# Your router has two passwords, and the factory one isn't good enough

> Your router has two passwords: the Wi-Fi one and the admin one for the box itself. Almost nobody has ever touched the second, and it's the one that really runs your house.

2026-09-06 · David Carrero · password.es
Original: https://password.es/en/blog/your-router-has-two-passwords/

---

Your router has two passwords, and almost nobody knows it.

One is the Wi-Fi key: the one you read out over the phone, the one scribbled on a
note in the kitchen, the one you give the plumber. The other is the admin
password for the box itself, the one that opens the panel where everything gets
configured. **That second one almost never gets changed**, and if you have never
changed it, it is still exactly what came printed on the sticker underneath.

The two protect different things and they fail in different ways. It is worth
pulling them apart, because twenty years of talking about "the Wi-Fi password"
have done a very good job of hiding the other one.

## The one you know by heart, and the one you've never looked at

The Wi-Fi key decides **who can connect** to the network. It is an entry permit:
with it, a device joins your local network and lives alongside everything else on
it.

The admin password decides **who can change how the network works**. From that
panel you set the network name, the encryption type, which DNS servers your
entire household uses, which ports are open to the outside, and whether the router
can be managed from the internet at all. It is not one more door. It is the door
the other doors are configured from.

That is the uncomfortable asymmetry. If somebody has your Wi-Fi key, they are on
your network. If somebody has your admin password, **your network is theirs**:
they can change the Wi-Fi key, weaken the encryption or redirect where your
traffic goes, and you would find out from the symptoms, never from a notification.

CISA's advice here has no hedging in it: change the router's login username and
password, because the default information that ships with it *may be publicly
available for anyone to find*, and make the new one long, random and unique. Add
one more rule that almost everyone breaks without noticing: **it must not be the
same as the Wi-Fi key.** They are two different things, shared in two very
different ways — half the neighbourhood knows one of them; nobody should know the
other.

## 2011: the button that looked convenient

There is a third secret in your router that hardly ever comes up: the **WPS** PIN,
the quick-pairing system that shows up as a button on the box and as an
eight-digit number on the sticker.

In December 2011, CERT/CC published vulnerability note **VU#723755**, based on
work by Stefan Viehböck, about a design weakness in how that PIN is checked. What
matters to you is not the technical detail: it is the official answer, which is
still the same fifteen years later. **There was no patch; there was a switch.**
The recommendation was — and is — to go into the settings and disable WPS. CISA
repeats it today in its home network guidance, on the same list where it asks you
to disable remote management.

It is the best return on effort in this entire article: two boxes you untick once
and never think about again.

## 2015: when the factory key came pre-calculated

A factory password is not a secret of yours. It is a value the manufacturer chose,
printed on the device, listed in the manual, and often repeated across every unit
of a model.

And there are published cases of something worse: factory keys that were not
random at all but **derived from data the router itself broadcasts**. NIST's
catalogue holds **CVE-2015-0558**, about a home router that generated its WPA key
from a fixed string and its MAC address. Not long after, a public advisory from
SEARCH-LAB about a cable modem widely deployed in Europe put it in one sentence:
*"The default SSID and passphrase are derived only from the MAC address. Since the
MAC address of the device is broadcasted via WiFi, the default password can be
calculated easily."* The operator ended up writing to its customers asking them to
change it.

You do not need to know how any of that was done — and it will not be explained
here — to keep the only part that matters: **a key the manufacturer could
generate, somebody else could reproduce.** Your factory key is not random because
it is long and ugly. It is ugly because it came out of a procedure, and
procedures get studied.

## The easiest password you will ever have to make long

Now the good news, and it is unusual, because security advice almost never comes
free.

Every password in your life drags the same hidden enemy behind it: you have to
type it. Often by hand, on a phone, in a hurry. That is why people make them
short, and that is why "use thirty characters" sounds like a punishment.

**The Wi-Fi key doesn't have that problem.** You type it once per device and never
see it again: the phone, the laptop and the TV remember it forever. And when
somebody does need it, most phones and plenty of modern routers hand it over as a
QR code, with nobody typing anything.

Which means: **length is essentially free here, so there is no excuse for a short
one.** The IEEE 802.11i standard, which has defined this since 2004, allows
passphrases of up to 63 characters. Almost nobody gets even halfway.

So what should you use? CISA's suggestion is refreshingly concrete: a memorable
passphrase of **five to seven unrelated words**, at least sixteen characters in
total, not used on any other account. It is the diceware idea applied to your
living room. If you would rather have a random string and let the QR code do the
work, better still: pull it from the [generator](/en/) and never look at it again.
And if the one you have now gives you doubts, run it through the
[checker](/en/checker/) before you decide anything.

## 2018: what WPA3 is, and why it changes the maths

In 2018 the Wi-Fi Alliance introduced **WPA3**, the successor to WPA2. It is now
mandatory for any device that wants to carry the Wi-Fi CERTIFIED badge.

The underlying change has an ugly name, **SAE**, and a very easy consequence to
grasp. Under WPA2, somebody nearby could capture the opening handshake between
your phone and the router, go home, and test millions of keys per second against
that file, with no attempt limit and nobody the wiser. It is exactly the problem
of a leaked password database: once the material is on the attacker's disk,
**there is nobody on the other end to say no.**

WPA3 breaks that. In the Wi-Fi Alliance's own words, *"WPA3-Personal replaces WPA2
Pre-Shared Key (WPA2-PSK) with Simultaneous Authentication of Equals (SAE). Unlike
WPA2-PSK, SAE is resistant to off-line dictionary attacks."* Every guess requires
talking to the router again, and a router seeing thousands of failed attempts can
notice and throttle.

