When you first connect a Raspberry Pi to your network and monitor, the system asks you to sign in using the default raspberry pi username and password. These preset credentials streamline initial setup but also create security risks if they are not changed before deployment in the wild.
This guide explains the out-of-the-box login details, how to customize them, and the best practices to keep your device accessible yet secure. You will find clear tables, step lists, and common questions to help you manage credentials confidently.
| Default Username | Default Password | Initial Access Method | Recommended First Action |
|---|---|---|---|
| pi | raspberry | Monitor, SSH, or headless setup | Change password and create a standard user |
| root | (disabled by default) | Optional sudo or su activation | Enable only if required for advanced workflows |
Secure Shell Access with Default Credentials
When you power on a Raspberry Pi for the first time, the most common login is the username pi and the default password raspberry over SSH or directly on the desktop. This combination allows rapid prototyping and automation scripts to run without manual account creation during initial setup.
If you are using headless mode, you can place an ssh file and a wpa_supplicant.conf on the boot partition so that the Pi connects to your WiFi or Ethernet and accepts SSH connections immediately with these same default credentials.
After the system boots, update the system packages, verify the network configuration, and then change the password to prevent unauthorized access from anyone who gains physical or network access to your device.
Configurable Authentication Options
Beyond the simple username pi and password raspberry combination, Raspberry Pi OS lets you create additional accounts, disable password login for SSH, and enforce public key authentication for stronger control. Using configuration options in raspi-config or manual edits to system files, you can customize login behavior without breaking automation workflows.
You can lock or unlock the root account, adjust sudo privileges, and set up automatic security updates so that credential changes align with organizational policies. Integrate these changes with your deployment scripts to ensure every new board starts with hardened defaults rather than well-known presets.
Document each custom username, home directory, and key location in an internal inventory so that operations, monitoring, and recovery teams can quickly identify who has access and how to rotate credentials safely when staff or projects change.
Headless Setup and First Login
For remote deployments, you prepare the boot partition with user configuration data such as username, password hash, and authorized keys, allowing the Raspberry Pi to apply your secure settings before the first boot completes. This approach removes the need to log in with the default raspberry pi username and password in production environments.
By pre-provisioning users and disabling password-based SSH, you ensure that only devices with the matching cryptographic keys can connect, greatly reducing the attack surface presented by default credentials. Combined with firewall rules and network segmentation, this method supports scalable, repeatable rollouts of many edge devices.
After the initial connection, run system updates, verify SSH service status, and rotate any temporary tokens or keys to align the device with your long-term identity and access management strategy.
Recovery and Administrative Access
If you forget your custom username or lose SSH access, you can boot from a different image or attach the storage to another system to modify configuration files and restore administrative control. During such recovery procedures, verify each change to account entries and ensure that services such as SSH and sudo remain functional after modifications.
Use this process to re-enable the root account only when absolutely necessary, and disable it again once recovery is complete. Maintain an audit trail of who performed recovery steps and when, so that security reviews can trace how credential issues were resolved without exposing unnecessary privileges.
Key Recommendations for Managing Raspberry Pi Credentials
- Replace the default password immediately and enforce strong, unique passwords or SSH keys.
- Create individual user accounts for operators and assign sudo rights through groups instead of sharing the pi account.
- Disable password authentication for SSH and rely on public key pairs to reduce brute-force risk.
- Rotate credentials periodically and maintain an inventory linking usernames, keys, and responsible team members.
- Use configuration management or immutable infrastructure patterns so that new boards inherit hardened settings automatically.
FAQ
Reader questions
What should I do immediately after flashing a new Raspberry Pi image regarding the default pi user?
Change the default password, create a dedicated user with sudo privileges, and disable password-based SSH login before connecting the device to any production network.
Can I disable the pi user entirely on a Raspberry Pi?
Yes, you can delete or lock the pi account after you have created an alternative administrative user, but ensure you retain at least one working user with sudo rights to avoid lockout.
Is it safe to use the default password raspberry on a device behind a firewall?
No, even inside a firewall, known default credentials can be exposed through misconfiguration or compromised services, so always replace them with unique, strong passwords or prefer SSH key authentication. Use configuration management tools or cloud-init scripts to push new user accounts, authorized keys, and password hashes in a controlled manner, then verify each device reports successful authentication after updates.