If you run MikroTik gear, you know the pattern. There is a core router, a handful of tower routers, switches, radios and an OLT or two. Each has a login. Some share one, some are different, and the real list lives in a spreadsheet, a shared note or someone's head. This page is about doing it properly.
The problem with the usual ways
- A shared spreadsheet or document is readable by everyone who can open it, copied into emails, and never updated when someone leaves.
- A general password manager stores logins well but does not know what a router is. It cannot try the three passwords your older routers might have, launch WinBox for you, or tell you a tower has gone down.
- The browser's saved passwords are tied to one person's profile and cannot be shared safely with a team.
What a MikroTik-aware vault does
NettForge is a zero-knowledge password manager with network tools built in. For MikroTik teams that means:
- Device templates. Routers, switches, OLTs, radios, UniFi and more are first-class items with address, ports and the right fields, not just "a website with a password".
- Keychain Login. Give a device an ordered list of credentials. NettForge tries them over SSH or the RouterOS API until one works, stops if the device locks you out, and remembers the winner.
- WinBox Quick Connect. In the Windows app, press the hotkey (Ctrl + Alt + W), pick the router, and WinBox opens already signed in. See how to automate WinBox and SSH logins.
- Auto-Type. Fill a password into any Windows program, even ones with no browser.
- Discovery. Point NettForge at one router and it reads that router's neighbours, DHCP leases and ARP table to build your device list for you.
- Leaver Lockdown. When a technician leaves, change the real password on a RouterOS device, prove the new one works and the old one no longer does. See the leaver checklist.
- Config backup. Save a router's configuration (passwords left out), keep it in the vault, and see exactly what changed since last time.
Set it up in about ten minutes
- Create an account and install the Windows app.
- In the Windows app, switch on the RouterOS API on one router (
IP, Services, api) and allow it from your management address. - Add that router as a device and give it a credential set. Add every login your devices might use, in the order you want them tried.
- Run discovery from that router to bring in its neighbours.
- Try Quick Connect on a device. If the first credential fails, NettForge moves on to the next by itself.
Good to know. Discovery, diagnostics and Leaver Lockdown use the RouterOS API (port 8728 by default), so it must be enabled on those routers. WinBox and SSH logins do not need it. NettForge only ever sends the credentials you saved to the device they belong to.
Compared with the alternatives
| Spreadsheet | General password manager | NettForge | |
|---|---|---|---|
| Encrypted, zero-knowledge | No | Yes | Yes |
| Knows what a router or OLT is | No | No | Yes |
| Tries several saved passwords per device | No | No | Yes |
| Opens WinBox already signed in | No | No | Yes (Windows app) |
| Changes the real device password when someone leaves | No | No | Yes (RouterOS) |
| Watches the network and tells you what is down | No | No | Yes (Polaris) |
| Share with a team, with roles and a log | Poorly | Yes | Yes |
Want the team side? Read password management for ISPs and MSPs, or see plans and prices in rand (Teams R129, Business R179, MSP R229 per user per month, in early access).
Questions people ask
Yes. The RouterOS API login used for discovery, diagnostics and Leaver Lockdown works on modern RouterOS (the plain login introduced in 6.43 and used by v7). WinBox quick connect and SSH logins work on any version that supports them.
Inside your zero-knowledge vault. Each login is locked on your device before it is synced, so NettForge's servers only hold locked boxes. A router password is never sent to us in readable form.
Yes. Keychain Login takes an ordered list of saved credentials, tries them one by one, stops on success or on a lockout, and remembers which one worked for that device.
Yes. The Windows app's Config backup tool exports a router's configuration over SSH, leaves passwords out, keeps the copies in your encrypted vault, and shows what changed since the last backup, with firewall and user changes flagged.