Pager Programming Passwords

These are used by service providers to keep other people from re-capping (reprogramming) pagers on their service. Often, the customer is told that they are buying the pager when they enter a service contract, only to find that they are unable to use this pager on another service. This is clearly unethical.

Some service providers use the same password on every pager, so they are not much of a problem once you know the password. For instance:

Service Password
SkyNet THEBEST or dictionary
SkyTel THEBEST or dictionary

Here's and even longer list of pager passwords.

Positive Communications uses a changing system, dependent on either the serial number or capcode of the pager.[From Shawn Monahan].

For Page Usa, the password is bp or lp for plus pagers, ex for express, ue for ultraexp, en for the encores and after it, put the last 3 digits of the serial number. [From Alton Yu]

Motorola pagers offer the user 8 chances to get the password correct. If the user fails, the pager is disabled and the code plug must be replaced. (unless someone knows how to fix this and will tell me). I do not know the procedures for other manufacturers.

Several places have offered pager password breaking equipment and services. Here is a sampling below. Please note that I do not give any particular recommendation to any provider:

My understanding is that passwords can be read from some Motorola pagers (Memo Express, others...?) by soldering wires in 6 places. I don't have specific instructions on this.


For the older Bravo Plus and Express pagers, fixing the pager disabled is easy. The operations work on the pagers with the codeplug S22 and some others. On the Express pagers it's the pocsag 0-3 (pocsag 4 will not work) and with the Plus pagers, all pagers w/ the bigger vibrator motors will work (only some of the ones with smaller vibrators will work).

For the plus, what you need to do is when programming the pager, get into the program screen (screen where you press F4 and it does it) and take a wire and short the TP20 (usually the very bottom pin on the front of the pager below the codeplug) to a ground -- the neg. end of the speaker or the bottom where the battery contacts will also work. when programming, let go when you see the status bar and you will get the codeplug is unprogrammed message. enter in something in the box and that'll be the pager's new serial number. Note: UUUUUUUUU will appear on the pager screen when performing this operation.

For the Express pager, you can take something to short pins counting from the left 3 & 4. -- on the 8pin -- the connector that connects the receiver board to the decoder board. (when the pager is disabled, the pager no longer powers up. this will power it up) you will need bravo express software version 1.00 to read the password -- same operation as the plus except instead of using the program function, you use the read function (F3) and press enter when it asks for the password. [From Alton Yu]

This HTML was authored by Dr.Who.