A factory reset is not an erase. On nearly every router, modem and access point sold this century it is a copy operation: the device writes a stored set of defaults over one small region of its flash memory and reboots. Everything outside that region sits exactly where it was. Good news at 11pm when you have locked yourself out of something you need working. Considerably worse news the morning you list it on eBay.
- What it rewrites
- The configuration region only — settings, Wi-Fi, port forwards, credentials you set
- What it leaves
- Bootloader, firmware, radio calibration, MAC addresses, serial, label credentials
- What returns by itself
- ISP provisioning, and anything a vendor cloud or ACS re-pushes on boot
- What it is not
- A secure erase. Nothing outside the config region is overwritten
Where a router’s configuration actually lives
Open the firmware image for almost any consumer router and you find the same shape. A few megabytes of NOR flash — 8 and 16 MB being usual — carved into partitions by the bootloader. Wi-Fi 6 and Wi-Fi 7 hardware has largely moved to NAND or eMMC, but the layout logic did not change.
A bootloader, usually U-Boot or Broadcom’s CFE on older kit. A small partition for its environment variables. One or two firmware partitions holding the kernel and a read-only squashfs root. A configuration area — an NVRAM blob on Broadcom-derived firmware, a compressed config file on others, a writable overlay on OpenWrt. And a factory partition, called art, caldata, factory or devinfo depending on the chipset, written once on the production line and never again.
Only one of those is involved in a factory reset.
What the reset writes, and what it simply leaves
Two mechanisms cover almost everything on the market. Stock vendor firmware runs a reset daemon that writes the vendor’s default configuration over the config partition and reboots. OpenWrt’s firstboot erases the overlay — rootfs_data — and nothing else, so the next boot mounts a bare overlay over the untouched read-only squashfs. Same outcome, same narrow blast radius.
So “reset” means “restore this one region to a known state”, not “sweep the chip”. Logs, crash dumps, analytics databases, downloaded firmware images and user-uploaded certificates frequently live outside the configuration blob, and whether they get cleared is a per-vendor decision rather than a law of physics.
ASUS ships that distinction in its own interface. Under Administration → Restore/Save/Upload Setting, Restore clears the settings and the log; Initialize also drops the accumulated database behind Traffic Analyzer and the AiProtection event log. The recessed button behaves like Restore. Two definitions of “factory default” on one router, and the pin gives you the weaker one.
Then the flash itself. On NAND and eMMC the controller does wear levelling, so a block holding an earlier copy of your configuration can sit unmapped long after the logical version was replaced. Reaching it means desoldering the chip and reading it directly — not what the buyer of your old router on Gumtree has in mind. But “needs lab equipment” is not the same as “gone”.
Nothing here is a secure erase
No consumer router offers the sanitise or crypto-erase function you get on an SSD. If it held a site-to-site VPN key or a certificate for a client network, treat the flash as recoverable and scrap the hardware rather than passing it on.
Firmware does not go backwards
A factory reset restores the default settings that shipped with whatever firmware is currently installed. It does not reinstall the firmware the unit left the factory with, and there is no single factory version to return to anyway — units come off the line with whatever build was current that month.
So if an update introduced the fault you are resetting to escape, the reset will not undo it. You have to flash an older image deliberately, and several vendors block downgrades outright or push you through the recovery procedure to do it. Same logic on third-party firmware: reset a router running DD-WRT and you get DD-WRT with default settings, not the stock vendor interface back.
The numbers on the label, and the keys underneath
The factory partition carries more than calibration. It typically holds the device’s MAC addresses, its serial number, the WPS PIN, the radio tuning data, and on modern hardware the per-device default SSID, Wi-Fi passphrase and admin password printed on the sticker. Neither a firmware update nor a reset overwrites it.
The printed defaults work again after a reset because they were never in the configuration to begin with — they are read out of a protected region at boot. That is also why they work for whoever owns the device next, and why the sticker is worth a thought before you photograph it for a listing. On hardware predating per-device defaults, that credential is a model-wide constant shared by every unit ever built, which is what the A–Z list of factory default passwords documents — model by model, as with the NETGEAR defaults or the TP-Link defaults.
The calibration data sits there for a hard engineering reason: the values are measured per unit on the production line, and no two units share them. Erase them and the radios transmit at the wrong power or refuse to come up at all. Vendors write-protect the region so no reset, no flash and no user action can touch it.
Cable modems carry something stronger. Every DOCSIS modem is issued an X.509 certificate and private key at manufacture, chaining to a manufacturer CA, and that pair authenticates it to the CMTS under BPI+. Nothing you can press resets, clears or rotates it. It identifies that specific modem to the operator for the life of the hardware, which is why an operator can refuse to provision a modem still registered to somebody else’s account.
The keys that do change
SSH host keys and the self-signed HTTPS certificate for the admin interface are generally regenerated after a reset. Expect a fresh browser certificate warning and, if you manage the device over SSH, a host-key mismatch against known_hosts. Both are normal here, and both would be alarming at any other time.
What comes back on its own
On ISP-supplied equipment a reset is closer to a request than a command, because the operator re-provisions the device the moment it comes back up.
A cable modem powers on, ranges on the downstream and upstream, takes an address by DHCP, then pulls a configuration file from the operator’s TFTP server. That file carries the service tier, the rate limits, the SNMP settings and whatever else the operator sets. Two minutes after a reset it is all back, because none of it was ever yours to erase.
DSL, fibre and gateway equipment usually does the same over TR-069. The ACS URL is part of the factory default configuration on carrier kit — that is the entire point of shipping it that way — so the device calls home on boot, the auto-configuration server recognises it, and down come the PPPoE credentials, the VLAN tags, the VoIP settings and, very often, the SSID and passphrase held on the operator’s record.
