ThinkPad BIOS password reset: methods and limits
A ThinkPad BIOS password reset starts with identifying the lock. Restoring BIOS defaults and removing a forgotten supervisor password are different tasks. This guide explains CMOS battery removal, EEPROM, MFG and LPC methods and their limits. A successful attempt on an older device cannot simply be repeated on a modern ThinkPad.
The T-series models used here illustrate comparable generations of premium Intel-based ThinkPads. The same developments affect other premium model families; the table is not a complete compatibility list. The mainboard, controller and Lenovo BIOS generation determine which method applies. Updated October 2026.
Quick access: known methods at a glance, Boot Guard, LPC and eSPI and our approach.
Identify the lock
Supervisor Password (SVP): Protects administrative access to UEFI / BIOS. The prompt shown when opening BIOS settings can often be skipped, leaving protected settings unavailable. A mandatory SVP prompt during system startup is a different situation.
Power-On Password: Protects startup. System Management Password: Controls BIOS permissions according to configuration. Drive password: Protects an HDD or NVMe drive. Lenovo explains the different password types.
Certificate-Based BIOS Authentication (CBA): A certificate takes the place of the supervisor password. For the on-screen authentication request, the responsible IT team generates an unlock code using the request data and the corresponding private key. This code is a one-time password: it works once for the current logon within the same power-on cycle. See our CBA guide.
Windows sign-in, BitLocker and MDM / Intune are additional layers. A BIOS unlock does not decrypt storage or remove device management. Our service description explains what is covered.
Recognise lock prompts and error messages
System Security: Supervisor Password Required blocks startup until the supervisor password is entered. Windows will not boot either. Unlike the often skippable “Enter Password” prompt when opening BIOS settings, this screen cannot be skipped.
0183: Bad CRC of Security Settings in EFI Variable indicates an incorrect checksum for security settings in an EFI variable. It is not a regular password prompt. An unknown SVP can prevent access to the BIOS settings needed to correct it.
0177: Bad SVP data, stop POST task indicates an incorrect checksum for supervisor-password data and stops the startup test. Both errors appear in Lenovo's maintenance documentation for the ThinkPad T14 Gen 6. Send your model and the complete message so we can assess the case.
Check for existing credentials first
Ask the previous IT team or owner for the password or the responsible certificate administrator. For company equipment, confirm the order and approval with the responsible party.
Record the model, MTM and exact prompt. Does it appear at startup or only when opening BIOS? Does Windows still boot? These details help identify the issue.
Changing or removing a BIOS password you know
If you know the current supervisor password and are authorised to change it, use the password settings in UEFI / BIOS and the guide for your exact model. Changing or removing a known password is different from resetting a forgotten BIOS password. Lenovo explains the password types and their management; available functions depend on the model and configuration.
When setting a new BIOS password, store it securely and check with the responsible IT team for company devices. If the previous credentials are unknown, start with our forgotten ThinkPad BIOS password FAQ. Our service page explains the assessment for professional removal.
ThinkPad BIOS password reset: does removing the CMOS battery help?
“Removing the CMOS battery deletes the supervisor password” is a myth. Password data resides in non-volatile storage and survives without battery power. This also applies to older ThinkPad generations: removing the backup battery was not an SVP reset then, and it is not one now.
The suggestion “Load BIOS defaults and the password will disappear” does not work either. It resets configuration values but does not erase an existing SVP.
“BIOS password” is an imprecise umbrella term. Instructions for older power-on passwords or other computers are often confused with the ThinkPad supervisor password. Lenovo's general password reference helps distinguish these locks.
Known methods at a glance
The Intel-based T-series models illustrate each generation of comparable premium ThinkPads. The same methods can also be found in other model families of those generations.
| Device example | Known methods and password storage |
|---|---|
| Older generations through T430 | Separate EEPROM; external access and widely used SDA/SCL shorting methods |
| T440 through T480 | Password in the EC's security EEPROM; temporary UEFI patches with the MFG bit set (Manufacturing Mode) |
| T490 through T14 Gen 1 | Password storage in the EC; LPC shorting on individual boards |
| T14 Gen 2 to the present | Modern Intel platforms with eSPI instead of LPC; the known LPC shorting method no longer applies. We use our own method for SVP and CBA. |
| Model families with other EC variants | Depending on the controller, dedicated EC programmers can directly access its storage and remove the password. |
Through T430: the separate EEPROM
Older ThinkPads through the T430 generation store password and device information in a separate EEPROM. Historical methods access this storage externally and modify the password data.
SDA/SCL shorting methods are also widely known. They temporarily disrupt communication with the EEPROM while entering BIOS. On suitable devices, this can bypass the password prompt and allow a new password to be set.
