Raspberry Pi Setup Guide: Imager, First Boot, and Headless Install

A fresh microSD card, a power supply, and a laptop are enough to bring a Raspberry Pi online. You don’t need a monitor or keyboard. Raspberry Pi Imager writes the OS and bakes in your username, Wi-Fi credentials, and SSH access before the board ever powers on. This guide covers the full path: flashing, first boot, headless login, and the first hardening steps.

Quick Takeaways

• Tool: Raspberry Pi Imager 2.0+ flashes the card and preconfigures the system in one wizard.
• OS: Raspberry Pi OS (Debian Trixie base). Use Lite for headless servers and Desktop for monitor-based use.
• No default login: you must create your own username and password. The old pi / raspberry pair is gone.
• Headless essentials: hostname, user, Wi-Fi, locale, and SSH. Set all five in Imager before writing.

What You Need Before You Start

Hardware:

• A Raspberry Pi (5, 4, 3, 400/500, or Zero 2 W)
• A microSD card from a known brand (fakes cause random corruption)
• A microSD card reader
• A quality USB-C or micro-USB power supply
• An Ethernet cable (optional, but the most reliable first connection)

Software:

• Raspberry Pi Imager for Windows, macOS, or Linux
• A terminal: Windows Terminal, macOS Terminal, or any Linux shell
• An SSH client (built into current Windows 10/11, macOS, and Linux)

Power matters. An underpowered supply causes undervoltage warnings, SD card corruption, and USB devices dropping out. On a Pi 5, a 3A supply limits USB peripherals to a lower current budget, so use the 5A unit if you plan to attach drives.

Step 1: Choose the Right Raspberry Pi OS Image

Raspberry Pi OS now builds on Debian 13 “Trixie”, and Trixie is offered as the default option in Raspberry Pi Imager. Pick the variant that matches your use case.

Use 64-bit on the Pi 3, 4, 5, and Zero 2 W. Use the 32-bit image only on older boards such as the original Zero.

Step 2: Flash the Card with Raspberry Pi Imager 2.0

Imager 2.0 replaced the old hidden “advanced options” window with a guided wizard. The steps are Device, OS, Storage, Customisation, Writing, and Done. Customisation is no longer a separate pop-up, so it sits in the main flow.

1. Insert the microSD card into your card reader and launch Raspberry Pi Imager.
2. Device: select your Pi model. Imager filters the OS list to compatible images.
3. OS: choose Raspberry Pi OS Lite (64-bit) for headless work.
4. Storage: select your card. Double-check the drive. Writing erases everything on it.
5. Customisation: fill in the settings below.
6. Writing: confirm and wait for the write and verify to finish.

Customisation Settings That Matter

Two details trip people up:

• Username and password are mandatory, because there is no default user any more.
• In Imager 2.0, the localisation step also sets the wireless regulatory domain, and the separate Wi-Fi country field is gone. A wrong region can hide 5 GHz channels or stop the radio from associating.

For SSH you can pick password authentication or a public key. Keys are safer. Generate one on your computer first:

# Generate an Ed25519 key pair (press Enter to accept the default path)
ssh-keygen -t ed25519 -C "pi-lab"

# Print the public key so you can paste it into Imager
cat ~/.ssh/id_ed25519.pub

Paste the public key into the Remote access screen. Imager installs it into the new user’s authorized_keys.

Step 3: Understand What Imager Writes (cloud-init)

Recent Raspberry Pi OS releases use cloud-init for first-boot provisioning. It marks the start of a move away from the legacy firstrun.sh customisation system. Since Imager 2.0, cloud-init configuration for Raspberry Pi OS is generated by default.

After flashing, the small boot partition (bootfs) holds files such as user-data and network-config. You can edit them by hand before first boot if you prefer text files to a GUI. A minimal user-data looks like this:

#cloud-config
hostname: pi-lab
enable_ssh: true          # Raspberry Pi OS option: starts the SSH server on first boot
ssh_pwauth: false         # Disable password logins once you use keys
users:
  - name: techie
    groups: [sudo]
    shell: /bin/bash
    lock_passwd: false
    ssh_authorized_keys:
      - ssh-ed25519 AAAA...your-public-key... pi-lab

And a Wi-Fi profile in network-config (Netplan syntax, using the default NetworkManager backend):

network:
  version: 2
  wifis:
    renderer: NetworkManager
    wlan0:
      dhcp4: true
      access-points:
        "YourSSID":
          password: "YourWiFiPassword"

Field names can change between OS releases, so compare against the current Raspberry Pi documentation if a setting is ignored.

Step 4: First Boot

1. Eject the card safely and insert it into the Pi.
2. Connect Ethernet if you have it (optional).
3. Apply power.

The first boot takes longer than later ones. Expect two to three minutes while the Pi applies your Wi-Fi and SSH settings and expands the filesystem, and it may reboot itself once. The activity LED flickers during this time. Don’t pull power.

If you plug in a monitor and keyboard and skipped customisation, the system launches a first-boot wizard that makes you create a user. Headless setups skip it because Imager already created the account.

Step 5: Connect Over SSH (Headless Login)

Find the Pi by hostname. Most modern systems resolve .local names through mDNS.

# Test that the Pi is on the network
ping pi-lab.local

# Log in (replace 'techie' with the username you created)
ssh techie@pi-lab.local

If .local doesn’t resolve, find the IP address instead:

# Linux/macOS: scan your subnet (adjust to your network range)
nmap -sn 192.168.1.0/24

# Or check your router's DHCP client list for "pi-lab"
ssh techie@192.168.1.57

Accept the host fingerprint on the first connection. You should land at a shell prompt.

