WiFi Password Generator

Generate a strong WPA2/WPA3-compatible random WiFi password using cryptographically secure randomness.

Length

Generated using crypto.getRandomValues — cryptographically secure. Never transmitted.

What makes a strong WiFi password?

WPA2 and WPA3 support passwords up to 63 characters. A 16-character random password using mixed case, digits, and symbols provides over 95 bits of entropy — effectively immune to brute-force attacks. Avoid dictionary words, names, or short passwords even if they seem creative. This generator uses crypto.getRandomValues so every character is drawn from a cryptographically secure source, not from Math.random() which is predictable.

Built and maintained by Meet Shah · Last updated 19 July 2026

What this tool is used for

Setting a passphrase for a home or office network that will be entered once per device.
Producing a guest network credential you are willing to write on a whiteboard.
Replacing a passphrase after someone who knew it has left.
Generating a long random passphrase specifically to defeat offline dictionary attacks on a captured handshake.
Choosing a passphrase that avoids characters some device keyboards make painful to enter.

Frequently Asked Questions

What length does WPA2 actually require?: 8 to 63 ASCII characters for the pre-shared key. Eight is the minimum and far too short — WPA2 handshakes can be captured and cracked offline, so 20 or more, or a multi-word passphrase, is the practical floor.
Why does the SSID affect the password's strength?: Because WPA2 uses the SSID as the PBKDF2 SALT. A common name like "linksys" has precomputed rainbow tables available, so an unusual SSID meaningfully increases cracking cost for the same password.
What does WPA3 change?: It replaces the handshake with SAE (Dragonfly), which resists offline cracking entirely — an attacker must guess against the live network. That is a bigger security gain than any password length under WPA2.
Which characters should I avoid?: Ones that are hard to type on a TV remote or a games console, and ambiguous look-alikes (0/O, 1/l/I). A slightly longer password without them is more usable and no weaker.
Is a separate guest network worth it?: Yes. It isolates visitors' devices from your printers, NAS and cameras, and lets you rotate the guest key without reconnecting everything you own. Client isolation should be enabled on it too.
What actually happens when I change the network password?: Every device is disconnected and must re-authenticate, since the key is used to derive the session keys. Anything unattended — printers, cameras, thermostats, smart plugs — silently stops working until reconfigured, which is the real cost of rotation.
Does hiding the network name add security?: No. A hidden SSID is still broadcast by every client looking for it, so it is trivially discoverable and actually leaks the network name from your devices wherever they travel. It costs convenience and buys nothing.

Common errors and gotchas

Choosing a short passphrase because it is easier to type once. WPA2 handshakes can be captured and attacked offline at leisure.
Reusing a passphrase across networks, when the network name is mixed into the derivation and gives no protection against reuse.
Including characters that some client keyboards cannot easily produce, which turns every new device into a support call.
Relying on a hidden network name for security. It is trivially discoverable and only inconveniences legitimate users.
Forgetting that changing it disconnects every device at once, including the ones with no screen.