Hikvision camera admin password reset tool

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,006
Location
USA
If you have ever locked yourself out of a Hikvision camera or NVR by forgetting the admin password, and had to beg Hikvision or anyone else for an unlock code, you will appreciate this. I present a small tool that lets you generate your own unlock codes which can be entered into SADP to reset the admin password on any of your Hikvision cameras. This tool is written in HTML/CSS/JavaScript so it runs in any modern web browser and you can view the complete source code easily.

/
Update (September 13, 2017)

It is now possible to reset passwords on some cameras that won't work with the reset code tool, by exploiting a backdoor that was recently made public.

I've built a tool for that. It only works with cameras (not NVRs. If you need to reset an NVR, click here.

GitHub - bp2008/HikPasswordHelper: A tool which exploits a backdoor in Hikvision camera firmwares circa 2014-2016 to help the owner change a forgotten password.



/

Disclaimer: This tool may or may not work for your camera or NVR. Please follow the instructions very carefully and be precise in all your inputs into the tool. Devices on newer firmware require a more secure password reset procedure which I can not help with. I think this tool will only work with cameras running firmware older than 5.3.0. I do not know what version is the cutoff for NVRs.

Some Hikvision devices (perhaps only NVRs) show their model number appended to the beginning of their serial numbers. You may need to remove this from the serial number that you enter into the tool. For example, if the serial number shows as DS-7208HVI-ST0123456789AAWR987654321WCVU and the device's model number is DS-7208HVI-ST, then the true serial number is 0123456789AAWR987654321WCVU

Without further ado, here is a link so you can use it without downloading anything: Hikvision Password Reset Tool



Inside this spoiler block is the complete source code which you can write to a .html file on your computer, allowing you to use it offline.
HTML:
<html>
<head>
    <title>Hikvision Password Reset</title>
    <script type="text/javascript">
        function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
        function initialize()
        {
            document.getElementById("year").value = new Date().getYear() + 1900;
            document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
            document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');

            document.getElementById("serialNumber").onchange = GenerateSerialCode;
            document.getElementById("year").onchange = GenerateSerialCode;
            document.getElementById("month").onchange = GenerateSerialCode;
            document.getElementById("day").onchange = GenerateSerialCode;
        }
        function GenerateSerialCode()
        {
            var serialNumber = document.getElementById("serialNumber").value;
            var year = document.getElementById("year").value;
            var month = document.getElementById("month").value;
            var day = document.getElementById("day").value;
            var plainText = serialNumber + year + month + day;

            var magicNumber = 0;
            for (var i = 0; i < plainText.length; i++)
                magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);

            magicNumber *= 1751873395;
            magicNumber = magicNumber >>> 0; / convert to 32 bit integer

            var magicWord = magicNumber + "";
            var serialCode = "";
            for (var i = 0; i < magicWord.length; i++)
            {
                var c = magicWord.charCodeAt(i);
                if (c < 51)
                    serialCode += String.fromCharCode(c + 33);
                else if (c < 53)
                    serialCode += String.fromCharCode(c + 62);
                else if (c < 55)
                    serialCode += String.fromCharCode(c + 47);
                else if (c < 57)
                    serialCode += String.fromCharCode(c + 66);
                else
                    serialCode += String.fromCharCode(c);
            }

            document.getElementById("output").innerHTML = serialCode;
        }
        window.onload = initialize;
    </script>
    <style type="text/css">
        body
        {
            width: 450px;
        }
        .description
        {
            margin: 20px 0px;
        }
        .label
        {
            margin: 10px 0px;
        }
        .input
        {
            margin-bottom: 10px;
        }
        #output
        {
            font-weight: bold;
            border: 1px solid black;
            padding: 10px;
            font-size: 2em;
            max-width: 100%;
        }
    </style>
</head>
<body>
    <div><h2>Hikvision Camera Password Reset Utility</h2></div>
    <div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
    <div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool:</div>
    <div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
    <div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
    <div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
    <div class="input"><input type="text" id="year" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
    <div class="input"><input type="text" id="month" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
    <div class="input"><input type="text" id="day" style="width: 20%" /></div>
    <div class="label">Your <b>password reset code</b> will appear below.</div>
    <div id="output"></div>
    <div class="label">The code must be entered into the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
</body>
</html>
Some will say it is irresponsible to publish this. I disagree. Evidently a number of people outside of Hikvision have possessed the ability to generate these codes for a while now. I found this (similar) functionality freely available for download elsewhere, so I really don't feel bad about releasing this and making it a bit easier to recover your cameras.
 
Last edited:

DaveP

Getting the hang of it
Joined
Nov 18, 2014
Messages
273
Reaction score
57
Location
Dumfriesshire
Just tested on my NVR (for no good reason, other than seeing if it worked on NVRs as well as cameras)

In the serial number from SADP, take out the beginning part of the serial which is the model number
 

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,006
Location
USA
Cool, I tried it with a Swann branded Hikvision cam and didn't have to remove anything from the serial. So that must just be a quirk of the NVR.
 

Mike

Staff member
Joined
Mar 9, 2014
Messages
2,982
Reaction score
2,725
Location
New York
This is awesome, many thanks for sharing! This will definitely come in handy for many.

Thread made sticky.
 

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,006
Location
USA
Are you sure about that? There need to be no errors at all in the serial number, and the year has to be 4 digits ("2015"), month 2 digits ("03"), day 2 digits ("12"), and the camera's internal clock needs to match the date you entered on the form. I do admit though I did not try it with a Chinese camera, only one from USA.
 

karmadhi

Young grasshopper
Joined
Mar 11, 2015
Messages
36
Reaction score
9
yeah i tried a couple of times, the cameras clock matched the one on the form. tied two different cameras but still nothing. both of them Chinese.
 

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,006
Location
USA
I will try one of my chinese cams when I get home. Maybe something needs to be taken out of the serial number like with an NVR...
 

RyanODan

IPCT Vendor
Joined
Mar 10, 2014
Messages
626
Reaction score
266
Location
Tulsa
Simply amazing. The time and trouble you've saved everyone is priceless. Thank you for sharing!
 

karmadhi

Young grasshopper
Joined
Mar 11, 2015
Messages
36
Reaction score
9
thank you. it worked. apparently i was doing something wrong.
 

whoslooking

IPCT Contributor
Joined
Oct 3, 2014
Messages
1,524
Reaction score
548
Location
London
Thanks for sharing, this can make life a lot easier for a lot of Engineers.
 

Arrowhawk

n3wb
Joined
Apr 27, 2015
Messages
5
Reaction score
0
Hi, I have just bought a new DS-7608NI-E2/8P from a Chinese seller, and when trying to log in for the first time it is telling me the password 12345 is wrong. I have emailed the seller for the reset code however have not had any reply yet.

I have tried resetting the password using this tool however keep getting the message password recovery failed. I have tried the full serial number and by deleting the model number from the start.

Has anyone else successfully used this reset tool with this model NVR?

Thanks.
 
Top