How to copy trades on MT4/MT5 without handing over your broker password

The three levels of access, and why the difference matters

Every copy trading setup needs some way to place orders in your account. What varies — enormously — is how much else that access allows, and platforms are often imprecise about which one they are asking for.

MetaTrader itself distinguishes two passwords. The master password is full control: place trades, close positions, change settings, and at many brokers request a withdrawal to a registered method. The investor password is read-only: it can see balance, equity, open positions and history, and it cannot trade at all.

A read-only investor password is therefore useless for copy trading — nothing can be executed with it — but it is exactly right for verification. It is how a platform can prove a trader's track record without being able to touch the account.

• Investor (read-only) password — can see everything, can trade nothing. Right for proving a track record.
• Trade relay via a copy API — can open and close positions, cannot withdraw or change account settings.
• Master password — full control, including whatever your broker permits on withdrawals. Rarely necessary.

What a copy platform genuinely needs

To mirror trades into your account, a platform needs to open and close positions in it. That is all. It does not need to change your leverage, alter your registered withdrawal methods, or move money.

Platforms built on a copy API — CopyFactory and equivalents — connect at that level: they receive the provider's trade events and place corresponding orders in the subscriber account. Withdrawals are not part of that surface at all.

If a service asks for your master password and cannot explain why it needs more than order placement, that is a question worth pressing on before you connect anything.

Practical checks before you connect an account

A few minutes of setup discipline removes most of the risk people worry about, and none of these require trusting anyone's marketing copy.

• Start on a demo account. Every claim about a platform is testable on money that isn't real, and a platform that makes this awkward is telling you something.
• Check whether your broker lets you set a separate withdrawal method lock or requires 2FA on withdrawals. Most do; it costs nothing.
• Confirm you can revoke the connection yourself, from your side, without emailing support. Changing your broker password should end the relay immediately.
• Check the account is yours to risk. Copy trading is not a way to make a prop-firm or funded account safer — most funded programmes prohibit it outright.

Why the broker relationship should stay yours

There is a meaningful structural difference between a platform that copies into an account you already hold, and one that requires you to open an account at its house broker.

In the first, your deposits, KYC, statements and withdrawals stay between you and a broker you chose and can leave. In the second, the platform sits between you and your money, and your ability to exit depends on them.

This is worth checking early, because it is difficult to unwind later. The question to ask is simply: if this platform disappeared tomorrow, would my account and my balance be unaffected?

Common questions

Can someone withdraw my funds with my MT5 investor password?

No. The investor password is read-only — it cannot place trades and cannot request withdrawals. It exists so you can show your account to someone without giving them control of it.

Does copy trading require giving up control of my account?

It shouldn't. A copy connection needs permission to open and close positions. You keep the ability to close positions yourself, change your password, or revoke the connection at any time.

Can I copy trades onto a funded or prop-firm account?

Usually not. Most funded-account programmes prohibit copy trading in their rules, and breaching them typically voids the account. Check your specific agreement before connecting anything.