ClawBox has one human password: the browser login and SSH check the very same Linux system password (account clawbox) — see Authentication. So “I forgot the box password” and “I can’t SSH” are usually the same problem, and this page assumes both. If you can still get a terminal on the box — a saved SSH key, a remembered password — you don’t need this page: reset the password in ten seconds with Recovery option A.

​
What the password actually is

The box never invents or rotates its own password. It only ever changes in four places: the wizard’s Security step, Settings → System → Change password, sudo passwd clawbox over SSH, and a factory reset. Updates and reboots never touch it. That means the password is always one of exactly two candidates:
The last row bites in real support cases. The factory reset deliberately resets the password (and drops your Wi-Fi) last, only after every file wipe has succeeded — a reset that stops early must leave the box reachable and retryable, not stranded offline. So a reset that reported an error, lost power, or never finished leaves the password exactly what it was before: the one set in the wizard. If “the box was reset” but clawbox is rejected, try the owner’s original password — it almost certainly still applies.
Two rarer corners, for completeness:
  • Reset completed but clawbox is refused. The password-reset step of a factory reset is best-effort: if it fails, the reset still finishes and reboots rather than stranding the box. Try the previous owner password; the wizard’s Security step overwrites it either way.
  • You know the password but the browser rejects it (and you can’t check over SSH). Try a private/incognito window and type it by hand — stale browser autofill is the most common cause. The full ladder is in Troubleshooting.

​
First, reach the box

Recovery starts with getting the ClawBox screen in front of you. In order of reliability:
  1. http://YOUR_BOX_IP — the IP from your router’s connected-devices list (the box shows up as clawbox), or the one you bookmarked during setup. Plain HTTP, port 80, nothing after the IP.
  2. http://clawbox.local — convenient but not universal; it fails on many Windows machines and behind VPNs. See Networking.
  3. The setup hotspot — if the box is broadcasting the ClawBox-Setup Wi-Fi network, join it and open http://10.42.0.1 (fallback http://10.43.0.1 if your home network already uses that range). A box in hotspot mode has either been factory reset or lost your network — either way the wizard is waiting there.

​
Recovery without SSH

Work top to bottom — each step is less convenient than the one before it.
1

Try both candidate passwords

There are only two (see the table above): the wizard-set password and clawbox. Check your password manager and your browser’s saved passwords for the box’s IP or clawbox.local before declaring the wizard password lost — the browser you set the box up with very often kept it.
2

Find a device that is still logged in

Browser sessions last up to 24 hours, so a tab that talked to the box recently — the phone you set it up with, a laptop at home — may still be signed in. A live session is all you need: factory reset from the UI requires being logged in, not re-typing the password.From the logged-in device, open Settings → System → Factory reset, run it, and let it finish completely — a completed reset ends with the box rebooting into the ClawBox-Setup hotspot. Then re-run setup and choose a new password at the Security step. If the box instead lands back in the wizard without having rebooted, the reset did not complete — see below.
3

No session anywhere: factory reset is the remaining path

With no password and no live session, the box cannot be administered — by design: the login has no “forgot password” bypass, because anyone on your network could use it. What remains is a factory reset, and without a login the UI won’t offer you one. Contact support — a reflash restores the box to its out-of-the-box state (everything on it is erased, exactly like a factory reset).
What a factory reset erases: AI provider keys, chats and agent state, Telegram pairing, backups pairing, saved Wi-Fi, downloaded models, files in Documents/Downloads/Desktop, SSH keys, and all settings. The offline on-device model weights and the network hardware config survive, so the box comes back functional. The full list, and what deliberately survives, is in Recovery option D. After a completed reset the box reboots into the ClawBox-Setup hotspot and the wizard runs without a login — you set the new password at the Security step.

​
If the factory reset fails partway

A reset that cannot delete every file stops before anything connectivity-destructive happens: no Wi-Fi is dropped, the password is not reset, and the box does not reboot. That ordering is deliberate — a reset that stops early must leave the box reachable rather than stranded offline — but it also produces the single most confusing state a ClawBox can be in, because on screen the reset can look like it finished and drop you into the setup wizard anyway. You can tell a reset did not complete by any of these:
  • The box never went down — no reboot, and the ClawBox-Setup hotspot never appeared. A completed reset always ends in a reboot into the hotspot.
  • The box is still on your Wi-Fi at its old address.
  • The setup wizard loads, but its steps fail with “Authentication required”.
  • clawbox is not accepted anywhere — but the owner’s original password still is (SSH will take it).
That last point is the whole story: the half-cleared box still has an owner — the old password — and it correctly refuses to hand itself to whoever happens to be on the network. There is no browser-only way out of this state; it genuinely needs SSH. Connect with ssh clawbox@YOUR_BOX_IP using the owner’s original password, then either:
  1. Return the account to the factory default — run sudo passwd clawbox and set the password to clawbox. The box treats the factory default as “no owner”, so the wizard immediately works again: its update step repairs the software, and its Security step sets your new password. Do this right away — until that Security step, anyone on your network could run the wizard; or
  2. Finish the wipe by hand — the step-by-step commands are in Recovery D → Over SSH.
If the owner’s password is truly lost too, SSH won’t open either — it’s a reflash; contact support.

​
Do I actually need SSH?