Factory radios based on Android often block access to system settings with a password - especially after resetting, flashing or purchasing a used device. Manufacturers (Pioneer, Joying, Xtrons, Atoto etc.) set standard codes or generate unique combinations that users forget or lose. In this article - current methods for obtaining the password for 2020–2026 modelsincluding legal workarounds and technical loopholes.

Important: most methods require physical access to the device or documentation from the manufacturer. If the radio was purchased secondhand, the chances of restoring access without resetting are reduced. We will consider options from the simplest (entering default codes) to advanced (working with ADB and service modes).

📊 What brand is your radio?
Pioneer
Joying
Xtrons
Atoto
Another brand
I don’t know

1. Standard manufacturer passwords: code table

Many brands use universal factory passwords to access settings. These codes are often indicated in the instructions or on the box, but they can also be found in open sources. Below is the current table for popular brands (data tested on models 2023–2026).

Brand Model range Standard password Notes
Pioneer AVH-, SPH-, DMH-series 1234 or 0000 For models up to 2022, it can work 5678
Joying JY-, JYT-series 6666 or 8888 On new devices, the password is tied to the serial number
Xtrons PB-, PF-, TE-series 1111 or 126 For Xtrons TE702PL - only 126
Atoto A6, S8, F7 3368 or atoto (in Latin) On Atoto S8 Ultra the password is generated by IMEI
Dasaita Max10, PX6 888888 Requires entering twice in a row

⚠️ Attention: If the standard password does not fit, this may mean that:

  • 🔧 The manufacturer has changed the security policy (relevant for models 2026–2026).
  • 🔄 The previous owner changed the password manually.
  • 📱 The radio is flashed with custom firmware (for example, Hal9k or MCU Update).

Before attempting to enter, check for a sticker with a code on the device body or in the documentation. On some Joying and Atoto the password is indicated on the back of the radio next to the serial number.

2. Where to look for the password in the documentation and on the device

Manufacturers. they often hide password information in unobvious places. Here's where to look:

  • 📄 Warranty card or instructions: there may be a sticker with a PIN code on the last page.
  • 🏷️ Device box: some brands (Pioneer, Kenwood) print the code on packaging.
  • 🔍 Serial number: y Atoto i Dasaita password is generated according to the formula last 4 digits S/N + 1234.
  • 📧 Email from seller: if you bought online, the code could come in an order confirmation letter.

🔹 An example of calculating a password using the serial number: if S/N is yours Atoto A6 — AT2305123456, try entering 4561234 (last 4 digits + 1234).

💡

If the documentation is lost, try to find an electronic version of the instructions on the manufacturer’s website for the radio model. Often PDF files contain a "Factory Reset Password" section.

⚠️ Attention: On radios with Android 11+ (released after 2022), the password can be linked to a Google account or IMEI. In this case, standard codes will not work - a reset will be required through the service menu.

3. Resetting the password through the service menu (Engineer Mode)

If standard methods do not help, you can try resetting the password through engineering menu. This method works on 70% of radios (except Pioneer with protection Secure Boot).

📌 Step-by-step guide:

  1. Turn off the radio by holding the button Power 10 seconds.
  2. Hold the combination:
    • For Joying/Xtrons: Menu + Power + Knob (adjustment knob).
    • For Atoto/Dasaita: Back + Power + Volume Up.
  • In the menu that appears, select Factory Reset or Clear Password (navigation by volume buttons, selection by short press Power).
  • Confirm reset (you may need to enter 1234 or 0000).

    • ⚠️ Attention: On some models (Xtrons PB7868AP, Joying JY-T07) after resetting via Engineer Mode, the connection to the CAN bus vehicle will be lost. You will have to re-configure the connection with the on-board system!

    Make sure that the radio is disconnected from the power supply for 30 seconds|Check the car battery charge (not lower than 12V)|Prepare a paperclip for pressing hidden buttons (if there is no sensor)|Write down the current radio station settings (they will be reset)-->

    4. Using ADB commands to bypass the password

    For advanced users, there is a way to reset the password via Android Debug Bridge (ADB). This works if the radio is enabled. data-i="127">🔌 USB cable (preferably original). USB debugging (which is unlikely by default).

    🔧 Prerequisites:

    • 🖥️ Computer with installed ADB Tools.
    • 🔌 USB cable (preferably original).
    • 📱 Enabled USB debugging in the radio settings (Settings → For developers).

    🛠️ Instructions:

    1. Connect radio to PC via USB.
    2. Open the command line and enter: 
      adb devices

      The device should appear in the list.

    3. Run the command to reset the password: 
      adb shell am start -n com.android.settings/.SecuritySettings

      adb shell settings put secure lock_pattern_autolock 0
      

      adb shell settings put secure lockscreen.password_salt ""
      

      adb shell settings put secure lockscreen.password_type 0

    4. Reboot the radio: 
      adb reboot

    ⚠️ Attention: On radios with Android 10+ and protection DM-Verity (for example, Pioneer DMH-WT8600NEX), this method can lead to locking the bootloader. In this case, flashing via Fastboot.

    What to do if ADB does not see the device?

    If the command adb devices returns an empty list:

    1 Check. Is USB debugging enabled in the radio settings?

    2. Try another USB cable (preferably the original one).

    3. Install drivers for your model (for example, MTK Driver for MediaTek processors).

    4. PC.

    5. If the radio is on Rockchip (for example, Joying JY-UQ135N4G), a special one may be required ADB Driver from the manufacturer's website.

