What is a BIOS password?
A BIOS password is checked by the firmware itself, before any operating system loads. Because it does not depend on Windows, macOS, or Linux, booting a different operating system does not get around it. On UEFI systems it is still commonly called a BIOS password, and vendors also use names such as setup, supervisor, administrator, system, or firmware password.
Types of firmware passwords
| Password | Other names | What it protects |
|---|---|---|
| Supervisor password | Administrator, setup, or BIOS password | Entering setup and changing settings. The PC still boots normally without it. |
| User password | Power-on, boot, or system password | Starting the computer. The prompt appears at every power-on, before the OS loads. |
| Hard drive password | Drive or ATA password | Access to the drive itself. It is stored on the drive, so it follows the drive into another computer. |
CompTIA's wording matches the first two rows: BIOS password for the setup lock and boot password for the power-on lock.
Why technicians set them
- A supervisor password stops users from changing the boot order to start a USB tool that bypasses Windows sign-in, and from disabling Secure Boot, the TPM, or ports that policy has turned off.
- It protects settings on shared and public computers such as lab machines and kiosks.
- A power-on password adds a check before the OS, but it does not encrypt anything. Someone who removes the drive can read it in another computer. To protect the data itself, use full-disk encryption such as BitLocker with the TPM.
Setting and managing the password
In setup, the options are usually on a Security page. Store the password in the organization's password vault or documentation. On many business laptops a lost supervisor password cannot be cleared on site, and recovery can mean a manufacturer service request or a system board replacement. Enterprise management tools from the major PC makers can set and change firmware passwords across a fleet.
Resetting a forgotten BIOS password
- Most desktop motherboards: clear CMOS. Shut down, unplug the power cord, then use the clear CMOS jumper (often labeled CLR_CMOS, CLRTC, or JBAT1) as the manual describes, press the clear CMOS button some boards have on the rear panel, or remove the coin-cell CMOS battery for several minutes.
- Clearing CMOS resets every firmware setting to default, including boot order, date and time, and any RAID or virtualization options. Note settings before clearing if you can.
- Business laptops and many brand-name PCs keep the supervisor password in protected non-volatile storage that a CMOS clear does not touch. Recovery goes through the manufacturer's support process with proof of ownership.
- A computer that turns up with an unknown firmware password and no ownership record should be treated as possibly stolen.
BIOS password on the CompTIA A+ exam
Core 1 objective 3.5 lists both boot password and BIOS password under BIOS/UEFI settings, alongside boot options, USB permissions, TPM security features, and Secure Boot. Know the difference: the BIOS (supervisor) password protects settings, and the boot (user or power-on) password is needed to start the computer. Know that clearing CMOS resets it on most desktops but not on many business laptops, and that it does not protect data on a removed drive. Workstation hardening in Core 2 builds on this. If a scenario asks how to stop users from booting from USB drives, the answer combines boot order, disabling USB boot, and a BIOS password so the settings stay locked.