Two passwords, two levels of access
Every MT4 and MT5 account comes with two passwords. The trading password (also called the master or main password) lets you open, modify and close trades. The investor password gives read-only access: you can see positions, history, balance and equity, but every attempt to trade is refused by the broker's server.
| Action | Investor password | Trading password |
|---|---|---|
| See open positions and history | Yes | Yes |
| See balance, equity, margin | Yes | Yes |
| Open, modify, close trades | No | Yes |
| Withdraw or transfer money | No | No |
| Change account passwords | No | Yes, in the terminal |
Which password a copier needs
A source account only needs to be watched, so the investor password is enough and is the safer choice: the copier physically cannot change anything on the source. A target account must receive orders, so it needs the trading password.
If you add a target with the investor password by mistake, the broker rejects every order. CopyTraderTool detects read-only access when the account connects; copiers into a read-only target are paused with a clear message instead of failing silently.
Why neither password can withdraw money
MetaTrader passwords control the trading account, not your money at the broker. Deposits and withdrawals happen in the broker's client area (sometimes called the personal area or cabinet), with a different login, usually with two-factor authentication and payment details checks. Someone with your trading password could trade badly, which is a real risk, but cannot send funds out.
Where to find or change the passwords
- Both passwords are in the account-opening email from your broker.
- In the MT4/MT5 desktop terminal you can change either password from the account settings; you need the current trading password to do it.
- Most brokers also let you reset passwords in their client area.
If you change the trading password of a target account, update it in the copier too. Until you do, the account shows as disconnected and copies into it can't be placed.
Good habits
- Give a source's investor password, never its trading password, to anyone who only needs to watch or copy it.
- Use a service that stores credentials encrypted and lets you delete them. In CopyTraderTool they are encrypted with AES-256-GCM and removed when you delete the account.
- Turn on two-factor authentication on the copier account itself.
- If you stop using a service, change the trading passwords of the accounts it traded.