JACE Default Credentials: Default Username, Password and IP Address

A factory-fresh JACE 8000 uses platform credentials tridium / niagara at IP address 192.168.1.140, and forces you to set new credentials on first connection.

"What is the default password for a JACE?" is one of the most common questions we get, usually from an engineer standing in front of a controller with no paperwork. The answer depends on what you are trying to log in to (the platform or the station), whether the JACE has ever been commissioned, and which model it is. This guide explains the defaults, why they usually no longer work on a commissioned controller, and the correct way to regain access when credentials have been lost.

Platform credentials vs station credentials

A Niagara controller has two separate sets of logins. Mixing them up causes most "wrong password" problems.

JACE 8000 default credentials and IP address

On a JACE 8000 in its factory-shipped state (new, or after a factory reset):

To connect, set your laptop to a fixed address on the same subnet, for example 192.168.1.10 with mask 255.255.255.0, plug into the JACE's Ethernet port, and open a platform connection to 192.168.1.140 in Workbench.

On first connection Niagara 4 forces you to create a new platform user and password. The factory defaults cannot be kept. After that, tridium / niagara no longer works, so on any JACE that has been commissioned the defaults are irrelevant unless the unit is factory reset.

JACE 9000 default credentials

The JACE 9000 follows the same security principle: it ships unconfigured and requires new platform credentials to be set during commissioning with Workbench, after which only those credentials work. Its first commissioning takes much longer than a JACE 8000's (allow 15 to 20 minutes or more while the operating system and Niagara are unpacked), so do not assume a slow first connection means the wrong credentials.

Before commissioning a JACE 9000, make sure its SD card is fitted. Without it the Host ID is reported incompletely and licensing fails.

Station credentials: there is no universal default

There is no factory default station password. When an engineer creates a station with the New Station wizard in Workbench, they set the admin user's password at that moment. The station also has a station passphrase that encrypts sensitive data in the station file.

So if you are trying to log in to a station's web interface and do not know the password, no published default will help. You need the credentials from the integrator who commissioned it, or you need to reset them legitimately (see below).

Older JACEs (NiagaraAX)

AX-era JACEs (JACE-2, JACE-3E, JACE-6E, JACE-7) used different defaults and procedures, and the platform user and passphrase rules were looser. They cannot run Niagara 4. If you are still running AX hardware, recovering access is only part of the problem; plan an upgrade (see what is a JACE controller?).

The default credentials don't work: what now?

Work through these checks before resetting anything.

1. Are you on the right connection type?

Platform credentials will not open a station, and station credentials will not open a platform. Check whether Workbench is doing Open Platform or Open Station.

2. Has the JACE been commissioned?

If the controller has ever been commissioned, tridium / niagara will have been replaced. Check the site's O&M manual, the previous integrator's handover documents, or your company's password vault.

3. Is the IP address actually 192.168.1.140?

A commissioned JACE has whatever address the integrator set. If you cannot reach it, connect to the serial shell through the debug port to read or change the network settings (see serial shell access).

4. Is it a connectivity problem rather than a credential problem?

TLS and certificate prompts, a wrong port (3011 vs 5011 for TLS), or a blocked firewall can all look like a failed login. See platform login failing.

How to recover lost JACE credentials

Lost platform credentials (JACE 8000 and JACE 9000, Niagara 4.4 or later)

You do not need to factory reset. Tridium provides a credential reset through shell mode:

1. Connect to the JACE's debug port with a serial terminal (115200 baud, 8 data bits, no parity, 1 stop bit, no flow control).
2. Reboot the JACE. When the message "Press ESC to choose alternate boot options…" appears, press ESC.
3. From the shell menu choose 8 – Reset Platform Credentials.
4. Record the Host ID, Token and OS version displayed.
5. Send them to your Tridium distributor (for controllers supplied by Tyrrell Products, our support team). The distributor submits them to Tridium, which validates ownership and issues a reset key.
6. Enter the reset key in shell mode within 24 hours.

Do not exit shell mode or reboot while you wait for the key; doing so generates a new token and invalidates the request. The full procedure is in how to generate a platform reset token. This method resets the platform credentials and system passphrase without deleting the station.

Lost station admin password

If you have the station files and its passphrase, or are entitled to reset the passphrase, you can reset the admin password offline in Workbench and copy the station back. Be aware that changing the station file's passphrase clears every stored password in the station (drivers, email, MQTT, users), which must then be re-entered. See how to reset a passphrase and the "Station Passwords" video in our advanced engineering guides.

