evidenceverified, inferred, ruled out
Why take this seriously, and where it fails
You are being asked to run a stranger's program on your laptop and then send that stranger money. You should want more than a confident sentence. This is the case, including the parts that are against us.
Recovered on our own Predator Helios 16 and typed successfully at its F2 prompt.
corroborated A stranger found the same thingA board-repair moderator described the same arrangement on a different Acer, with no contact with us.
inferred The rest is a reasonable priorSame BIOS family and era across the Intel Acer range. A prior is not evidence and we say so.
limits Four ways this failsNamed and ranked, rather than buried. Any of them costs you nothing.
1What the method is, in the terms we can give
Your BIOS does not keep your password. It keeps a one-way value derived from it, and when you type a password at the F2 prompt the firmware runs the same transformation and compares. That value has to be somewhere the firmware can reach it every time the machine starts, which means it is still on your laptop right now, whatever you have forgotten.
That is what we read, and that is what we work backwards from. It is not a UEFI variable, which is why the guides that tell you to go hunting through your firmware settings come up empty, and it is not in the same place on every machine, which is why tools that assume a fixed location fail on half the models they meet.
Recovery happens offline, on our own equipment, against that value. Your code.txt plays no part in it.
What we are not publishing, and why
How the value is constructed, what marks it, and where it is kept. Those three things are the research, and they are the only thing standing between a paid service and a script that anyone can run — including the people who currently charge to desolder your chip.
The tool you download does not contain them either. It knows how to fetch what we need and nothing whatsoever about how the answer is worked out, which is why there is nothing in it worth pulling apart, and why we will never ask you to switch off your antivirus to run it.
We recognise the awkwardness: the specifics would make this page more convincing, and we are choosing not to give them. What we can offer instead is a structure where you do not have to take our word for anything, which is section 4.
2What is verified, and what is a guess
Every claim below carries its own confidence. Nothing is dressed up as more than it is.
Acer Predator Helios 16, PH16-71, InsydeH2O 1.18
Our own machine, our own capture. The transformation was fully reversed and the supervisor password recovered from it, then typed successfully at the F2 prompt on the real hardware. It has been done more than once, including a blind test: a password was set on the machine and withheld from the person doing the recovery, who produced it anyway. This is the machine the whole thing was built on, and it works.
Acer Nitro Lite 16, NL16-71G
Not our work. A moderator on a well-known board-repair forum, independently and without any contact with us, described the same storage arrangement on this board while helping someone else — a different product line, a different board, a different firmware image, the same structure. We are not linking it, for the reason in the box above. It remains the most useful fact on this page precisely because it is the one we did not produce.
Other Intel Acers with 12th, 13th or 14th generation Core chips
Predator, Nitro, Aspire, Swift, TravelMate. The supported tier: $100 with a proof of purchase and $150 without, usually within 24 hours. These share the platform generation with both machines above, which is the thing that actually decides it. That is a reasonable prior and most enquiries land here. It is not evidence, and we will not pretend otherwise until a capture from such a machine reaches us. Being inferred is a good outcome for you rather than a hedge: we expect it to work, and you pay nothing if it does not.
Intel Core Ultra
Taken on, at $200 with a proof of purchase and $250 without, with a turnaround of up to 72 hours rather than the usual 24. It is the dearest tier and the reason is worth being precise about: Core Ultra is a different family from Core i7, not a newer version of it, so a brand-new Core Ultra machine sits further from the cheap tier than a 13th-generation one, not closer. These take us more work per machine, and the price says so rather than the coverage table hiding it.
Intel Core 11th generation and below
Also taken on, at $150 with a proof of purchase and $200 without, again with up to 72 hours rather than the usual 24. Older machines need more work from us per model, which is what the higher price covers. Neither this tier nor Core Ultra is a refusal, and neither is a queue you are waiting in: the free check gives you the firm answer and the exact price before you commit to anything.
Acer Chromebooks and Acer desktops
Chromebooks, and the desktop lines — Orion, Nitro N50, Veriton, Aspire TC — are built on entirely different firmware. Nothing here applies to them, at any price, and the free check will not change that. Send one if you would rather have it confirmed — the answer will be the same.
AMD Acers
Not supported, and not a matter of us not having tried. The method needs an Intel platform, so on an AMD machine there is nothing to read and nothing to attempt — for a fee or for free. There is no AMD version coming, and we would rather say that plainly than leave you hoping. Send a file if you would rather hear it from us; we will look, and the answer will still be no.
Machines not running Windows
The capture tool is a Windows program, so the laptop has to be running Windows with an administrator account available — that is a requirement on every tier rather than an assumption. A machine running Linux or anything else cannot be done as things stand. The password sits in firmware rather than in the operating system, so installing Windows would bring it back into scope, but that is the owner's decision and not something we promise or support.
Those last three, together with the on-screen-code machines in section 3, are genuinely refused rather than a dearer tier or a longer queue: we do not look at them at all, and there is no point running the tool or sending us a file for one. What is left — Intel Acer laptops running Windows, whatever the generation — is what the free check is for.
