How long should a WiFi password be?
WPA2 and WPA3 accept anything from 8 to 63 characters. Eight is the protocol floor, not a recommendation — at that length an attacker who has captured your handshake can exhaust the whole keyspace on a GPU in hours. Here is what each length actually buys you, using the 55-character pool this generator uses after ambiguous characters are removed.
| Length | Entropy | Verdict | Notes |
|---|---|---|---|
| 8 | ~46 bits | ❌ Too weak | The WPA2 floor. A captured handshake falls to a GPU in hours. |
| 10 | ~58 bits | ⚠️ Marginal | Better, but still inside reach of a well-resourced attack. |
| 12 | ~70 bits | ✅ Strong | Practical minimum. Fine for most home networks. |
| 16 | ~93 bits | ✅ Very strong | Recommended default. Beyond any realistic brute force. |
| 20 | ~116 bits | ✅ Excellent | Use when you only ever share via QR code. |
Characters this generator leaves out (and why)
A WiFi password gets typed by other people, often on the worst keyboards ever made. Two categories cause real problems, so both are excluded by default:
| Character | Why it's excluded |
|---|---|
| I | Identical to lowercase l and the digit 1 in most fonts |
| l | Identical to capital I and the digit 1 |
| 1 | Identical to I and l |
| O | Identical to the digit 0 |
| 0 | Identical to the letter O |
| \ | Treated as an escape character by some router firmware |
| " | Router config pages can misparse quotes inside form fields |
| ; | Some older firmware reads it as a field delimiter |
Skipping symbols costs you some entropy per character, but 16 characters from a 55-character pool already lands above 90 bits — far past anything a brute-force attack can reach. Length is the cheaper lever, and it doesn't make your guests hunt for the @ key on a TV remote.
How to change your WiFi password on your router
The menu labels differ by brand, but the path is the same on every consumer router:
WPA2 vs WPA3
WPA3 swaps the WPA2 pre-shared key handshake for Simultaneous Authentication of Equals, which closes the offline dictionary attack that makes WPA2 password length so critical. Your password still matters on WPA3 — it protects against anyone who reads it off a sticky note or watches you type it — but the urgency drops. Turn on WPA3 if your router offers it, or WPA2/WPA3 transition mode if older devices on your network still need WPA2.
Related
Once you have a password, make a WiFi QR code so guests can join without typing anything. For the reasoning behind the length and randomness rules — plus what a weak password actually looks like — see what makes a WiFi password strong. If you want something more memorable for the network name itself, there are 150+ WiFi password ideas organised by theme. For non-WiFi accounts, the full Password Generator adds symbols, bulk generation, PINs, and a strength analyzer.
Frequently asked questions
What is the WPA2 minimum password length?
WPA2 and WPA3 accept 8 to 63 characters. Eight is the protocol floor, not a security recommendation — a captured handshake with an 8-character password falls to consumer GPU hardware in hours. Use 12 as your practical minimum and 16 as your default.
What characters should I avoid in a WiFi password?
Capital I, lowercase l, the digit 1, capital O, and the digit 0 — all visually identical in most fonts, and the cause of most "it says the password is wrong" moments. Also backslash, double quotes, and semicolons, which some router firmware mishandles or silently truncates. This generator excludes all of them.
How do I change my WiFi password on my router?
Open your router's admin address in a browser — usually 192.168.1.1 or 192.168.0.1, printed on the router label with the admin login. Sign in, go to Wireless or WLAN settings, find the Password or Passphrase field, paste the new password, and save. Every device will need to reconnect.
Can I make a QR code for my WiFi password?
Yes. A WiFi QR code encodes the network name, security type, and password, so a phone camera can join the network with no typing. Generate the password here, then build the code in the QR Code Generator with WiFi selected as the type. It's static, so it keeps working indefinitely.
How often should I change my WiFi password?
Not on a schedule — NIST dropped mandatory rotation in its 2024 guidelines. Change it when someone who had access no longer should, when you think it spread further than intended, when an unfamiliar device shows up on the network, or when you swap routers or ISPs.
Does WPA3 change what password I need?
WPA3's SAE handshake removes the offline dictionary attack that WPA2 is vulnerable to, so length matters less than it used to. The advice doesn't really change though, because the password also protects you from anyone who sees it written down. Enable WPA3 where you can, or WPA2/WPA3 transition mode if older devices still need WPA2.