From T440: storage in the Embedded Controller
With this generation, Lenovo replaced the separate password EEPROM and moved the information into the security area of the Embedded Controller (EC). The BIOS flash and password storage are separate. Writing or rewriting the BIOS chip does not erase the supervisor password stored in the EC.
In repair discussions, the controller is sometimes also called SIO / Super I/O. Other model families use different EC variants. On suitable controllers, the password area can be read and modified directly. This requires dedicated, generally more expensive EC programmers and a sound understanding of the controller and its memory layout.
T440 through T480: firmware patches and MFG Mode
Temporary UEFI patches became available for Intel platforms of this Lenovo BIOS generation. With the MFG bit (Manufacturing Mode) set, they could run an unlocking routine that accesses the EC's security area. The protection policies in use at the time allowed these changes despite the presence of Boot Guard.
The patch enables access to the EC. The password itself is still not stored in the BIOS chip.
Boot Guard: why firmware cannot be modified freely
Intel Boot Guard verifies BIOS firmware at startup. Signed firmware regions are checked against the manufacturer's designated key. Its hash and the protection policies are permanently anchored in platform fuses. A modification that fails an enforced signature check stops firmware startup.
Secure Boot acts later in the boot chain, checking the operating system's bootloader in particular. The two features protect different layers. Disabling Secure Boot therefore does not remove Boot Guard's protection of the BIOS. Intel explains the signature chain and its hardware foundation.
ALLservice's development work
Victor Voinea / ALLservice.ro is one of the pioneers of ThinkPad unlocking. His public post about the UEFI DXE solution dates from October 2015. In our view, his development work and early commercial unlock service made a substantial contribution and helped move the repair community forward. We value his longstanding expertise and want to give this work explicit credit.
From T490: newer UEFI, GUI and Self-healing BIOS
With the T490 generation, Lenovo moved to a newer UEFI base with a graphical interface and larger flash storage, such as 32 MB. Self-healing BIOS was added to recover damaged firmware. This feature appears in Lenovo's T490 specification.
The old MFG and patch method used on the T440–T480 generation no longer works on this newer BIOS generation. Lenovo tightened the Boot Guard protection policies. Unauthorised changes to the protected firmware regions prevent BIOS startup. “GUI BIOS” and “32 MB BIOS” are common shorthand for this generation; the limits come from the protection mechanisms, not the interface or storage capacity.
MaxPower3, LPC and the move to eSPI
MaxPower3 published an EC-related shorting method in the Badcaps thread “Lenovo ThinkPad EC PWD Bypass”. We also want to give explicit credit to this contribution.
LPC shorting follows a principle similar to older EEPROM methods: on suitable boards, communication with password storage is temporarily disrupted. The BIOS then detects no effective password protection, and setting a new password replaces the previous state.
LPC stands for Low Pin Count and eSPI for Enhanced Serial Peripheral Interface. Intel developed eSPI as the successor to LPC. The transition fundamentally changes the protocol and signalling. Intel's eSPI specification.
The known LPC shorting method does not work on eSPI platforms. Simple shorting is therefore not a practical unlocking route for the modern ThinkPads we focus on. Possible exceptions involving targeted interventions require detailed specialist knowledge and, in our workshop experience, are usually uneconomical because of the time involved.
Our independently developed approach
UnlockNG has developed its own method, independently of the public patching and shorting methods described here. We focus on modern ThinkPads with SVP or CBA. We can also assess and service older devices.
Based on our current technical knowledge, we see no fundamental model-related limit to our method within the ThinkPad platforms we have considered. This assessment comes from our development work and service experience.
The device finder shows the status of our model checks. An unconfirmed model does not mean unlocking is technically impossible. We confirm service availability after assessment.
Weighing up DIY attempts and professional service
Unsuitable firmware, incorrect voltages or damaged contacts can leave a working device unable to start. Sound technical knowledge, suitable tools and reliable backups of the original state are essential.
An inexpensive programmer such as the CH341A and a clip do not replace that knowledge. Larger BIOS storage and more complex firmware structures also make correctly restoring a BIOS image more demanding. Being able to read or write a chip does not establish that the image is correct or that the chosen unlocking method works.
A useful guide identifies the board, firmware version, outcome and known side effects. Tell us about earlier flashing, repair or shorting attempts when enquiring; these help us assess the starting condition.
Service assessment and partners for other devices
Our ThinkPad BIOS password removal service works on the existing device or a removed mainboard. A locked ThinkPad need not be replaced or sold for parts without first considering an unlock. We agree on the model, lock type, scope and price before shipping and discuss the next steps with you.
For other manufacturers or work outside our focus, we can draw on our independent expert network. We work with a range of specialists and repair companies to find a suitable contact for your enquiry.
For the screens described above, see the FAQ on locks and error messages. Data privacy and shipping and our process explain the next steps. Examples of completed work appear in ThinkPad unlocking in practice.