Your router has two passwords, and almost nobody knows it.
One is the Wi-Fi key: the one you read out over the phone, the one scribbled on a note in the kitchen, the one you give the plumber. The other is the admin password for the box itself, the one that opens the panel where everything gets configured. That second one almost never gets changed, and if you have never changed it, it is still exactly what came printed on the sticker underneath.
The two protect different things and they fail in different ways. It is worth pulling them apart, because twenty years of talking about “the Wi-Fi password” have done a very good job of hiding the other one.
The one you know by heart, and the one you’ve never looked at
The Wi-Fi key decides who can connect to the network. It is an entry permit: with it, a device joins your local network and lives alongside everything else on it.
The admin password decides who can change how the network works. From that panel you set the network name, the encryption type, which DNS servers your entire household uses, which ports are open to the outside, and whether the router can be managed from the internet at all. It is not one more door. It is the door the other doors are configured from.
That is the uncomfortable asymmetry. If somebody has your Wi-Fi key, they are on your network. If somebody has your admin password, your network is theirs: they can change the Wi-Fi key, weaken the encryption or redirect where your traffic goes, and you would find out from the symptoms, never from a notification.
CISA’s advice here has no hedging in it: change the router’s login username and password, because the default information that ships with it may be publicly available for anyone to find, and make the new one long, random and unique. Add one more rule that almost everyone breaks without noticing: it must not be the same as the Wi-Fi key. They are two different things, shared in two very different ways — half the neighbourhood knows one of them; nobody should know the other.
2011 the button that looked convenient
There is a third secret in your router that hardly ever comes up: the WPS PIN, the quick-pairing system that shows up as a button on the box and as an eight-digit number on the sticker.
In December 2011, CERT/CC published vulnerability note VU#723755, based on work by Stefan Viehböck, about a design weakness in how that PIN is checked. What matters to you is not the technical detail: it is the official answer, which is still the same fifteen years later. There was no patch; there was a switch. The recommendation was — and is — to go into the settings and disable WPS. CISA repeats it today in its home network guidance, on the same list where it asks you to disable remote management.
It is the best return on effort in this entire article: two boxes you untick once and never think about again.
2015 when the factory key came pre-calculated
A factory password is not a secret of yours. It is a value the manufacturer chose, printed on the device, listed in the manual, and often repeated across every unit of a model.
And there are published cases of something worse: factory keys that were not random at all but derived from data the router itself broadcasts. NIST’s catalogue holds CVE-2015-0558, about a home router that generated its WPA key from a fixed string and its MAC address. Not long after, a public advisory from SEARCH-LAB about a cable modem widely deployed in Europe put it in one sentence: “The default SSID and passphrase are derived only from the MAC address. Since the MAC address of the device is broadcasted via WiFi, the default password can be calculated easily.” The operator ended up writing to its customers asking them to change it.
You do not need to know how any of that was done — and it will not be explained here — to keep the only part that matters: a key the manufacturer could generate, somebody else could reproduce. Your factory key is not random because it is long and ugly. It is ugly because it came out of a procedure, and procedures get studied.
The easiest password you will ever have to make long
Now the good news, and it is unusual, because security advice almost never comes free.
Every password in your life drags the same hidden enemy behind it: you have to type it. Often by hand, on a phone, in a hurry. That is why people make them short, and that is why “use thirty characters” sounds like a punishment.
The Wi-Fi key doesn’t have that problem. You type it once per device and never see it again: the phone, the laptop and the TV remember it forever. And when somebody does need it, most phones and plenty of modern routers hand it over as a QR code, with nobody typing anything.
Which means: length is essentially free here, so there is no excuse for a short one. The IEEE 802.11i standard, which has defined this since 2004, allows passphrases of up to 63 characters. Almost nobody gets even halfway.
So what should you use? CISA’s suggestion is refreshingly concrete: a memorable passphrase of five to seven unrelated words, at least sixteen characters in total, not used on any other account. It is the diceware idea applied to your living room. If you would rather have a random string and let the QR code do the work, better still: pull it from the generator and never look at it again. And if the one you have now gives you doubts, run it through the checker before you decide anything.
2018 what WPA3 is, and why it changes the maths
In 2018 the Wi-Fi Alliance introduced WPA3, the successor to WPA2. It is now mandatory for any device that wants to carry the Wi-Fi CERTIFIED badge.
The underlying change has an ugly name, SAE, and a very easy consequence to grasp. Under WPA2, somebody nearby could capture the opening handshake between your phone and the router, go home, and test millions of keys per second against that file, with no attempt limit and nobody the wiser. It is exactly the problem of a leaked password database: once the material is on the attacker’s disk, there is nobody on the other end to say no.
WPA3 breaks that. In the Wi-Fi Alliance’s own words, “WPA3-Personal replaces WPA2 Pre-Shared Key (WPA2-PSK) with Simultaneous Authentication of Equals (SAE). Unlike WPA2-PSK, SAE is resistant to off-line dictionary attacks.” Every guess requires talking to the router again, and a router seeing thousands of failed attempts can notice and throttle.
