This preset makes a 20-character Wi-Fi password from upper- and lowercase letters and digits, minus the look-alikes 0, O, 1, l and I, which leaves 57 characters and about 20 × log2(57) ≈ 116.7 bits. WPA2-Personal accepts passphrases of 8 to 63 characters, so the length can be changed within that range. Twenty characters keeps a captured handshake far out of reach of offline guessing.
What makes a Wi-Fi password different
Most passwords are checked by a server that can lock you out after a few wrong tries. A WPA2 home network has no such protection against an attacker within radio range. Anyone who records the brief handshake when a device joins can take it away and test guesses offline, as fast as their hardware allows. The password is the only thing standing between them and your network.
The other difference is who types it. A Wi-Fi password gets entered on televisions, games consoles, printers, smart speakers, e-readers and visitors' phones, often with an on-screen keyboard and a remote control. Symbols live on a second or third keyboard page, uppercase needs an extra toggle, and a zero that looks like the letter O causes failed attempts and frustration.
This preset handles both: enough length for offline attacks, and a character set chosen for awkward keyboards.
The rule
- Length: 20 characters by default, adjustable from 8 to 63, the range WPA2 allows for passphrases.
- Characters: A–Z and a–z and 2–9, minus capital O, capital I and lowercase l. That is 57 characters: 24 uppercase, 25 lowercase, 8 digits.
- No symbols and no spaces, so no keyboard page switching beyond letters and numbers.
- No forced mix of types. Each position is simply one of the 57 characters, chosen uniformly, so the entropy is exactly length × log2(57), about 5.83 bits per character.
Set a new Wi-Fi password
- Leave the length at 20, or change it to anything from 8 to 63.
- Press Generate and check that the meter shows about 116.7 bits for 20 characters.
- Open your router's settings page or app, find the wireless security section, and paste the new password into the WPA2 or WPA3 password field.
- Save the settings; your devices will disconnect and need the new password.
- Reconnect each device, and write the password on a card or save it in your password manager for guests.
How WPA2 turns your password into a key
WPA2-Personal does not use your passphrase directly. Every device runs it through PBKDF2 with HMAC-SHA1, using the network name (SSID) as the salt and 4,096 iterations, to produce a 256-bit key. The reference Linux software, hostapd and wpa_supplicant, accepts either an ASCII passphrase of 8 to 63 characters or the 256-bit key written out as 64 hexadecimal digits.
Two consequences follow. First, because the network name is the salt, changing the SSID changes the key, and networks that keep a factory default name share a salt with every other network of that name, which lets attackers reuse precomputed work. Give your network a name of its own. Second, the key is 256 bits, so no passphrase can be stronger than that. With this preset's 57 characters, 44 characters already exceed 256 bits; anything longer adds nothing.
Offline guessing against a captured handshake
The 4,096 iterations make each guess expensive. In a published hashcat benchmark, one RTX 4090 tested about 2.5 million WPA2 guesses per second. The table uses that figure and a far larger assumed attacker, 10⁹ guesses per second, roughly 400 such cards. Times are for searching half of all passwords this preset could produce at each length.
| Length | Bits (57-character set) | One RTX 4090, 2.5 × 10⁶/s | About 400 cards, 10⁹/s |
|---|---|---|---|
| 8 | 46.7 | 255 days | 15 hours |
| 10 | 58.3 | 2,264 years | 6 years |
| 12 | 70.0 | 7 million years | 19 thousand years |
| 16 | 93.3 | 7.8 × 10¹³ years | 197 billion years |
| 20 | 116.7 | 8.2 × 10²⁰ years | 2.1 × 10¹⁸ years |
| 24 | 140.0 | 8.7 × 10²⁷ years | 2.2 × 10²⁵ years |
Eight characters, the minimum the standard allows, is within reach of a determined attacker even with random characters. Twelve is solid; 20 leaves an enormous margin while still being quick to type.
WPA3 and transition mode
WPA3-Personal replaces the WPA2 handshake with SAE, which the Wi-Fi Alliance describes as resistant to offline dictionary attacks: an attacker has to interact with the network for every single guess, and access points can throttle repeated failures. That makes even moderate passwords much safer on a WPA3-only network.
Most home routers, though, run in WPA3 transition mode so older devices can still connect over WPA2, and both use the same password. The Wi-Fi Alliance's deployment guide points out the trade-off: the shared password can then be attacked offline through a WPA2 client, just as on a WPA2-only network. Its recommendation for that WPA2 passphrase is a high-entropy, non-dictionary password of 8 to 63 characters. Until every device on your network supports WPA3, choose the password as if the network were WPA2.
Where this preset fits
- Home and small-office networks, whether WPA2, WPA3 or both.
- Guest networks you share on a card or a fridge note.
- Hotspots on phones and travel routers, where the password is often read off a screen.
Where to choose differently
- Corporate networks with individual logins (WPA2/WPA3-Enterprise). Those use per-user credentials instead of a shared password.
- Devices that require the 64-digit hex key. This preset produces passphrases, not hex; see the 64-character page for how the two forms differ.
- Router admin passwords. The router's own management login is a separate password; a random 20-character password with symbols is better there, since you rarely type it.
Kept on this device
The password is generated by the page's script in your browser. It is not sent to us, to your router or to anyone else, and the page keeps no copy once you leave. Your router only learns it when you paste it in yourself.
Technical notes
The 57 characters are chosen with crypto.getRandomValues, using rejection sampling so that none is more likely than another. There is no "one of each type" rule in this preset, so the figure shown is exactly length × log2(57). The methodology page explains how to watch the page's network requests while you generate.
FAQ
Why 20 characters and not the maximum of 63?
Twenty characters of this set already give about 116.7 bits, which no offline attack can approach. Longer passwords only make typing on a TV slower.
Why are zero, one and some letters missing?
So the password can be read off a label or a screen without confusing 0 with O or 1 with l and I. Removing them costs about 0.12 bits per character.
Can I use spaces or symbols in a Wi-Fi password?
WPA2 allows any printable ASCII character, including spaces, but some devices handle them badly and they are slow to enter with a remote. This preset leaves them out on purpose.
Do I need a new password when I switch to WPA3?
Not if the current one is long and random. If your router runs in transition mode, keep treating the password as exposed to WPA2-style offline guessing.
Is an 8-character Wi-Fi password enough?
Not for long. Even random, 8 characters of this set could be found within days by a modest GPU cluster. Use at least 12, and 20 if you can.
Will older devices accept a 20-character password?
Yes. Any WPA2 device accepts 8 to 63 characters, and letters and digits are the safest characters for older firmware.
Sources
- Wi-Fi Alliance: WPA3 and Enhanced Open deployment guide v1.1
- hostapd.conf documentation
- wpa_passphrase.c (PBKDF2, 4,096 iterations)
- Hashcat benchmark: RTX 4090, mode 22000
Checked 2026-10-11.
Last updated: