WiFi Password Generator - WPA2 and WPA3 Passphrases

Guessing is not the weak point here. The choice you are really making is how painful it is to type

The problem nobody warns you about. You pick the longest, nastiest password on offer, save it in the router, and then spend the next two years reading it out over the phone, squinting at a lowercase l that might be a 1, and thumbing it into a smart TV with a remote control that has no keyboard. Meanwhile the security gain over a shorter option is, in practice, zero.

A 12 character password from the reduced set carries 70 bits of entropy, assuming each character is an independent uniform draw. Nothing brute forces that. Going to 32 characters takes you to 186 bits, which is not more secure in any way that matters, only 20 characters longer. How good the source of randomness itself is, is a separate question, and the last section answers it plainly.

What this generator does about it

It reports entropy, not a made up crack time. Bits are computable and honest. A number of years is a guess about someone else's hardware dressed up as a fact.

It offers a set with the look-alikes removed. No capital I, no capital O, no lowercase l, no lowercase o, no zero, no one. Six characters gone, and with them the phone call that starts with "is that an ell or a one".

It gives you up to five at a time. A password you can half remember while you walk to the router is worth more than a marginally stronger one you have to copy character by character.

How to set a new WiFi password step by step

Length - from 12 to 32 characters. Sixteen is the number to pick if you have no reason to pick another.
Character set - letters and digits (62 characters), the same plus symbols (76), or the reduced set with look-alikes removed (56). The reduced set costs you about 0.15 bits of entropy per character and saves you every argument about whether that was a zero.
How many to generate - one, three or five. Generating several and picking the one that reads best out loud is the whole point.
Read the entropy line - the bit count tells you where you stand. Anything at or above 80 bits is past the point where brute force is the threat.
Put it in the router - the admin page is usually at 192.168.1.1 or 192.168.0.1, under Wireless and then Security. Choose WPA3-SAE if the router has it, otherwise WPA2-PSK with AES.
Save it somewhere real - a password manager, and a printed copy in the drawer. Every device on the network has to be reconnected, so do this when nobody is on a call.

Decision table: which combination to pick

Entropy is length multiplied by the base two logarithm of the character set size. That is the only number in this tool that is exactly computable, so it is the one the table is built on.

Your situation	Length	Character set	Entropy
Home network with guests and smart devices (the common case)	16	No look-alikes	93 bits
You type it into a TV or a console with a remote control	12	No look-alikes	70 bits
You only ever paste it from a password manager	20	Letters, digits and symbols	125 bits
Office or shared network, policy asks for symbols	16	Letters, digits and symbols	100 bits
Guest network you rotate every few months	12	Letters and digits	71 bits
You want the biggest number on the page	32	Letters, digits and symbols	200 bits

Quick cheat sheet: entropy for every combination

Fifteen numbers, all of them length multiplied by the logarithm of the set size, rounded the same way the tool rounds them. The 80 bit line is where brute force stops being a sensible thing to worry about.

Length	No look-alikes 56 characters	Letters and digits 62 characters	With symbols 76 characters
12	70	71	75
16	93	95	100
20	116	119	125
24	139	143	150
32	186	191	200

Look down the columns rather than across the rows. Moving from the reduced set to symbols at the same length buys you 5 bits at 12 characters and 14 at 32. Moving from 12 characters to 16 in the same set buys you 23. Length does far more work than the character set, which is the opposite of what most password advice implies.

Five situations and what to do

The router is in the hallway and guests keep asking for the password. Sixteen characters, look-alikes removed. It fits on a card by the door and survives being read out loud.
Result: 93 bits, and no arguments about the letter O.

A printer and two cameras have to be re-paired by hand. Twelve characters, look-alikes removed. Older devices sometimes reject symbols outright, and every character is one more chance to mistype.
Result: 70 bits, still nowhere near brute forceable.

Everything on the network is a laptop or a phone with a password manager. Twenty characters with symbols. Nobody types it, so the typing cost is zero and you may as well take the bits.
Result: 125 bits.

Someone moved out and knows the old password. Any setting will do, because the point is the change, not the strength. Generate three, pick one, and remember that every device needs reconnecting.
Result: the previous password stops working the moment you save.

The router only offers WPA2 and the password field caps at 63 characters. That cap is part of the WPA2 specification, not a limitation of your hardware. The longest option here is 32, comfortably inside it.
Result: 200 bits at the top setting, half the field unused.

Questions people actually ask

How random are these passwords, really?

They come from the JavaScript pseudo-random generator, which is not a cryptographic source. In practice that is fine for a home network, because the payoff for attacking the generator rather than the network is not worth the effort. It is not fine for anything you would defend seriously: for that, use the generator built into a password manager, which draws from the operating system. The bit counts on this page describe the password on the assumption of a uniform draw, and that assumption is exactly what a non-cryptographic source does not guarantee. This page says so outright rather than printing the word "cryptographic" and hoping nobody checks.

Why does the tool not tell me how many years it takes to crack?

Because that number is not a property of your password, it is a property of somebody else's graphics card. WPA2 turns the passphrase into a key with PBKDF2-HMAC-SHA1 over 4,096 iterations, which deliberately makes each guess expensive, so the honest answer spans several orders of magnitude depending on hardware. Entropy in bits does not move. At 70 bits, the weakest setting offered here, a rate of a million guesses a second would still need millions of years on average.

Do symbols make a password meaningfully stronger?

Barely. Adding the 14 symbols takes the set from 62 to 76 characters, which is 0.29 extra bits per character. At 16 characters that is 5 bits in total, slightly less than the 6 you would get by making the password one character longer. Symbols are worth using when a policy demands them or when nobody has to type the password by hand, and not otherwise.

What exactly does the reduced set remove?

Six characters: capital I, capital O, lowercase l, lowercase o, the digit zero and the digit one. Those are the pairs that get confused on a printed card, in a hallway, and in most sans serif fonts. The set drops from 62 to 56, which costs about 0.15 bits per character. At 16 characters you give up 2 bits in total, and you will never again spell a password out over the phone.

WPA2 or WPA3?

WPA3 if every device on the network supports it, because its handshake removes the offline guessing attack entirely rather than just making it slow. In practice most homes run mixed mode, because one old printer or thermostat will only speak WPA2. A long random password is exactly what makes that compromise safe, since the offline attack WPA2 permits is the one this password defeats.

Should I change the WiFi password regularly?

No, not on a schedule. A random password does not wear out, and rotating it means re-pairing every device in the house for nothing. Change it when a reason appears: somebody left, you handed it to a contractor, the router was reset, or you finally noticed it is still the string printed on the sticker underneath.

Is the password on the sticker under the router a problem?

Sometimes. Factory passwords are usually random and long enough, but on some models they are derived from the network name or the serial number, and those schemes have been published for specific manufacturers. The sticker is also visible to anyone who walks past the router. Replacing it costs ten minutes once.

Related tools

Password Generator

For accounts rather than routers, with a strength rating and a character mix you control - Open the generator

Nickname Generator

The public half of the same job: a network or account name instead of the secret - Open the generator

Random Number Generator

Draws from a range you set, when you need digits rather than a passphrase - Open the generator

Anagram Generator

Rearranges a word you choose, which is how memorable passphrases go wrong - Open the generator

Color Generator

Random values of a different kind, in HEX, RGB and HSL - Open the generator