Then there is the honest part, which the same document makes a point of stating. That resistance means “the onus for password security is not placed on users”, and that demanding mixed case and special characters is no longer a valid requirement with SAE. But it is not permission to pick a bad one: the active attack still exists, and the specification says so flatly — passwords used with SAE must be extremely difficult to guess. Which is what NIST has been saying about the rest of your passwords for years: length beats contortion.
Two practical warnings. If your router doesn’t reach WPA3, CISA accepts WPA3 Personal and WPA2 with AES, and only those two; an open network, WEP or TKIP is not a weak password, it is no password at all. And if you turn on transition mode, your network accepts WPA3 and WPA2 at once so older gear can still join — a reasonable call in a house with a printer from 2013, but know what it is: while it is on, your network keeps a WPA2 door. If everything you own speaks WPA3, turn it off.
2024 the law reaches under the sticker
For decades this was a problem of advice. Now it is also a problem of regulation.
On 29 April 2024 the UK’s PSTI regime — the law on the security of connected products — came into force, banning universal default passwords on consumer connectable products: no more shipping every unit of a product with the same key. The law does allow a default password that is unique per unit, which is exactly the sticker case, with a different string on every router. In the European Union, the cybersecurity requirements of the Radio Equipment Directive — Delegated Regulation (EU) 2022/30 — have been mandatory since 1 August 2025.
Two things follow from that, and they are not the same thing. First: new routers will arrive in better shape. Second, and this is the one that concerns you: none of it applies retroactively to the box already sitting in your hallway. If it has been there six years, your house is still running under the old rules.
The guest network, or how to stop dictating your key
Think about how many people know your Wi-Fi key. Your brother-in-law, the babysitter, the friend who came for dinner in 2022 and still has the phone configured, the technician who came to install something.
None of them just got permission to reach the internet: each one has a device inside your local network, next to your NAS, your printer and your cameras. And you have no idea what state that device is in.
The guest network is the answer, and it is a feature you already have and don’t use. CISA spells it out: if your router has a guest Wi-Fi option, enable it, give it its own password — long, random and unique — and let it serve everyone who does not routinely connect to your home Wi-Fi. Then add the part almost nobody does: put the connected gadgets there too — the smart plug, the TV, the vacuum — if all they need is internet access, so they can’t discover the rest of the devices in the house.
It is the principle behind this entire blog applied to the living room: one credential per place. Your main Wi-Fi is a place. Visitors are another.
What to do, in order
- Log into the router panel and change the admin password. It is the one item here you have probably never touched and the one with the most authority. Long, random and different from the Wi-Fi key.
- Set a long Wi-Fi key. Five to seven unrelated words, or a string from the generator. You type it once and share it by QR afterwards.
- Move up to WPA3 if your router allows it. If not, WPA2 with AES.
- Disable WPS and remote management. Two boxes, once.
- Turn on the guest network and send visitors and gadgets there.
- Update the firmware and leave automatic updates on if they exist.
- Don’t reuse either password anywhere else. If you have doubts about any of the ones you already use, run it through the checker.
None of this takes more than twenty minutes, and they are twenty minutes you spend once.
The router is the most important device in your home and the only one that administers itself as long as nobody administers it. It has been on in a corner for years, doing its job without complaining, and that is precisely why it never feels like the moment to look at it.
The factory password isn’t bad because it is short or ugly. It is bad because it isn’t yours. Somebody else chose it, printed it on an adhesive label and shipped it to thousands of homes just like yours. Changing it is the closest thing home computing has to changing the locks when you move in.
Sources: CISA, “Project Upskill · Module 5: Securing Your Home Wi-Fi”, from the Joint Cyber Defense Collaborative — change the router login username and password because default router information may be publicly available, a passphrase of five to seven unrelated words totalling at least sixteen characters, WPA3 Personal or WPA2 AES as the only encryption considered safe, disable WPS and remote management, and enable guest Wi-Fi including for IoT devices · Wi-Fi Alliance, “WPA3 Security Considerations Overview” (April 2019), on replacing WPA2-PSK with SAE, its resistance to off-line dictionary attacks, and the requirement that passwords still be extremely difficult to guess · CERT/CC vulnerability note VU#723755 (27 December 2011), reported by Stefan Viehböck, whose recommended solution is to disable WPS · NVD (NIST), CVE-2015-0558, on a home router that generated its WPA key from a fixed string and its MAC address · public advisory from SEARCH-LAB (Gergely Eberhardt) on the Ubee EVW3226 modem, published on Full Disclosure in July 2016 · IEEE 802.11i, which defines the passphrase as between 8 and 63 characters · United Kingdom, the Product Security and Telecommunications Infrastructure Act regime, in force since 29 April 2024 · European Union, Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive, mandatory since 1 August 2025 · NIST SP 800-63B, on length over complexity.
Photo by Jakub Zerdzicki · Pexels