WiFi Password Generator

How the WiFi Password Generator works

WiFi password generator: what the router actually accepts

A WPA2 or WPA3 personal network is protected by a pre-shared key of 8 to 63 printable ASCII characters. Eight is the minimum and far too short; the router will accept it, but a captured handshake can be run through an offline cracking rig at hundreds of thousands of guesses a second, and eight lowercase letters fall in under an hour. Sixty-three is the maximum, and nobody wants to type it into a television remote. Twenty random characters, the default here, is over 110 bits and comfortably beyond any practical attack while still fitting on a card.

Two styles for two situations

Random characters gives the most strength per character and is the right choice when the key is typed once per device and then remembered by it. The alphabet drops capital I, lowercase l, digit 1, capital O and digit 0, because a guest squinting at a printed key cannot tell them apart, and that costs less than a tenth of a bit per character. Words and digits produces something like Falcon7Meadow2Quartz9, which is easier to read out loud to a visitor and to type on a phone; it carries less entropy per character, so let the generator run a little longer than the minimum.

The words style stops at exactly the requested length, so the last word may be cut short. Each word-and-digit pair adds 16.2 bits regardless of its length.

Why WiFi keys need to be stronger than website passwords

A website can lock an account after ten wrong tries. A WiFi network cannot: anyone within range can record the four-way handshake when a device connects and take it away to attack at leisure, with no rate limit and no trace. That makes a WiFi key an offline-cracking target like a disk encryption password, and it is why the default here is twenty characters rather than the twelve that would be adequate behind a login form. WPA3 improves on this with a handshake that resists offline attack, but most home networks still run WPA2 or a mixed mode.

Changing the key

The key is set in the router's admin page under wireless security, along with the network name. Choose WPA3 or WPA2-AES if the option exists, never WEP or WPA-TKIP. Every device will need the new key, so do it at a time when reconnecting the printer and the thermostat is not a nuisance, and put guests on a separate guest network with its own key so the main one is shared as rarely as possible.

Generated locally, never sent

The key is produced in your browser by its cryptographic random generator, with no request to any server. Nothing is logged and nothing persists after you close the tab, so copy it into the router and somewhere safe before you leave the page.

Related tools