Factory reset: the last resort

A factory reset returns a JACE 8000 to tridium / niagara at 192.168.1.140, but removes all platform and station data. Only do it if you have a station backup and the licence, or are deliberately starting again. On older JACE 8000s running early Niagara 4 releases, a factory reset can also leave the controller unable to boot because of a known date issue; see restoring connectivity after a factory reset.

Credentials on other Niagara hosts

The same principles apply across Niagara hardware, with some differences:

A glossary of Niagara credentials

• Platform user: account used to connect to a host's platform (software, licences, station copying).
• Station user: account inside a station, used for Workbench station connections and web logins. Each has roles and permissions.
• Station passphrase: encrypts sensitive values stored in the station file, such as passwords used by drivers and services. Needed to open or run a station on another host.
• System passphrase: protects sensitive platform-level data on a host.
• Licence and Host ID: not credentials, but you will need them for any recovery involving Tridium.

Knowing which one you have lost points you straight to the right recovery method.

Inheriting a site: first steps

If you are taking over a Niagara site with no handover:

1. ask the building owner for any credentials, backups and O&M documents they hold
2. contact the previous integrator in writing for credentials and passphrases
3. identify each controller's model, Niagara version and supplier
4. take backups of anything you can access before changing anything
5. use the shell-mode platform reset for JACEs where credentials cannot be obtained
6. reset station credentials only with backups in hand, and re-enter cleared passwords
7. create owner and integrator accounts and document everything for the next handover

Securing JACE credentials properly

Default and shared credentials are among the most common weaknesses in building systems. After commissioning:

• give every engineer and operator their own account; never share admin
• use long, unique passwords, stored in a password manager or vault, not in the O&M manual in the plant room
• apply least privilege: operators do not need platform access
• enable two-factor authentication or LDAP for station logins where possible (see two-factor authentication and LDAP integration)
• record the station passphrase and platform credentials securely at handover, so the building owner is never locked out of their own system
• remove accounts of people who have left, and review user lists at each maintenance visit

Handover checklist for building owners

When a Niagara system is handed over, the owner should receive, in a secure form:

1. platform usernames and passwords for every controller and supervisor
2. station admin credentials (or an owner account with full rights)
3. the station passphrase for each station
4. the system passphrase where applicable
5. current station backups
6. licence files and Host IDs
7. IP addresses and network settings

Without these, a change of integrator can turn into a costly recovery exercise.

Frequently asked questions

What is the default password for a JACE 8000?

A factory-fresh JACE 8000 uses platform username tridium and password niagara. You must set new platform credentials on first connection, so these defaults do not work on a commissioned controller.

What is the default IP address of a JACE 8000?

192.168.1.140 with subnet mask 255.255.255.0.

Is there a default station password on a JACE?

No. The station's admin password is set by whoever creates the station. There is no universal default.

How do I reset a forgotten JACE platform password?

On a JACE 8000 or 9000 running Niagara 4.4 or later, use the shell-mode Reset Platform Credentials option to get a token, obtain a reset key from Tridium through your distributor, and enter it within 24 hours. No factory reset is needed.

Does a factory reset restore the default credentials?

Yes. A JACE 8000 returns to tridium / niagara at 192.168.1.140, but all station and platform data is erased.

What is the default password for a JACE 9000?

The JACE 9000 is commissioned with new platform credentials set during first commissioning in Workbench. Use the credentials recorded at commissioning, or the shell-mode reset if they are lost.

Can I log in to a JACE with the station admin account on the platform?

No. Station users and platform users are separate. Use platform credentials for Open Platform and station credentials for Open Station or the web interface.

Is tridium / niagara a security risk?

Only on an uncommissioned controller. Niagara 4 forces new platform credentials on first connection, so a commissioned JACE cannot be accessed with the factory defaults.

Will the account lock after failed logins?

Niagara applies lockout policies to repeated failed logins to slow down password guessing. Wait for the lockout period or have another administrator unlock the account.

Why does Workbench reject the correct password?

Common causes are using platform credentials on a station connection (or the reverse), connecting on the wrong port or without TLS, certificate prompts, or account lockout after repeated failures.

Where should JACE credentials be stored?

In an access-controlled password vault, with a copy held by the building owner, not on labels or in documents left in the plant room.

Should operators have platform access?

No. Operators need station accounts with appropriate roles. Platform access is for engineers who manage the controller itself.

Related guides

• How to generate a platform reset token
• How to access the serial shell on a JACE
• Platform login failing
• JACE FAQs