All of that is a prior. There is one definitive test for any machine, regardless of everything above, and the capture tool performs it in about a minute. The free check is how you get it done: run the tool, email us the file, and we reply with whether your laptop can be done, what it will cost and how long it will take, at no charge whatever the answer. That is a better answer than anything we could promise you in advance.
Both timings above are targets rather than deadlines, and unsupported machines sometimes need a remote session so we can gather more detail — free when we are the ones asking for it. And the two columns are two prices rather than one price with something taken off: establishing ownership takes us more work when there is no proof of purchase.
3Things that do not work, and how we know
A service that claims everything works is a service that has not tried much. Here is the negative knowledge, which is harder to come by than the positive kind and which you can check against your own experience.
Your code.txt cannot be solved. Not by us, not by anyone.
The file is base64 wrapped around an RSA-encrypted blob, and the digits inside it were generated at random on your machine at the moment it locked. They are not derived from your serial number, your model, or anything else that could be worked backwards from, and there is no way to check a guess without the machine in front of you agreeing. Seven BIOS lockout cycles went into establishing that, which is seven separate waits with a dead setup screen. It is not a puzzle waiting for a cleverer person. It is closed.
Anyone who offers to decode your code.txt for money is either working from an older scheme that your machine does not use, or is not being straight with you.
If your Acer shows an 8 or 10 digit code on the screen, you do not need us
Some older Acers display an 8 or 10 digit code at the password prompt itself, right there on the screen. Those are solved instantly by free tools that have existed for years, and you should go and use one — it will cost you nothing and take a minute. We would rather tell you that than take your money for something you can have for free, so we refuse those machines outright rather than inviting a file we could do nothing with.
The machines we exist for are the newer ones, which give you a code.txt file instead, and which those free tools cannot touch.
The old Acer master-password generators do not apply
bios-pw.org, BiosBug and dogbert's bios-pwgen answer an older Insyde prompt. On a machine that emits code.txt they have nothing to work with. That is not a criticism of them — they were written for a scheme Acer has since replaced.
Hashcat is irrelevant here
There is no InsydeH2O mode in hashcat, and adding one would take longer than running the purpose-built GPU code we already have.
Removing the CMOS battery achieves nothing
The password does not live in volatile memory. It survives the battery, a full discharge and a BIOS reset, which is the single most common piece of bad advice on this subject.
Acer's own service declined, with proof of purchase in hand
Worth knowing before you spend a fortnight in their support queue. Your experience may differ, and if they will do it for you then let them — it is their machine's firmware and they are welcome to it.
Hardware routes are real, and they are where laptops die
A programmer and a chip clip will get at the same data, and it does work — in the hands of someone who does it every week. It is also the one route on this page that can destroy your laptop outright. The clip has to seat perfectly on a chip smaller than a fingernail while the board is powered; get the alignment, the voltage or the pinout wrong and you burn the chip. A burnt chip means a dead motherboard, and on most machines that costs more than the laptop is worth.
That is the risk you are being asked to take by every service that wants the laptop posted to it, and by every forum thread that ends in "just get a programmer". No programmer, no clip and no soldering iron touches anything here. We read, over the wire, and the machine never leaves your desk. As far as we can find, no other service recovers these passwords without physical possession of the laptop.
4Why there are no testimonials on this page
Because there are no customers yet. This is a new service, and that sentence is more use to you than five invented five-star reviews with stock photographs attached.
So instead of asking for trust, the process is arranged so that you do not have to extend any:
- The tool is free and read-only. Check its SHA-256 before running it. It cannot write to your firmware.
- You find out before you pay. The free check tells us both whether your machine is workable, and tells you the price and the turnaround, at no cost and with no commitment.
- You pay after, never before. No deposit and no assessment fee. If we fail, you owe nothing.
- If a delivered password does not work, you are refunded in full. We verify every password against your own machine's stored value before sending it, so this is rare — and because it is rare, a claim needs a short video of it failing on the machine. Section 8 sets out exactly what to film.
- Your file is sealed before it leaves your machine. Not even you can read it, which means nobody intercepting your email can read your machine's identifiers either.
- Two things are excluded on purpose, though the tool can see them. Your disk-encryption key material and your secure-boot certificates. When the tool lists what your machine has, those two are recorded by name and size only — never their contents, and not even a fingerprint of them. There is one honest limit, and we would rather state it than have you find it: on a model we have not seen before, the tool has to send a copy of the firmware itself, and those settings are stored inside that copy, so on those machines they do reach us. We do not filter that copy, because filtering it would destroy the very thing we need to read. That is the restraint and its exact edge, rather than a promise to be nice.
5What will go wrong, if something does
In rough order of likelihood:
- The tool cannot read your machine. Some Intel platforms close that door. You learn this in the first few seconds, for free.
- What we need is not present on your model. Then the method does not apply to it, and no amount of effort on our side changes that.
- It is present but arranged differently. Your model does things a way we have not mapped. Sometimes we can work it out from the capture, sometimes not.
- The password is long and unusual. Recovery works against a one-way value, so an unusual password takes longer and a genuinely random twelve-character one may not fall at all. This is where the guesses box on the form earns its place — a half-remembered fragment can turn an impossible job into a quick one.
If any of those happen you will be told which one, in plain words, and charged nothing. We would rather have a reputation for saying no than for taking money hopefully.