A hard-coded password is a static credential embedded directly in software, firmware, or an appliance instead of being created, stored, and rotated by administrators. Because it is built into the product, it often cannot be changed easily, and sometimes it is shared across many installations. This breaks normal password hygiene and creates a secret that attackers can look for by reverse engineering or by probing exposed services.
In cyber security, hard-coded passwords matter because they can turn a single flaw into broad unauthorized access. If an attacker discovers the credential, they may log in without brute force, bypass intended authentication, or move into sensitive management functions. Defenders reduce this risk by banning baked-in secrets, using unique per-device credentials, storing secrets in a vault, rotating them regularly, and scanning code and firmware for embedded passwords. Any management interface or control plane that relies on a hidden static secret should be treated as high risk.