Wi-Fi Password Generator: WPA2 and WPA3 Passphrases

This Wi-Fi password generator makes WPA2 and WPA3 passwords right here in your browser, using crypto.getRandomValues(). Nothing you generate or type on this page gets sent to my server, including the network name you put in the QR code box. If you don't believe me (good), open your browser's network tab and hammer the button.

There are three styles because Wi-Fi passwords live a strange life. You paste them once on a laptop, then type them with a TV remote one letter at a time while someone asks whether that's a zero or an O. Pick the style that matches how the password will actually get entered.

What a Wi-Fi password has to be

For WPA2-Personal and WPA3-Personal the rules are short. The passphrase must be 8 to 63 characters, and every character must be printable ASCII, codes 32 through 126. That is the space, the digits, upper and lowercase English letters, and the 32 standard symbols. No emoji, no accented letters, no curly quotes pasted from a word processor.

The odd 63 limit exists because the key can also be entered as exactly 64 hexadecimal digits, which is the raw 256-bit key. Capping passphrases at 63 means a device can always tell the two apart. The hostapd documentation describes it the same way: a 256-bit secret as 64 hex digits, or an ASCII passphrase of 8 to 63 characters that gets converted to the key. You can check it yourself with the wpa_passphrase tool on Linux, which refuses anything outside that range:

$ wpa_passphrase "HomeNetwork" "short"
Passphrase must be 8..63 characters

Every password this page makes is inside those limits, whatever settings you choose.

Which style should you pick?

The entropy number is how many random yes-or-no choices went into the password. It assumes the attacker knows which style and settings you used, because they usually can guess. Every extra bit doubles the work. My rule of thumb for a WPA2 network: under 50 bits is weak, 50 to 70 is fine for most homes, 70 and up and you can stop thinking about it.

The easy-to-type mode uses 31 characters: lowercase letters without i, l and o, and the digits 2 through 9. No capitals, because the shift key on a TV keyboard is a small circle of hell. It loses about a bit per character compared to letters plus digits, so it uses more characters to make up for it. The hyphens are in fixed places and add nothing to the strength. They're there so you can say "k4mt, dash, 9xpq" instead of losing your place.

If you want words and nothing else, the random passphrase generator does exactly that. If you want words with numbers and a symbol in a pattern that also passes website password rules, that's the memorable password generator.

WPA2 vs WPA3: why length still matters

WPA2-Personal turns your passphrase into the network key with PBKDF2-HMAC-SHA1, 4,096 iterations, using the network name as the salt. That part is fine. The problem is what an attacker can collect. If they record the four-way handshake when a device joins your network, they can go home and test password guesses against it offline, as fast as their graphics cards allow, and your router never sees a single attempt. The hashcat project also described a PMKID attack in 2018 that gets similar material straight from many routers without waiting for a device to connect. Cracking tools like hashcat support both. Against WPA2, the only thing standing between a recorded handshake and your network is how guessable the password is. That's why I don't use short passwords or words from a phrase here.

WPA3-Personal replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals). The Wi-Fi Alliance's WPA3 security considerations document says it directly: unlike PSK, SAE is resistant to offline dictionary attacks, and the only way to learn the password is repeated active attacks, where each attempt tests a single guess. Your router can notice that and slow it down. SAE also gives forward secrecy, so learning the password later does not decrypt traffic someone recorded earlier.

The catch is WPA2/WPA3 transition mode (often labeled "WPA2/WPA3 mixed"), which lets older WPA2-only devices keep connecting. It uses the same password for both. The same Wi-Fi Alliance document points out that the password of a transition mode network can be recovered with the ordinary offline WPA2 attack. So unless every device you own speaks WPA3 and you have switched the router to WPA3 only, treat your network as WPA2 and use a long password.

How to change the Wi-Fi password on your router

Every router menu is different, but the path is usually the same:

1. Find the admin page. Many home routers answer at 192.168.0.1 or 192.168.1.1 in a browser, but the reliable way is to look up your default gateway. On Windows run ipconfig and read the "Default Gateway" line. On Linux run ip route and look at the line starting with default via. Many mesh systems and ISP gateways are managed through a phone app instead.
2. Log in with the admin password, which is often printed on a sticker on the router next to the default Wi-Fi password. More on that below.
3. Open the wireless settings. Look for Wireless, Wi-Fi, WLAN, or Wireless Security. Dual-band routers sometimes have a separate section for 2.4 GHz and 5 GHz (and 6 GHz). Change it in each one or turn on the option that uses one name for all bands.
4. Choose the security mode. WPA3-Personal if every device supports it, otherwise WPA2/WPA3 mixed, otherwise WPA2-Personal (AES). Avoid anything that says WEP, WPA (without the 2), or TKIP.
5. Paste the new password, save, and wait for the radios to restart. Every connected device drops off at that moment, including the laptop you're using if it's on Wi-Fi.
6. Reconnect your devices. Phones and laptops ask for the new password. Smart plugs, cameras and speakers usually need their own app. This is where the QR code above saves real time.

Store the new password somewhere you will find it next year, like a password manager. On Windows, you can read the saved password for a network the machine has already joined:

netsh wlan show profile name="HomeNetwork" key=clear

Run it from an administrator prompt, and the key is shown in plain text in the output. On an iPhone, the Passwords app has a Wi-Fi section that shows saved network passwords.

The router admin password is a different password

People mix these up constantly. The Wi-Fi password lets devices join the network. The admin password lets someone log in to the router itself and change everything: the Wi-Fi password, DNS servers, port forwarding, firmware. Anyone on your main network can usually reach the admin login page. If the admin password is still a default or is the same as the Wi-Fi password, a guest can take over the router.

Change it to something different and long, stored in your password manager. The strong random password generator is the right tool for that one. While you're in there, turn off remote administration from the internet unless you actually use it, and check for a firmware update.

Turn off WPS

WPS (Wi-Fi Protected Setup) is the push-button or PIN method for joining a network without typing the password. The PIN version has a design flaw documented by CERT/CC as VU#723755. The PIN is 8 digits, but the last digit is a checksum, and the router confirms the first half and the second half separately. That turns what should be millions of guesses into about 11,000 at most (10,000 for the first four digits, 1,000 for the last three). A successful guess hands over the actual Wi-Fi password, however long it is, and many routers did not lock out repeated attempts.

CERT's workaround is to disable WPS. Look for WPS or Wi-Fi Protected Setup in the wireless settings and turn it off. A 63-character password does nothing if the router hands it to anyone who guesses an 8-digit PIN. If your router won't let you disable it, replace the router.

Use a guest network for guests (and gadgets)

Most home routers can run a second network with its own name and password. On most models guests on it can reach the internet but not your computers, NAS or printers. Check your router's setting, often called something like "allow guests to access the local network", and leave it off.

You can change a guest password after a party without re-joining every device you own. I also park cheap smart home gadgets there. Use the words or easy-to-type style for it, since guests are exactly the people typing it on a phone while you spell it out.

Share the password with a QR code

The QR code above holds a short piece of text in the format described in the ZXing project's barcode contents documentation, which is what phone cameras look for:

WIFI:T:WPA;S:HomeNetwork;P:your-password-here;;

T is the security type, S is the network name, P is the password, and H:true marks a hidden network. The characters \ ; , : " have to be escaped with a backslash inside the name and password, so a network called Joe's; Guest becomes S:Joe's\; Guest;. The generator does the escaping for you. Open "Show the text inside the QR code" if you want to see it.

• iPhone: open the Camera app, point it at the code, and tap the notice that appears. To share your own network, the Passwords app has a Wi-Fi section where you can pick the network and tap Show Network QR Code.
• Android: scan with the camera or Google Lens. To share, Google's Android help describes Settings, then Network & internet, then Internet, then your network, then Share, which shows a QR code. Menu names vary a little between phone makers.

For WPA3-only networks, Android's own share codes use T:SAE instead of T:WPA, which is why there's a separate option. I haven't been able to confirm how every phone treats SAE codes, so scan it once with each kind of phone you care about before you print a stack of them.

A QR code is the password in a format a camera can read. Anyone who can photograph it can join. Taping it inside a kitchen cabinet or a guest room drawer is fine. Taping it to the front window is not. Use it for the guest network, not your main one.

Generate a Wi-Fi password yourself, offline

If you would rather not use a web page at all, these do the same thing on your own machine.

OpenSSL, 24 random bytes as 32 base64 characters (letters, digits, +, / and sometimes =):

openssl rand -base64 24

Python, 20 characters of letters and digits:

python3 -c "import secrets,string; a=string.ascii_letters+string.digits; print(''.join(secrets.choice(a) for _ in range(20)))"

Node.js, 20 characters from the same easy-to-type set this page uses:

node -e "const c=require('crypto');const a='abcdefghjkmnpqrstuvwxyz23456789';let s='';for(let i=0;i<20;i++)s+=a[c.randomInt(a.length)];console.log(s)"

On Linux, wpa_passphrase shows the 64-hex-digit key your passphrase turns into for a given network name, which is handy for wpa_supplicant.conf or checking a config:

wpa_passphrase "HomeNetwork" "your new passphrase here"

Change the network name and the key changes too, because the name is the salt.

Common mistakes

• Keeping the password printed on the router. A random default sticker beats the old days of "password", but everyone who has ever been in the room with the router can read it.
• Pasting from a document that "smart quotes" things. A curly apostrophe is not ASCII, so the router should reject it, and good luck typing one on a TV remote anyway.
• Spaces at the start or end. Legal, but invisible and easy to lose when copying. This page never puts them there.

Wi-Fi Password FAQ

How long should a Wi-Fi password be?

WPA2 and WPA3 accept 8 to 63 characters. Eight is the legal minimum, not a recommendation. For a home network I use 20 random characters, 6 groups of the easy-to-type characters, or 5 random words. All of those land somewhere around 65 to 120 bits of entropy, which is far past what anyone can guess offline.

Can a Wi-Fi password contain spaces and symbols?

Yes. The passphrase can use any printable ASCII character, codes 32 through 126, and that includes the space. Emoji, accented letters and other non-ASCII characters are not allowed. Quotes, backslashes and a few other symbols mean something special in web forms, config files and the Wi-Fi QR code format, and they are awkward on TV keyboards, so the default symbol set on this page skips them.

Is a WPA3 password different from a WPA2 password?

The password itself follows the same rules: 8 to 63 printable ASCII characters. What changes is the handshake. WPA2-Personal lets someone who records the handshake test guesses offline as fast as their hardware allows. WPA3-Personal uses SAE, which forces every guess to be a live attempt against your router. If your router runs WPA2 and WPA3 together in transition mode, the same password is exposed to the WPA2 attack, so length still matters.

Is it safe to generate a Wi-Fi password on a website?

This page generates everything in your browser with crypto.getRandomValues, and the QR code is drawn in your browser too. The password and network name are never sent to my server or anyone else. You can load the page, turn off your connection and it keeps working. What no web page can protect you from is malware already on your own device.

Will changing my Wi-Fi password disconnect my devices?

Yes. Every phone, laptop, TV, printer and smart plug keeps using the old password until you give it the new one. Phones and laptops will ask. Smart home gadgets usually need their own app to join again, so budget some time for those, or keep the network name the same and set them up one by one.

Should I change the network name (SSID) too?

It is a good idea if you still have the default name. WPA2 mixes the network name into the key derivation as a salt, so a unique name means precomputed work aimed at common default names does not apply to you. Do not put your address, apartment number or last name in it.

Does the Wi-Fi QR code work on iPhone and Android?

Yes. On an iPhone, point the Camera app at the code and tap the network notice. On Android, scan it with the camera app or Google Lens. Pick the WPA option for WPA2 and mixed WPA2/WPA3 networks. For a WPA3-only network, Android writes SAE in its own share codes, so try that option and test with each phone you care about.

How often should I change my Wi-Fi password?

When someone who should not have it might have it: a roommate moved out, a contractor used it, a device with it saved was lost, or you shared it far more widely than you meant to. A strong password does not wear out on a calendar.

What is the 64-character Wi-Fi key option on my router?

A WPA pre-shared key can be entered as a 63-character passphrase or as exactly 64 hexadecimal digits, which is the raw 256-bit key itself. This generator stays at 63 characters or fewer so nothing it makes can be mistaken for a raw hex key.

Related tools: Memorable Password Generator, Random Passphrase Generator, Strong Random Password Generator, PIN Generator, and my opinionated security best practices.

-Sethers