Headless Connection Troubleshooting

The Pi Zero W and Zero 2 W support only 2.4 GHz Wi-Fi. If your router merges both bands under one SSID, split them temporarily.

Step 6: Post-Install Essentials

Run these commands right after your first login.

# Update the package list and upgrade everything
sudo apt update && sudo apt full-upgrade -y

# Reboot to load a new kernel or firmware if one was installed
sudo reboot

Reconnect, then open the configuration tool:

sudo raspi-config

Useful menu areas:

• Interface Options: enable I2C, SPI, UART, or the camera for hardware projects.
• Localisation Options: adjust time zone, locale, or Wi-Fi region.
• Advanced Options: expand the filesystem or update the bootloader (Pi 4/5).

From Raspberry Pi OS 6.2 onward, passwordless sudo is disabled by default, so sudo prompts for your user’s password. This matters for scripts. Cron jobs and automation that assumed passwordless sudo now need an explicit, narrow sudoers rule.

Check Wi-Fi from the Command Line

Trixie uses NetworkManager, so nmcli manages connections:

# Show Wi-Fi status and signal
nmcli device status
nmcli device wifi list

# Add or change a network
sudo nmcli device wifi connect "YourSSID" password "YourWiFiPassword"

Set a Static IP (Recommended for Servers)

A reserved address saves you from hunting for the Pi after each reboot. The cleanest method is a DHCP reservation in your router. If you must set it on the Pi:

# Replace "preconfigured" with your connection name from: nmcli con show
sudo nmcli con mod "preconfigured" ipv4.method manual \
  ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 ipv4.dns "1.1.1.1"
sudo nmcli con up "preconfigured"

Hardening Your Headless Pi

An internet-reachable Pi gets scanned within hours. Apply these basics:

1. Use SSH keys and disable passwords. Set PasswordAuthentication no in /etc/ssh/sshd_config, then run sudo systemctl restart ssh.
2. Keep the system updated. Run sudo apt update && sudo apt full-upgrade regularly.
3. Enable a firewall. Install ufw, allow only port 22 (and what you serve), then enable it.
4. Don’t forward port 22 to the internet. Use a VPN or Raspberry Pi Connect instead.

sudo apt install ufw -y
sudo ufw allow 22/tcp     # SSH
sudo ufw enable
sudo ufw status verbose

Imager 2.0 can authenticate with a Raspberry Pi Connect account directly inside the app. That gives you browser-based remote access without opening router ports.

Real-World Project: Headless Sensor Node on I2C

A headless Pi suits sensor logging. This quick build reads a BME280 temperature, humidity, and pressure sensor over I2C.

Wiring

Use 3.3V, not 5V. Pi GPIO pins are not 5V tolerant.

Enable I2C and Verify the Sensor

# Turn on the I2C interface (0 = enable)
sudo raspi-config nonint do_i2c 0

# Install tools and scan the bus
sudo apt install -y i2c-tools python3-venv
i2cdetect -y 1        # BME280 usually appears at 0x76 or 0x77

Read the Sensor with Python

python3 -m venv ~/sensor-env
source ~/sensor-env/bin/activate
pip install adafruit-circuitpython-bme280

# bme_read.py: read the BME280 over I2C and print values every 5 seconds
import time
import board
import adafruit_bme280.basic as adafruit_bme280

i2c = board.I2C()  # uses GPIO2 (SDA) and GPIO3 (SCL)
bme = adafruit_bme280.Adafruit_BME280_I2C(i2c, address=0x76)  # change to 0x77 if needed

while True:
    # Temperature in Celsius, humidity in %RH, pressure in hPa
    print(f"{bme.temperature:.1f} C | {bme.relative_humidity:.0f} % | {bme.pressure:.0f} hPa")
    time.sleep(5)

Run it with python3 bme_read.py. From here, add a systemd service to start it at boot or push readings to MQTT.

Common Mistakes to Avoid

• Skipping the region setting. The wrong wireless domain breaks Wi-Fi.
• Using a weak phone charger. Undervoltage causes silent corruption.
• Cutting power during first boot. Wait for the filesystem expansion to finish.
• Powering off by pulling the plug. Run sudo shutdown -h now and wait for the LED to settle.
• Reusing a worn card in a 24/7 build. For always-on projects, consider an SSD or a high-endurance microSD card.

FAQ

What is the default username and password for Raspberry Pi OS?

There is none. Current images ship without default credentials, and you set your own username and password in Raspberry Pi Imager or on first boot. The old pi / raspberry login only works on images released before April 2022.

How do I enable SSH on a headless Raspberry Pi?

Enable it in Raspberry Pi Imager under the Remote access step before writing the card, then provide a username and either a password or a public key. On first boot, SSH is the only remote option for a headless Pi. After flashing, you can also place an empty file named ssh on the boot partition, or set enable_ssh: true in user-data.

Can I set up a Raspberry Pi without a monitor or keyboard?

Yes. Preconfigure the hostname, user, Wi-Fi, and SSH in Imager, then power the board and connect with ssh user@hostname.local. You only need power and a flashed microSD card. Ethernet is the safest fallback if Wi-Fi fails.

How do I find my Raspberry Pi’s IP address?

Try ping hostname.local first. If that fails, check your router’s DHCP client list or scan your subnet with nmap -sn 192.168.1.0/24. With a monitor attached, hostname -I prints the address directly.