Current Answer: Modern wg-easy v15 Has No Universal Default Password
The 2024 CasaOS question asked for the default password after installing WireGuard Easy. That question belongs to an older generation of wg-easy packaging. Current wg-easy v15 starts with an explicit first-run setup where you create the username and password yourself. There is no safe universal “admin/admin” credential that should be published or reused.
On a Fresh v15 Install, Create Your Own Account
The current wg-easy first setup asks for username, password and confirmation during User Setup, then host and WireGuard port information.
Do Not Use Old PASSWORD or PASSWORD_HASH Advice on v15
wg-easy v14 commonly used environment variables such as PASSWORD_HASH. v15 changed configuration substantially and its migration path imports v14 configuration through the new setup process. If you copy a years-old CasaOS Compose file into v15, authentication variables can be misleading or unsupported.
The wg-easy version tags warns users to match instructions to the image version and avoid ambiguous tags.
Check the Container Image Version First
docker inspect wg-easy --format '{.Config.Image}'
docker logs --tail=100 wg-easyIf you are on v14, follow v14-specific migration/authentication material. If you are on v15, use the new setup flow. Do not change authentication settings until the actual running major version is known.
Pin a Major Version Instead of Using an Ambiguous latest Tag
Current wg-easy material recommends a major-version tag such as :15 so updates stay within compatible v15 releases. This avoids accidental breaking changes and makes your ZimaOS/CasaOS deployment reproducible.
Protect the Web UI Like an Admin Console
The wg-easy dashboard can create and revoke VPN clients, display QR codes and expose peer configuration. Keep the UI LAN/VPN-only where possible. If it must be public, put it behind HTTPS and strong authentication.
The Tailscale remote access is an alternative when you only need remote NAS access rather than managing WireGuard peers yourself.
Persist /etc/wireguard Before Recreating the Container
Current wg-easy Compose examples persist WireGuard configuration. Back up that state before migration or password recovery so existing peers are not lost simply because the web container is replaced.
The ZimaOS backup covers the recovery layer.
If You Inherited an Unknown Old Password
Do not search the internet for a “default” credential and expose the UI while guessing. Identify the image version, preserve configuration, follow that version's reset/migration process, and rotate the password after access is restored.
WireGuard Keys Matter More Than the UI Password
The dashboard password protects administration, while peer private keys authenticate VPN clients. If configuration files or QR codes have been exposed, changing only the web password does not revoke those peers. Remove/reissue affected clients.
Recover Access Without Throwing Away Every Existing Peer
If the old web password is unknown but the WireGuard service is still carrying traffic, back up the persistent configuration before recreating anything. A password-reset or v14-to-v15 migration should not automatically become a VPN-key reset for every phone and laptop. Preserve the existing peer definitions, follow the matching major-version migration process, then verify each client after the new admin account is created.
Also test the VPN from outside the home network after any authentication migration. A working admin page only proves the management UI is healthy; it does not prove UDP forwarding, peer keys, routes or DNS are still correct.
FAQ
What is the wg-easy default password?
Current v15 uses first-run account creation and does not have a universal default password.
Does PASSWORD_HASH still work?
It belongs to the older v14 configuration model; v15 uses a different setup/migration flow.
How do I know which wg-easy version I run?
Inspect the container image tag and logs before following version-specific authentication instructions.
Should I expose the wg-easy UI to the internet?
Prefer LAN/VPN-only access. If public exposure is necessary, use HTTPS and strong authentication.
Will resetting the UI password revoke VPN clients?
No. Peer WireGuard keys are separate; revoke and recreate any peer whose configuration was exposed.
