ThinkPad Password Removal

There are a few cases where you may need to remove the supervisor password from a ThinkPad laptop, e.g. buying a used model on eBay. You may think that removing the CMOS battery for a few moments should be enough to clear the password store. In ThinkPads though, as with most other business/enterprise line laptops, there is a dedicated security chip, which handles “BIOS password” storage and verification. To reset a supervisor password the chip needs to be desoldered and/or reprogrammed with special equipment.

There is a way easier method though.

A bunch of clever people figured out that shorting the SDA and SCL pins of the chip while the password input is getting verified silently gets around the verification process and thus accepting empty passwords.

You are then able to enter the (unrestricted) BIOS settings and remove the supervisor password.

General procedure

Compatibility
These method described below seems to only work for older ThinkPads (up until the ‘__30’ series, e.g. X220, R500, T430, etc.)

You need to take apart the device and find the security chip. Most ThinkPads use either the PS08 (24RF08) or the smaller package L08.

The teardown procedure and chip location differ for every model. Please consult the hardware maintenance manual for your device.

Once you identified the security chip and the correct pins (SDA and SCL) you need to power on your ThinkPad and immediately start shorting both pins together and keep them connceted until you entered the BIOS successfully. Timing matters here. The correct moment differs between devices. Often though you need to short after powering on and before display init. If you shorted too early the machine will not boot; too late and it will not work.

When you see the BIOS password prompt, just hit enter and you should get into the unlocked BIOS settings if your timing was correct. You need to then stop shorting the pins and may reset the supervisor password.

Note: There have been reports of the supervisor password resetting long after it has been reset. You may work around it by disconnecting the CMOS battery and/or setting the supervisor password to a non-empty value.

Listed below are chip locations and notes for popular ThinkPad models. More models are available here.

Most pictures are taken from allservice.ro. Thanks to them and their users for the excellent resources.

ThinkPad R61

Source

ThinkPad R400

Source

ThinkPad R500

Source

ThinkPad T61

Source

ThinkPad T400

Source

ThinkPad T400s

Source

ThinkPad T410

Source

ThinkPad T410s

Source

ThinkPad T420

Source

ThinkPad T420s

Source

ThinkPad T430

Source

ThinkPad T430s

Source

ThinkPad T431s

Source

ThinkPad T500

Source

ThinkPad T510

Source

ThinkPad T520

Source

ThinkPad T530

Source

Alternative pinout

(This method worked perfectly on a ThinkPad T530 for me)

The L08 chip on a T530 is located on the hard to reach underside of the mainboard below black tape. As pointed out by user “eatbuckshot” in the comment section here there is a direct wiring connection between the WWAN pins 30/32 and the SDA/SDL pins on the security chip.

So, instead of digging for the security chip, you may also short pins 30 and 32 on the lower WWAN mPCIe row while booting to get the desired result.

ThinkPad W500

Source

ThinkPad W510/W520

Source

ThinkPad W700

Source

ThinkPad X1

Source

ThinkPad X1 Carbon

Source

ThinkPad X61

Source

ThinkPad X200

Source

ThinkPad X201

Source

ThinkPad X220

Source

ThinkPad X300

Source