Investor Password vs Master Password in MT4 and MT5

Every MetaTrader 4 and MetaTrader 5 account has two passwords. The master password gives full access: trading, closing positions and changing orders. By contrast, the investor password gives read-only access: someone logged in with it sees balances, positions and history but cannot trade. Neither password moves money; deposits and withdrawals happen in your broker's client area, which has its own login.

Keeping the two apart protects your account. You can share the investor password to show results to a mentor, a prop firm or a journal app, while keeping trading control to yourself.

What each password allows

When to share the investor password

• Showing a live track record to a mentor or community without risk.
• Connecting a journal or analytics service that only needs to read trades.
• Letting an accountant or tax adviser review activity.
• Proving results for a job application or a fund allocation.

Even read-only access shows your balance and every trade, so share it only with people and services you trust, and change it afterwards if needed.

How to change your passwords

On desktop MT5, right-click your account in the Navigator and choose Change password, or use the Tools menu, then Options and the Server tab. Enter the current master password, choose whether to change the master or the investor password, and set the new one. MT4 uses Tools, Options, Server, Change. Some brokers also let you reset both from the client area, which is the route to use if you have forgotten the master password.

Use long, unique passwords for each. A password manager makes this easy, and keeps you from saving the investor password in the login box by mistake, which is the most common reason the trade buttons turn grey. Our guide to the greyed-out New Order button covers that case.

Scams that misuse these passwords

Account managers and signal sellers on Telegram and WhatsApp often ask for your master password so they can "trade for you". Once they have it, they can open huge positions, run the account into a stop out, or trade against your account from one of their own. Because they never withdraw, some victims do not realise the risk until the balance is gone.

Never give anyone your master password, and never give your client-area login to anyone at all. Regulators in many countries warn about unlicensed account management. Our guide to Telegram and WhatsApp scams shows the patterns.

Passwords on VPS and journal services

When you set up MT5 on a VPS to run an EA, it needs the master password, because the EA must trade. Keep that VPS login private and protected with its own strong password. For journal and analytics services, which only read trades, the investor password is enough; a service that insists on the master password is a warning sign.

Prop firms often ask for the investor password of a personal account to verify experience, and some signal marketplaces ask for it to show live results. Sharing it in those cases is reasonable, since it cannot trade. Change it once the purpose is finished.

Forgotten passwords

If you forget the master password, the terminal cannot recover it. Use the client area's password reset for the trading account, or contact support, who will verify your identity before issuing a new one. A forgotten investor password is simpler: log in with the master password and set a new investor password from the terminal. Never accept a reset sent from an unknown email address or a link in a chat message.

Two passwords, two logins

It helps to keep three credentials separate in your head. The MetaTrader master password trades. Its investor password only watches. Your client-area login, usually your email and its own password, controls money, documents and account settings. A leak of the investor password is a privacy issue; a leak of the master password is a trading risk; a leak of the client-area login is a money risk. Protect them in that order of importance, from the client area down.

Brokers that offer two-factor authentication usually apply it to the client area, where withdrawals happen. Turn it on. Some also send an email or SMS each time a MetaTrader login connects from a new device, which is worth enabling if available.

If you think someone has your master password

1. Change the master password immediately from the terminal or client area.
2. Reset the investor password too, so old shared access ends.
3. Update your client-area password and turn on two-factor authentication if offered.
4. Check the History tab for trades you did not place, and report them to the broker.

Frequently asked

Official sources: MetaTrader 5 Help

Related reading

• MT5 New Order button greyed out
• Export MT5 trade history
• How to spot a fake forex broker
• Scam brokers to avoid