diff --git a/backend/src/routes/import.routes.ts b/backend/src/routes/import.routes.ts
index 6da98a2..5580217 100644
--- a/backend/src/routes/import.routes.ts
+++ b/backend/src/routes/import.routes.ts
@@ -1,6 +1,7 @@
 import { Router, Response, NextFunction } from 'express'
 import multer from 'multer'
 import * as XLSX from 'xlsx'
+import bcrypt from 'bcryptjs'
 import { authMiddleware, AuthRequest } from '../middleware/auth'
 import { requireAdmin } from '../middleware/rbac'
 import { encrypt, decrypt, sha256 } from '../lib/crypto'
@@ -305,6 +306,11 @@ router.post('/excel', authMiddleware, requireAdmin, upload.single('file'), async
           const housingFundOptOut = val(getField(r, '公积金基数')) === '无' || val(getField(r, '公积金基数')) === '不缴'
           const housingFundBase = housingFundOptOut ? 0 : (housingFundBaseVal || num(salary))
 
+          // 默认密码：手机号后6位（无手机号则 123456）
+          const importPhoneVal = val(getField(r, '手机号')) || null
+          const defaultPwd = importPhoneVal ? importPhoneVal.slice(-6) : '123456'
+          const importPasswordHash = await bcrypt.hash(defaultPwd, 10)
+
           const emp = await prisma.employee.create({
             data: {
               orgId, name, department: dept, hireDate,
@@ -312,7 +318,8 @@ router.post('/excel', authMiddleware, requireAdmin, upload.single('file'), async
               gender: val(getField(r, '性别')) || (idCard ? extractGenderFromIdCard(idCard) : null),
               femaleWorkerType: (val(getField(r, '女性岗位类型')) === '工人' || val(getField(r, '女性岗位类型')) === 'WORKER') ? 'WORKER'
                 : (val(getField(r, '女性岗位类型')) === '干部' || val(getField(r, '女性岗位类型')) === 'CADRE') ? 'CADRE' : null,
-              phone: val(getField(r, '手机号')) || null,
+              phone: importPhoneVal,
+              passwordHash: importPasswordHash,
               idCardNumber: idCard ? encrypt(idCard) : null,
               idCardHash: idCard ? sha256(idCard) : null,
               birthDate: idCard ? extractBirthDateFromIdCard(idCard) : null,