WiFi Password Generator

WiFi password generator guide: what it does and when to use it

What this tool does

It creates a random WiFi password from letters and digits, suggests a minimum length for the security type you pick — 12 characters for WPA3, 16 for WPA2 — and turns your network name and password into a standard WiFi QR code. You can download the code as PNG or SVG, or print a card that also shows the name and password in plain text. Everything happens in your browser.

When to use it

Anyone within radio range of your network can try to get in, so a WiFi key deserves a properly random password.

✓Setting up a new router, or replacing the password it shipped with
✓Locking out someone who should no longer have access
✓Creating a guest network for visitors and smart-home devices
✓Printing a join card for a home, office, shop or holiday rental

How to create and set a WiFi password, step by step

1
Choose the security type
Pick what your router uses. If it runs a mixed WPA2/WPA3 mode, choose WPA2 so the longer minimum applies.
2
Set the length
16 characters is the default. Do not go below the recommendation shown for your security type.
3
Enter the network name
It is only used for the QR code. Tick “hidden network” if your router does not broadcast the name.
4
Change it on the router
Open the router's admin page, go to the wireless security settings, paste the new password and save. Every device will need to reconnect.
5
Share the QR code
Download it or print the card. Guests scan it with their camera app instead of typing the password.

Tips, common mistakes and the maths behind the length

Why WPA2 needs a longer password

With WPA2, anyone in range can capture the connection handshake and then guess offline, with no lockout. Each guess is slowed by 4,096 rounds of key derivation, yet one RTX 4090 still tests about 2.5 million per second. Average times for a random password on that single GPU:

✓8 digits — about 20 seconds
✓8 lowercase letters — about 11 hours
✓8 letters and digits — about 1.4 years, or about 5 days on 100 rented GPUs
✓12 letters and digits — about 20 million years; 16 adds a huge safety margin

WPA3, and the transition-mode catch

WPA3 replaces that handshake with SAE, which is designed to resist offline dictionary attacks: every guess has to go through the live network. That is why 12 characters is enough on a WPA3-only network. But in transition mode the router accepts WPA2 connections with the same password, and researchers demonstrated a downgrade attack that brings back the offline guessing — so treat a mixed network as WPA2.

Common mistakes

The password is not the only way into a router.

✓Leaving WPS on: a design flaw lets its 8-digit PIN be found in at most 11,000 attempts, and CERT's advice is to disable it
✓Still using WEP or WPA-TKIP — both are obsolete
✓Using a phone number, date or name as the key
✓Keeping the router's admin password unchanged — it is a separate secret from the WiFi key

Sources

The 8–63 character limit and the WPA cracking speed (2,533 kH/s for mode 22000 on one RTX 4090) come from hashcat's documentation and benchmark; times are averages for random passwords, and human-chosen passwords fall much faster. WPA3 and transition-mode behaviour follow the Dragonblood paper; the WPS figures follow CERT/CC. The 12- and 16-character recommendations are this tool's guidance derived from those numbers, not values set by the Wi-Fi standard.

Features

✓Choose WPA3, WPA2, WPA, WEP or an open network, with a recommended minimum length for each
✓Random password from 55 unambiguous letters and digits (no l, I, 1, L, o, 0, O), 8 to 63 characters
✓Scannable QR code in the standard WIFI: format — special characters escaped, hidden networks supported
✓Download the QR code as PNG or SVG, or print a WiFi card showing the network name and password
✓Runs entirely in your browser — nothing is ever uploaded or logged

Frequently Asked Questions

How long should a WiFi password be?

At least 16 random characters on a WPA2 network or a mixed WPA2/WPA3 network, and at least 12 on a WPA3-only network. The difference exists because WPA2 passwords can be attacked offline once a handshake is captured, while WPA3 forces every guess through the live network. These figures are this tool's recommendation, derived from measured cracking speeds rather than set by the WiFi standard.

What is the minimum and maximum WiFi password length?

A WPA2 personal network accepts a password of 8 to 63 characters, and a mixed WPA2/WPA3 network is held to the same limit; some WPA3-only routers accept longer ones. Eight is only the floor — eight random letters and digits last about 1.4 years on average against a single high-end GPU. Sixty-three characters is perfectly usable when a QR code does the typing.

What are the WPA2 password requirements?

Only the length: 8 to 63 characters. There are no rules about upper case, digits or symbols, so strength depends entirely on how random and how long the password is. The network name is mixed into the key calculation, which means the same password on a differently named network has to be attacked separately.

Is WPA3 more secure than WPA2?

Yes, mainly against password guessing. WPA3's SAE handshake is designed so that a captured connection cannot be attacked offline; each guess requires talking to the network. The protection disappears for devices that connect through WPA2 in transition mode, so use WPA3-only where every device supports it.

How long does it take to crack a WiFi password?

For a random WPA2 password on one RTX 4090 running at about 2.5 million guesses per second, the average is about 20 seconds for 8 digits, 11 hours for 8 lowercase letters and 1.4 years for 8 letters and digits. Twelve random letters and digits take about 20 million years. Passwords made of words, names or dates fall far faster because they are tried first.

Why doesn't the generated password include symbols?

Letters and digits are the characters every device keyboard can enter easily — TV remotes, printer panels and game consoles included — and they need no escaping inside a WiFi QR code, where characters such as ; , : " and \ must be escaped. The missing symbols are made up for by length: this generator also leaves out look-alike characters, and 16 characters from the remaining 55 letters and digits still carry about 92 bits of entropy.

Will the QR code work on iPhone and Android?

The code uses the widely supported WIFI: format, and both iPhone's Camera app and Android can read QR codes; Android 12 and later can even share networks as QR codes from Settings. The format's documented type values are WEP, WPA, WPA2-EAP and nopass, so the code uses WPA for both WPA2 and WPA3 networks. If a device does not offer to join, the printed card shows the password to type in.

Is my network name or password sent anywhere?

No. The password and the QR code are both created in your browser and never leave your device. Nothing is uploaded, logged or stored after you close the tab.