WiFi Password Generator
Router-safe WPA2 and WPA3 passwords, a read-aloud passphrase mode, and a QR code guests can scan to join. Nothing leaves your browser.
WPA requires at least 8 characters.
Five words drawn from a 1,480-word list give about 53 bits of entropy - enough to survive an offline attack on a captured WPA2 handshake, while still being something you can say across a room.
WiFi QR code
Add your network name and guests can point a phone camera at the code to join - no typing, no dictating.
Enter your network name to generate the QR code.
The QR code contains the password in plain text. It is generated on your device and never uploaded - but treat a printed copy the same way you would treat the password itself.
Generated in your browser with the Web Crypto API. Nothing is sent to a server.
How long should a WiFi password be?
WPA2 and WPA3 accept 8 to 63 characters, but 8 is nowhere near enough. An attacker only needs to capture one handshake and can then guess offline, at roughly 10 million attempts per second on an eight-GPU machine. Aim for at least 55 bits of entropy: 5 random words, or about 12 fully random characters. The meter above shows exactly where you stand.
WPA2 vs WPA3: why the difference matters
WPA2 turns your passphrase into a key with PBKDF2-HMAC-SHA1 at 4,096 iterations, salted with the network name - which is why a captured handshake can be attacked offline and why passphrase strength carries all the weight. WPA3 replaces that with the SAE handshake, which makes offline dictionary attacks impossible. Both use the same 8-63 character rule, so a passphrase generated here works on either.
Why a passphrase beats random characters for guest WiFi
A WiFi password is transcribed, not pasted. Someone reads it across a room, types it on a TV remote, or copies it off a card in a cafe. Five random words are as strong as a dozen random characters but survive that journey intact - no ambiguity between O and 0, no hunting for the symbol keyboard. Use the random mode when the password lives in a password manager and nobody has to say it out loud.
Rotate it without reprinting the card
Guest passwords leak by accident: a photo of a whiteboard, a screenshot in a group chat, a contractor who still has it a year later. Generate a fresh one, share it as a self-destructing Vaulted link that expires after one view, and the copy in someone's message history stops being useful the moment your router changes.
Frequently asked questions
What makes a good WiFi password?
Enough entropy to survive an offline attack, and a form people can actually transcribe. Five random words (about 53 bits) or twelve or more fully random characters both clear the bar. Avoid anything derived from your address, surname, provider name or phone number - those are the first things a cracking wordlist tries.
What characters are allowed in a WiFi password?
The 802.11i standard allows 8 to 63 printable ASCII characters. In practice, avoid quotes, backslashes, backticks, dollar signs, ampersands and semicolons: they are legal, but they break a surprising number of router admin pages, captive-portal scripts and hostapd config files. This generator sticks to !#*+-.=?@_~ for that reason.
Can I share my WiFi password with a QR code?
Yes. iOS Camera, Android and most scanner apps understand the WIFI: URI format, so pointing a camera at the code offers to join the network directly. Enter your network name above and the code appears. Remember that the code encodes the password in plain text - anyone who photographs it has your password.
Is it safe to generate a WiFi password on a website?
Only if the password is generated on your device and never transmitted. This tool runs entirely in your browser using the Web Crypto API's crypto.getRandomValues(), the same source of randomness that backs TLS and SSH. There is no request to a server, no logging, and the page is open source. Generators that produce passwords server-side ask you to trust an operator you cannot audit.
What is the difference between a WPA2 passphrase and a PSK?
The passphrase is what you type; the pre-shared key is the 256-bit value your router actually uses, derived from the passphrase with PBKDF2 and the network name as salt. Entering exactly 64 hexadecimal characters skips that derivation and sets the PSK directly - maximum strength, at the cost of every device having to accept a 64-character entry.
How often should I change my WiFi password?
Change it on events rather than a calendar: when someone who had it leaves, when it has been photographed or posted somewhere shared, or when you add a separate guest network. Rotating a strong password on a schedule mostly trains people to write it down.
Send the WiFi password without leaving it in a chat
Share it as an encrypted link that self-destructs after one view. The server never sees the password - the key stays in the URL fragment.