We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKDefault Passwords

UK PSTI Product Security Default Passwords

PSTI requires each covered password to be user-defined or . Unique credentials must not use incremental counters, public information, unprotected product identifiers, or another generation method that fails the statutory guessability test.

Check every password path in the hardware and associated software, including setup, recovery, service and factory-reset states.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections11 primary sources
Overview

PSTI requires each covered password to be user-defined or . A unique-per-product password must not use an incremental counter, public information, or a unique product identifier without accepted encryption or keyed hashing. It must not otherwise be in a manner unacceptable as part of good industry practice.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

Which passwords does the PSTI rule cover?

The rule has applied since 29 April 2024 when a manufacturer makes a relevant connectable product available to UK consumers and no product exception applies. Typical examples can include connected cameras, speakers, toys, appliances, hubs, and wearables, but classification depends on the product's internet or network connectivity, intended consumer availability, supply facts, and Schedule 3 exceptions. Excepted products include specified medical, smart-meter, electric-vehicle charging, computer, and vehicle categories only when their exact conditions are met.

Schedule 1 applies the password rule to the product's hardware and pre-installed software when the product is not in the factory default state. It also covers software that is not pre-installed at supply but must be installed on the product for every manufacturer-intended purpose that uses the product's hardware, pre-installed software, or installable software. Cryptographic keys, API keys, and pairing PINs for protocols outside the Internet Protocol suite are excluded from this password definition. The manufacturer is the duty-holder for this security requirement.

A covered password must either be defined by the user or be . A unique-per-product password must not be based on incremental counters or public information. It may be based on or derived from a unique product identifier only when an encryption method or keyed hashing algorithm accepted as good industry practice is used. It must not otherwise be in a manner unacceptable as good industry practice.

  • Inventory setup, local administration, recovery, service, diagnostic, companion-app, cloud-service, and factory-reset states.
  • Record whether each authentication path uses a password. The rule does not require a product to use passwords when it uses another authentication mechanism.
  • Test the credential behavior of the released product and associated services, not only the intended design.
Question 2

How can a manufacturer evidence the password decision?

Keep a credential inventory tied to the product model, firmware, software installed or required to be installed on the product, and factory-reset behavior. For user-defined passwords, preserve the setup flow and tests showing that the user defines the credential before the relevant access is enabled. For unique passwords, preserve the generation design, unpredictability rationale, provisioning controls, and tests showing that credentials do not repeat across sampled units.

If a password is derived from a serial number, MAC address, or another unique identifier, document the accepted encryption or keyed-hashing method. Encoding, truncation, reversal, or a secret-free formula does not establish the statutory exception.

Schedule 2 can provide for the password requirement when the exact standards or current-label conditions are met. For the original ETSI route, preserve the V2.1.1 assessment against provisions 5.1-1 and, where relevant, 5.1-2 plus the additional statutory conditions. From 4 December 2025, verify any claimed Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme route against the amended Schedule, the covered product, and the label's current status.

  • Link each test to the exact hardware or in-scope software authentication path.
  • Retain results for production units and reset or recovery states, where credentials can change.
  • Record any reliance on , including the exact Schedule 2 condition, named standard or current label, version, covered product, issue date, verification record, and expiry.
  • Reassess after a credential-generation change, new administration or recovery path, factory-reset change, supplier change, label expiry, product-scope change, or an app or cloud release that changes an in-scope product password path.
Question 3

What mistakes should teams avoid?

Do not limit the review to a shared factory password. Predictable per-unit credentials can still fail, and the product's setup, recovery, service, and factory-reset states can expose different covered passwords. A test report for ETSI EN 303 645 also does not replace the separate product-scope, statement-of-compliance, supply-chain, investigation, notification, and record duties in the Act.

When a product has more than one manufacturer for PSTI purposes, including a business selling a white-label product under its own name or trade mark, each manufacturer must meet the applicable security requirement or a deemed-compliance condition. Importers and distributors must perform their own statement and supply checks and act when the statutory knowledge or belief test for a compliance failure is met.

Question 4

Questions and answers

What do the PSTI default-password rules require?

A covered password must be defined by the user or . A unique-per-product password must not be incremental, based on public information, derived from a unique product identifier without accepted encryption or keyed hashing, or otherwise in a manner unacceptable as good industry practice.

Who needs to act on the default-password rule?

The manufacturer must meet the password security requirement when the Act's UK consumer-product conditions apply. Importers and distributors have separate duties, including statement checks and action when they know or believe that a manufacturer has failed to comply; they do not become the manufacturer merely by reselling a product.

What should evidence show for a password decision?

For an in-scope UK consumer connectable product, keep a credential inventory, setup and reset flows, generation or user-definition design, release-test results, product and service versions, samples, and the approval record. The evidence should show how every covered password meets the user-defined or unique-per-product rule and should identify any exact Schedule 2 deemed-compliance condition relied on.

When should the password assessment be repeated?

Repeat the PSTI password assessment when a firmware, app, cloud service, setup, recovery, service, diagnostic, or factory-reset change adds or changes a password path; when credential generation or provisioning changes; when a recognised label expires or its scope changes; or when the product's UK consumer-market or exception facts change.

Does the password rule apply to every connected product?

No. The manufacturer duty applies when the product is a relevant connectable product made available to UK consumers under the PSTI Act and no Schedule 3 exception applies. The product's connectivity, intended consumer availability, actor, supply facts, and exact exception conditions must be recorded before applying the password test.

Recommended next step

Test every covered password path

Map each covered password to the released hardware or software, its user-defined or unique-per-product route, generation evidence, reset behavior, owner, and retest trigger.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create credential questions, generation-evidence fields, reset tests, and remediation tasks from this guide.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

ETSI EN 303 645 V2.1.1
etsi.org
Referenced sections
  • The edition and password provisions named by the 2023 Regulations for standards-based deemed compliance.
PSTI Amendment (No. 2) Regulations 2025
legislation.gov.uk
Referenced sections
  • Adds current-label routes under Japan JC-STAR STAR-1 and the Singapore Cybersecurity Labelling Scheme to the deemed-compliance conditions from 4 December 2025.
PSTI Security Requirements Regulations 2023
legislation.gov.uk
Referenced sections
  • Binding source for the password requirement, deemed-compliance routes, scope of associated hardware and software, and multiple-manufacturer rule.

Related guides

UK PSTI ETSI Evidence and Deemed Compliance

ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.

UK PSTI Excepted Products and Boundaries

An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.

UK PSTI Importer and Distributor Duties

Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.

UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties

OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.

UK PSTI Relevant Connectable Product Scope

A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.

UK PSTI Security Update Support Periods

PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.

Show all related guides (39)

UK PSTI Security Update Transparency

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.

UK PSTI Statement of Compliance: Contents, Delivery, and Records

A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.

UK PSTI Vulnerability Disclosure Requirements

Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.

UK PSTI Act statement of compliance: what must the SoC contain?

Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.

UK PSTI Act: vulnerability disclosure policy requirements and template

Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.

UK PSTI applicability test: product, market, and actor scope

Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.

UK PSTI compliance checklist for product release

Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.

UK PSTI compliance: duties, evidence, and response

Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.

UK PSTI default password requirements

Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.

UK PSTI Manufacturer, Importer and Distributor Roles

Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.

UK PSTI password and security update policy requirements

Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.

UK PSTI Product Security Deadlines and Compliance Calendar Guide

Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.

UK PSTI Product Security FAQ

Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.

UK PSTI Product Security Importer and Distributor Duties Guide

Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.

UK PSTI Product Security Minimum Support Period and Update Transparency Guide

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.

UK PSTI Product Security OPSS Enforcement and Penalties Guide

Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.

UK PSTI Product Security OPSS Notices Guide

Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.

UK PSTI Product Security Penalties and Fines Guide

Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.

UK PSTI product security requirements

Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.

UK PSTI relevant connectable product scope test

Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.

UK PSTI relevant connectable products: categories and exceptions

Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.

UK PSTI Scope Classifier Workflow

Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.

UK PSTI security requirements in practice

Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.

UK PSTI Statement of Compliance Evidence Pack

Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.

UK PSTI Statement of Compliance Template

Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.

UK PSTI Statement of Compliance Workflow

Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.

UK PSTI Support Period Evidence Workflow

Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.

UK PSTI to ETSI Evidence Mapping

Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.

UK PSTI vs Australia Smart Device Rules

Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.

UK PSTI vs ETSI EN 303 645

See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.

UK PSTI vs EU Cyber Resilience Act

Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.

UK PSTI vs EU Cyber Resilience Act (CRA)

Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.

UK PSTI Vulnerability Disclosure Workflow

Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.