Your BIOS is showing a code. Here is the one that clears it.
Type the code your laptop shows. Every known scheme is tried at once, in this browser.
Manufacturers this tool covers
Sixteen generators across seven manufacturers, all of them computed in this browser. If your laptop is not here, the models page says what is and is not covered, and why.
Finding the code
At the setup screen, F2 on most machines, type the password wrong three times. Firmware of this vintage then stops accepting input and prints something instead, under a heading like System Disabled, Password Check Failed, Unlock Code or just a bare string on an otherwise empty screen. It is different on every machine.
What it looks like depends on who made the laptop. Acer and other InsydeH2O machines show 8 or 10 digits. Asus shows what looks like a date. Samsung and Fujitsu show hexadecimal. HP shows one of three things depending on the model, and has its own page. Dell's older hard-drive-serial backdoor is covered; its newer service-tag scheme is not, and no generator we know of covers Lenovo. You do not need to identify it: copy it exactly as shown and the box above tries every scheme at once.
Write it down with the leading zeros and any dashes. The zeros matter: a code starting with one can be read two ways inside some firmware, which is why the tool sometimes hands back more than one candidate. The dashes do not matter and are stripped, but keeping them makes it easier to check you copied the whole thing.
If the screen says “Enter Unlock Code” with no number beside it, or your laptop wrote a file to a USB stick instead, this tool does not apply to it, and neither does any other generator. Look your model number up (the code on the underside label, like PH16-71) and it will tell you which of the two you have. Every site telling you to paste a key into a box is describing an older machine than yours. Here is what a code.txt actually contains and why there is nothing in it to solve.
Entering the code
Take the answer back to the locked machine and type it at the same prompt, then press Enter. The shape of the answer depends on the scheme: the InsydeH2O 8-digit variant returns 8 digits, its 10-digit variant returns 16 hexadecimal characters, and several of the other manufacturers return a mix of letters and digits. Where letters appear, type them as shown, case does not matter.
If more than one family matched what you typed, each is labelled with the manufacturer it belongs to. That is not the tool hedging: some code shapes are genuinely valid input to more than one scheme, and there is no way to tell from the code alone which machine you are holding. Try the one matching your laptop first.
If the machine drops you into the setup screen, it worked. Clear or change the password while you are in there, and reboot to confirm it is gone.
Once you are in, set the password to something you will keep. This same prompt will be waiting the next time.
If it did not work
- Re-read the seed. A misread 8 for a 3, or a dropped leading zero, produces a code that will never be accepted. This is by far the most common cause.
- Try every code you were given. When the tool returns several, they are ordered by likelihood, not preference. The last one is as valid a candidate as the first.
- Some machines want a reboot between attempts. The prompt can stop accepting input after a wrong try; power-cycle and fail the password again to get a fresh one.
- The seed may have been regenerated. On a few firmware versions the number changes each time it appears. If so, use the one currently on screen, not the one you wrote down yesterday.
If none of that helps, your machine is very probably on the newer scheme rather than this one, and no generator anywhere will open it. That is the problem this site's paid service exists for: the paid recovery starts with a free report that tells you which situation you are in.
How it works, and why we can publish it
The number on your screen is not random. The firmware computes it, and it computes what it will accept from the same value, using a fixed transformation that ships inside every copy of that BIOS. Because the transformation is fixed and the firmware is public, it could be, and was, extracted and published. On the 8 digit variant it is barely cryptography at all: a constant string, an addition, an exclusive-or and a remainder. The 10 digit variant is heavier, running the seed through SHA-256, an AES block and a CRC, but it is just as deterministic.
The work is not ours. It comes from dogbert's reverse engineering and the implementations in pwgen-for-bios and insydious. Ours is a reimplementation of the same published derivation, served unminified at /unlock.js so you can read what you are running, and licensed GPL-3.0 like the work it derives from. bios-pw.org does the same job and has for years; we host it here so people who arrive at this site with the older lock are not sent away to find out.
None of this is how the paid service works. That addresses a different scheme on newer machines, where no such shortcut exists, and its specifics are not published anywhere on this site. The models page explains the distinction and what stays withheld.
Use it on a machine you own. It is your firmware and your password, and this is not a way into somebody else's.
These tools are free, and stay free
No account, no email address, no paid tier, and nothing you type here is sent anywhere.
Sixteen generators across seven manufacturers, all of them computed in your own browser. The work they are built on is other people's, published years ago and licensed so that anyone can reimplement it, which is why this costs nothing and why the code is served unminified for you to read.
Hosting and the time to keep adding manufacturers are not free, so there are a few ads on the page. If you would rather chip in instead, or as well, there is a link below. It is entirely optional and nothing on this page is withheld from anyone who does not use it.
This is for the free tools and the site, and nothing else. The paid Acer recovery service is never paid through PayPal. That one is settled by cryptocurrency, Western Union or MoneyGram, or a bank transfer, deliberately, because a reversible payment on a job that cannot be un-done is an invitation to abuse. How paying for the service actually works.