    5. Generating a password by IMEI or serial number

    Some manufacturers (Atoto, Dasaita, Hizpo) bind the password to IMEI or serial number (S/N). It can be calculated using online calculators or manually.

    🔢 How to find IMEI/serial number:

    • 📱 On the lock screen, enter *#06# (does not work on all models).
    • 🏷️ Look at the sticker on the back of the radio (usually under the barcode).
    • 📄 In the settings: About phone → Status → IMEI.

    🔑 Generation examples password:

    • For Atoto A6/S8:
      1. Take the last 6 digits of IMEI (for example, 123456).
      2. Divide into pairs: 12 34 56.
      3. Add the first two pairs: 12 + 34 = 46.
      4. Password: 4656.
  • For Dasaita Max10: 
    Password = (first 4 digits S/N) + (last 4 digits S/N)

    Example: S/N DS2023051234 → password 20231234.

    • ⚠️ Attention: Generation algorithms may change! For example, for Atoto F7 2026 the formula is different: 

    Password = (IMEI[7..10]) + "2026"

    Example: IMEI 861234567890123 → password 56782026.

    💡

    If the radio was released after 2023, first check the password generation algorithm on the brand's official forum. Manufacturers often update protection schemes.

    6. Contacting manufacturer support

    If all methods have been exhausted, the official path remains - request a password from support. Most brands provide a code upon request, but may require:

    • 📄 Photo of the receipt or warranty card.
    • 📷 Photo of the sticker with the serial number and IMEI.
    • 🔗 Data from the account to which the radio is linked (for models with Android 11+).

    📬 Support contacts for popular brands:

    Brand Email/Website Response period Notes
    Pioneer support@pioneer.eu 3–5 days Require a scan of the owner's passport
    Joying service@joyingauto.com 1–2 days Send the code after checking S/N
    Atoto support@atoto.com 24 hours You need to send a photo of the IMEI
    Xtrons technical@xtrons.com 5–7 days They may request a video of the device

    ⚠️ Attention: Some manufacturers (for example, Pioneer) block the issuance of passwords for devices purchased not from official dealers. In this case, only a service center will help.

    7. Extreme measures: flashing and resetting via Fastboot

    If the password cannot be recovered, it remains full reset through the firmware. all data, but will restore access to the settings.

    🔧 Methods:

    • 🔄 Reset via Recovery:
      1. Turn off the radio.
      2. Hold Power + Volume Up (for Rockchip) or Power + Menu (for MediaTek).
      3. In the Recovery menu, select Wipe data/factory reset.
    • 🖥️ Firmware via Fastboot: 
      fastboot flash system system.img

      fastboot erase userdata
      

      fastboot reboot

      (requires official firmware from the website manufacturer).

      • ⚠️ Attention: On radios with locked bootloader (Pioneer AVH-Z5200BT, Kenwood DDX9907S) incorrect firmware can lead to "brick" (complete inoperability). In this case, a programmer and soldering work will be required.

      What is a "brick" and how to avoid it?

      "Brick" is a condition when the radio does not turn on and does not respond to buttons. Reasons:

      - Interrupted firmware.

      - Incompatible software version.

      - Error when unlocking the bootloader.

      To avoid:

      1. Use only official firmware.

      2. Do not turn off the power during the process.

      3. Connect the radio to a stable 12V source (not through the cigarette lighter!).

      FAQ: Frequently asked questions about passwords on Android radios

      Can I find out the password by the car's VIN code?

      No, VIN code is not associated with the radio password. The exception is standard radios of premium brands (BMW, Mercedes), where the code can be linked to the on-board system. For after-market devices (Pioneer, Joying) VIN is not used.

      What to do if after resetting the radio requires a Google account?

      This is FRP blocking (Factory Reset Protection). To bypass it:

      1. Connect the radio to Wi-Fi.
      2. On the Google account entry screen, click on the email field and enter a, then select it and select "Help."
      3. Go to your browser settings and reset your password via chrome://settings (the method does not work on all firmware).

      For new devices (Android 12+) you may need FRP-tool (for example, GSMTool or Octoplus).

      How to reset the password on the radio without losing settings?

      Without losing data, this is only possible if:

      • You have backup settings (made through Titanium Backup or adb backup).
      • The radio supports separate erasing (for example, only resetting the password without deleting music and contacts). This is available on some Xtrons and Dasaita via Engineer Mode.

      In all other cases, resetting the password will lead to the deletion of user data.

      Do apps for cracking passwords help? Android?

      apps like Android Multi Tools or iMyFone LockWiper do not work with most Android radios for reasons:

      • There is no support for custom firmware (for example, Hal9k or MTCD).
      • Access to /data/partition is blocked due to security DM-Verity.
      • Devices often run on non-standard kernels (for example, Rockchip RK3368 or Allwinner T3).

      The only working software — ADB and Fastboot (described above).

      Can I change the factory password myself?

      Yes, on most radios the password can be changed in the menu: Settings → Security → Screen lock → Change password.
      🔹 Important:

      • The new password must be 4–8 digits (letters and symbols are not supported).
      • On some devices (Atoto S8) requires entering the old password.
      • After changing, write down the code in a safe place - recovery through support may take weeks.