Typing a router password a few dozen times a day is slow, and it encourages everyone to use the same short one. Here is how to make signing in to routers, switches and OLTs a single keypress, without weakening anything.
Why automate it
- Speed. Technicians reach a device in seconds.
- Strong passwords. Nobody needs to remember or type a long random one.
- Less sharing. The password is used by the app and never pasted into a chat.
- A record. On team plans there is a login trail of who connected to what.
Step by step
- Install the Windows app from nettforge.com/download and sign in. Your vault unlocks on your PC.
- Add the device. Give it a name, its address and a type (router, switch, OLT and so on). Put it under the right client or tower.
- Add credentials in order. Create a credential set with every login the device might use, most likely first. Several devices can share one set.
- Test Keychain Login. The app tries each credential over SSH or the RouterOS API until one succeeds and remembers the winner. If a device uses an SSH key, add that instead of a password.
- Use WinBox Quick Connect. Press
Ctrl + Alt + W, pick a router, and WinBox opens signed in. - Open a terminal. SSH and Telnet sessions, and serial (COM port) consoles, open inside the app, using the same saved login.
- Use Auto-Type for anything else on Windows: it types the password into the window you are in.
Keeping it safe
- The vault stays zero-knowledge. Credentials are decrypted only on your PC while the app is unlocked.
- Lockout-aware. The login attempts stop when a device signals a lockout, so you are not locked out of a tower by your own tool.
- One credential per purpose. Do not reuse one admin password everywhere just because it is now easy. Use separate credentials per client or per tower, and rotate them when staff change. See the leaver checklist.
- Restrict the API. If you enable the RouterOS API, allow it only from your management addresses.
Next steps
Read a password manager for MikroTik teams for the whole picture, and the network toolbox for what to do once you are connected. Team plans and prices are on the plans section.
Questions people ask
No. Your vault is unlocked on your own PC and the app connects straight from your PC to the device. The password is used locally and is not sent to NettForge.
Keychain Login stops as soon as it sees a lockout, and remembers which saved login last worked for that device, so it normally tries the right one first.
Yes. A client can have its own WireGuard tunnel that runs inside the Windows app, so connections to that client's devices go through it without changing anything else on your PC.