Hence the complaint: I factory reset my router and the old Wi-Fi password came back instead of the one on the label. Nothing went wrong. The reset worked, and thirty seconds later the ACS overwrote it with the operator’s stored values. If those values are stale, the reset reproduces the wrong state as faithfully as it would the right one. That is a call to the ISP, not another reset. If you are staring at a login screen, work through the recovery ladder for locked-out devices rather than resetting again.
Vendor clouds are inconsistent, and it bites when hardware changes hands. TP-Link documents that a factory reset releases the TP-Link ID binding on a router, so it can be registered to a new account — but on a Deco you must reset the unit and delete the Deco network in the app before the binding clears. An eero is worse: the reset leaves the unit on the previous owner’s account, and because a serial number can only be registered to one network at a time, the new owner cannot add it until the old owner removes it in their app.
| Item | After a reset | Why |
|---|---|---|
| Bootloader and its environment | Unchanged | Separate partition, usually write-protected |
| Radio calibration data | Unchanged | Factory partition; erasing it breaks the radios |
| MAC addresses, serial, WPS PIN | Unchanged | Same factory partition, written once on the line |
| Default credentials on the label | Unchanged | Read from protected flash, not from the config |
| Firmware version | Unchanged | Only a flash writes the kernel and rootfs |
| Your settings, Wi-Fi, port forwards, DNS | Gone | They live in the region being rewritten |
| Logs and analytics databases | Vendor-dependent | ASUS clears these on Initialize, not on Restore |
| Files on attached USB storage | Unchanged | Different device entirely |
| ISP provisioning | Returns in minutes | Re-pushed by DOCSIS config file or TR-069 ACS |
| Vendor cloud binding | Vendor-dependent | TP-Link ID releases; an eero stays bound |
The 30-30-30 reset is over
Hold reset for 30 seconds, pull the power while still holding for 30 seconds, restore power and hold for 30 more. It was genuinely useful once, in the DD-WRT era, on Broadcom MIPS hardware where it forced the full NVRAM clear that the normal button sometimes failed to achieve.
DD-WRT’s own documentation now warns against it on ARM-based routers, and on current hardware it is at best a no-op. The reset button is a GPIO line polled by a userspace daemon with a hold threshold. Hold it while the OS is not running and nothing is recorded — there is nothing running to record it.
Worse, on several vendors holding reset while power is applied is the documented route into firmware recovery, not configuration reset. ASUS calls it Rescue Mode: hold Reset, plug in the power, keep holding, and the power LED flashes slowly to show the router sitting in the bootloader waiting for the Firmware Restoration utility to push it an image. Run a 30-30-30 on one of those and you land in a state that looks convincingly bricked and is not.
Do not cut the power mid-reset
The one reliable way to brick a router during a reset is to interrupt it while it is writing defaults and rebooting. Once you release the button, leave it alone for two to three minutes, however dead it looks.
What works instead is dull. With the unit powered on and fully booted, hold the recessed button with a pin for as long as the vendor documents — TP-Link says roughly 6 to 10 seconds, ASUS says 5 to 10 — and watch for the LED signature, usually every indicator flashing at once and then going dark. Then release and wait.
Many devices give that one button two thresholds: a short press reboots, a long press resets. A hurried four-second press on a device expecting ten gets you a reboot and the firm conviction that the reset did not work. If the defaults still will not take, the default password not working after a reset has its own set of causes worth ruling out.
Capture this before you press it
- Photograph the label and note the firmware version. Model, hardware revision, serial, default credentials. The hardware revision decides which firmware and which documented reset procedure apply to you.
- Write down the WAN side by hand. PPPoE username, connection type, any VLAN ID for IPTV or voice, static addressing, custom DNS. This is the one people forget, and it is what leaves you offline rather than merely inconvenienced.
- Screenshot port forwards and DHCP reservations. Reservations are tedious to rebuild from memory and fail silently when they go missing.
- Save a configuration backup, but do not rely on it. Backups are frequently not portable across firmware versions, so treat the file as a reference document rather than a restore point.
Save yourself an evening of re-pairing
Record the SSID and passphrase character for character first, then set them back to exactly that after the reset, before you change anything else. Every phone, laptop, printer, thermostat and camera rejoins on its own, and nobody has to go round the house with a ladder and a WPS button.
Before you sell, return or scrap it
Order matters here, because two of these stop working once the device has been reset.
- Unbind the cloud account first, while the device still works. eero, Deco, Orbi, Nighthawk and ASUS Router all hold an account-side record. Unbind the TP-Link ID under Advanced; on a Deco, delete the network in the app as well. Reset first and you may lose the route to the record you need to delete.
- Cancel any dynamic DNS hostname. The name stays claimed to your account, pointing at whoever ends up with the hardware.
- Clear by hand what the reset will not touch. USB storage and attached drives, VPN client certificates, OpenVPN keys, Samba shares, printer configurations.
- Then reset, and check it took. Reconnect, confirm the default Wi-Fi network appears and the label password logs you in. That is your evidence the config region really was rewritten.
- For anything sensitive, reflash rather than reset. Writing a firmware image and then resetting overwrites far more of the chip than a reset alone. Not a certified sanitise, but a real improvement.
ISP equipment is not yours to sell
Return it. The factory certificate ties it to the operator’s records permanently, a buyer often cannot get it provisioned, and unreturned-equipment charges keep running long after the box has left the house.
A reset clears your configuration from one partition of one device. It does not clear the ISP’s record of your line, the vendor’s record of your account, the saved network profiles on every client that ever joined, or the lease history on everything else in the house. Those need handling separately, and none of them cares how long you hold a button.
