Wi-Fi Password Security

Why your Wi-Fi password matters

Your Wi-Fi password is the front door to everything on your home network: laptops, phones, smart TVs, cameras, printers, and every other device that connects to your router. Someone who joins your network can see which devices are connected, try to reach their login pages, and slow down your connection. On a poorly protected network, an attacker nearby can also capture the handshake that devices exchange when they connect, then try to guess the password offline, at the speed of their own hardware, with no lockout and nobody watching.

Many people treat the Wi-Fi password as a one-time setup chore and keep the default or something easy to type. That is the weak point. A well-protected Wi-Fi setup has three parts: modern encryption, a long random password, and a router that is itself protected.

Choose modern encryption: WPA3 or WPA2

Encryption is the setting that decides how well your password protects you. In your router's wireless settings, choose WPA3 if all of your devices support it, or WPA2 with AES (sometimes shown as "WPA2-PSK (AES)" or "CCMP") if some older devices do not. WPA3 is the newer standard, and among other improvements it makes it much harder to guess a password from captured traffic, even when the password is not perfect.

Avoid anything older. WEP can be broken in minutes and should never be used. The original WPA, and WPA2 with TKIP, are outdated. An open network with no password, like those in cafés and airports, lets anyone nearby read unencrypted traffic, so never run one at home. If your router only offers old options, it is time for a firmware update or a new router.

Make the password long and random

A Wi-Fi password, technically the pre-shared key, can be 8 to 63 characters long. Aim for at least 16 random characters, and longer if you can. Length matters more than complexity here, because an attacker who captures a handshake can test guesses offline without any limit. Names, birthdays, street addresses, and phone numbers are among the first things they try, and a neighbor can guess them too.

Generate the password with a random generator instead of inventing it yourself, because people are bad at randomness. If a long string of symbols is hard to type on a TV or game console, a random passphrase of five or six unrelated words is a good alternative: it is long, easy to read aloud, and still hard to guess. Whatever you choose, use a password you have never used anywhere else.

Change the router's own admin password

Your router has two separate passwords. The Wi-Fi password lets devices join the network. The admin password lets someone change the router's settings, including the Wi-Fi password itself. Many routers ship with a default admin login that is printed on a sticker or documented online, such as "admin" for both the username and the password. If you never changed it, anyone on your network can open the admin page and take control.

Set a new, unique admin password and store it in a password manager. Turn off remote administration unless you really need it, so the settings page cannot be reached from the internet. Keep the router's firmware up to date, because manufacturers fix known vulnerabilities in updates, and many routers can install them automatically.

Use a guest network for visitors and smart devices

Most routers can create a second network with its own password. Give that password to visitors instead of your main one. Guests can get online without being able to reach your computers, shared folders, or printers. The same applies to smart-home gadgets such as plugs, bulbs, and cameras. They often receive fewer security updates than phones and laptops, so keeping them on the guest network limits the damage if one of them is compromised. Give the guest network a password of its own, and you can change it whenever you like without disturbing your own devices.

Turn off WPS and features you do not use

WPS (Wi-Fi Protected Setup) lets devices connect by pressing a button or entering an 8-digit PIN. The PIN method has a design flaw that lets an attacker guess the PIN within hours, which bypasses even a very strong Wi-Fi password. Turn WPS off in your router settings. Also switch off features you do not need, such as UPnP and remote access, and disable the guest network if you never use it.

When to change your Wi-Fi password

You do not need to change it every few months for no reason. Change it when there is a reason: after someone you no longer trust has had it, such as a former roommate, a contractor, or an ex-partner; after you replace or reset the router; when you have shared it so widely that you cannot tell who has it; or when you notice unknown devices on your network. Most routers show a list of connected devices, so check it now and then. After a change you have to reconnect every device, so save the new password in your password manager first.

In short: modern encryption (WPA3 or WPA2 with AES), a long random password, a separate strong admin password, a guest network for visitors and smart devices, and WPS switched off. Those five steps cover most of what protects a home network.