Investor password: what it is & is it safe?

The investor password in a nutshell

The investor password is a second, read-only password for your MetaTrader 4 or MetaTrader 5 account. It grants read-only access: anyone logging in with the investor password can see open positions, the full trade history, balance and equity – but cannot trade, cannot change settings, and cannot withdraw funds. That is exactly why it is the standard tool for letting a third party analyze or verify an account without handing over control. With every regulated broker, withdrawals run separately through the back office and are technically impossible from the trading platform at all.

Master password vs. investor password

Every MT4/MT5 account has two separate passwords:

| Password | Access | Used for | | --- | --- | --- | | Master password | Full trading access | Trading yourself, running EAs, managing the account | | Investor password | Read-only | Showing the account, analysis, third-party verification |

The two are independent. You can share the investor password without the recipient ever gaining access to your master password. Anyone who had read access loses it the moment you change the investor password – the master password stays untouched.

Why read-only is truly read-only

Read-only access is not just a UI setting; it is enforced server-side by the broker. A platform connected with the investor password technically cannot issue OrderSend or PositionOpen commands – the trade server rejects them. In practice this means:

• No trading: no new positions, no closing, no modifying.
• No account changes: leverage, profile data and settings stay locked.
• No withdrawals: withdrawals only happen after identity verification through the broker back office – never through MT4/MT5, and therefore never through the investor password.

So the maximum exposure when sharing it is visibility into your trade data – not loss of capital.

Is it safe to share?

With a reputable, genuine read-only service: yes. Still, handle the access deliberately:

• Trusted services only. Established analytics platforms (e.g. Myfxbook, FXBlue) and our own Portfolio Analysis use read-only connections exclusively.
• Beware "account management" offers. Anyone asking for the master password wants to trade – an entirely different risk class. For pure analysis, the investor password is always enough.
• Revocable at any time. A new investor password removes any third party's access in seconds (see below).
• No anonymous bots. Do not hand the password to unknown Telegram bots or shady "signal copiers".

Setting or changing the investor password

In MT4 and MT5 the path is almost identical:

1. Open Tools → Options (MT4) or Tools → Settings (MT5).
2. Select the Server tab and click Change Password.
3. Enter your current master password, then choose the Investor password type.
4. Set and confirm the new investor password.

A new investor password immediately invalidates the old one. That is how you revoke read access from an analytics service or another person without touching your master password.

How to analyze your EA account risk-free

This is exactly where our free Portfolio Analysis comes in: you connect your account read-only and instantly see your metrics across multiple EAs and brokers – drawdown, profit factor, correlation and combined risk. Because only the investor password is used, your capital stays under your sole control at all times.

For a real example of a read-only connected account, see our public Live Multi-EA Showcase – an actual account embedded in read-only mode.

Related guides

• Trading metrics explained: drawdown, profit factor, Sharpe & Sortino – so you read the analysis numbers correctly.
• EA portfolio management – combining multiple EAs cleanly.
• Broker comparison – which brokers suit EA and algo trading.

Bottom line

The investor password is the safe, read-only key to your account. It is perfect for showing performance transparently or having an EA portfolio analyzed – without ever giving up trading or withdrawal rights. As long as you only share it with reputable read-only services and change it when needed, the risk is minimal.