and read the security advisories on the maker's website.
• Turn off remote access you do not use. The NCSC advises considering switching off UPnP and port forwarding on your router, because criminals can exploit them.
• If you cannot find the recorder on your network afterwards, our CP Plus IP Finder guide shows how to find its address, and our KVMS Pro guide covers watching it on a PC.