Then there is the honest part, which the same document makes a point of stating.
That resistance means *"the onus for password security is not placed on users"*,
and that demanding mixed case and special characters is no longer a valid
requirement with SAE. But **it is not permission to pick a bad one**: the active
attack still exists, and the specification says so flatly — passwords used with
SAE must be extremely difficult to guess. Which is what NIST has been saying about
the rest of your passwords for years: length beats contortion.

Two practical warnings. If your router doesn't reach WPA3, CISA accepts WPA3
Personal and WPA2 with AES, and only those two; an open network, WEP or TKIP is
not a weak password, it is no password at all. And if you turn on **transition
mode**, your network accepts WPA3 and WPA2 at once so older gear can still join —
a reasonable call in a house with a printer from 2013, but know what it is: while
it is on, your network keeps a WPA2 door. If everything you own speaks WPA3, turn
it off.

## 2024: the law reaches under the sticker

For decades this was a problem of advice. Now it is also a problem of regulation.

On 29 April 2024 the UK's **PSTI** regime — the law on the security of connected
products — came into force, **banning universal default passwords** on consumer
connectable products: no more shipping every unit of a product with the same key.
The law does allow a default password that is **unique per unit**, which is
exactly the sticker case, with a different string on every router. In the European
Union, the cybersecurity requirements of the Radio Equipment Directive — Delegated
Regulation (EU) 2022/30 — have been mandatory since 1 August 2025.

Two things follow from that, and they are not the same thing. First: new routers
will arrive in better shape. Second, and this is the one that concerns you:
**none of it applies retroactively to the box already sitting in your hallway.**
If it has been there six years, your house is still running under the old rules.

## The guest network, or how to stop dictating your key

Think about how many people know your Wi-Fi key. Your brother-in-law, the
babysitter, the friend who came for dinner in 2022 and still has the phone
configured, the technician who came to install something.

None of them just got permission to reach the internet: **each one has a device
inside your local network**, next to your NAS, your printer and your cameras. And
you have no idea what state that device is in.

The guest network is the answer, and it is a feature you already have and don't
use. CISA spells it out: if your router has a guest Wi-Fi option, enable it, give
it its own password — long, random and unique — and let it serve everyone who does
not routinely connect to your home Wi-Fi. Then add the part almost nobody does:
**put the connected gadgets there too** — the smart plug, the TV, the vacuum — if
all they need is internet access, so they can't discover the rest of the devices
in the house.

It is the principle behind this entire blog applied to the living room: one
credential per place. Your main Wi-Fi is a place. Visitors are another.

## What to do, in order

- **Log into the router panel and change the admin password.** It is the one item
  here you have probably never touched and the one with the most authority. Long,
  random and **different from the Wi-Fi key**.
- **Set a long Wi-Fi key.** Five to seven unrelated words, or a string from the
  [generator](/en/). You type it once and share it by QR afterwards.
- **Move up to WPA3 if your router allows it.** If not, WPA2 with AES.
- **Disable WPS and remote management.** Two boxes, once.
- **Turn on the guest network** and send visitors and gadgets there.
- **Update the firmware** and leave automatic updates on if they exist.
- **Don't reuse either password anywhere else.** If you have doubts about any of
  the ones you already use, run it through the [checker](/en/checker/).

None of this takes more than twenty minutes, and they are twenty minutes you spend
once.

The router is the most important device in your home and the only one that
administers itself as long as nobody administers it. It has been on in a corner
for years, doing its job without complaining, and that is precisely why it never
feels like the moment to look at it.

The factory password isn't bad because it is short or ugly. **It is bad because it
isn't yours.** Somebody else chose it, printed it on an adhesive label and shipped
it to thousands of homes just like yours. Changing it is the closest thing home
computing has to changing the locks when you move in.

---

*Sources: CISA, "Project Upskill · Module 5: Securing Your Home Wi-Fi", from the
Joint Cyber Defense Collaborative — change the router login username and password
because default router information may be publicly available, a passphrase of five
to seven unrelated words totalling at least sixteen characters, WPA3 Personal or
WPA2 AES as the only encryption considered safe, disable WPS and remote
management, and enable guest Wi-Fi including for IoT devices · Wi-Fi Alliance,
"WPA3 Security Considerations Overview" (April 2019), on replacing WPA2-PSK with
SAE, its resistance to off-line dictionary attacks, and the requirement that
passwords still be extremely difficult to guess · CERT/CC vulnerability note
VU#723755 (27 December 2011), reported by Stefan Viehböck, whose recommended
solution is to disable WPS · NVD (NIST), CVE-2015-0558, on a home router that
generated its WPA key from a fixed string and its MAC address · public advisory
from SEARCH-LAB (Gergely Eberhardt) on the Ubee EVW3226 modem, published on Full
Disclosure in July 2016 · IEEE 802.11i, which defines the passphrase as between 8
and 63 characters · United Kingdom, the Product Security and Telecommunications
Infrastructure Act regime, in force since 29 April 2024 · European Union,
Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive, mandatory
since 1 August 2025 · NIST SP 800-63B, on length over complexity.*