The Guest Network on Your Home Router

When visitors ask for the Wi-Fi password, most people give the main one. It sounds trivial, but it means that visitor's phone is now on the same network as the work laptop, the printer, the home cameras, and files shared between family devices.

Nearly every modern home router has the way out: a guest network. One extra Wi-Fi name, with its own password, connected to the internet but not to the other devices in the house.

What actually gets separated

A guest network gives two things at once. First, a separate password, so the main one never leaves the house. Second, and more important, isolation: devices on the guest network can only go out to the internet, and can't see or reach devices on the main network.

Isolation is the point. A visitor's phone that happens to carry a misbehaving app can't scan your home network, can't open shared folders, and can't try logging into a camera's admin page. To that phone, your home is just a door to the internet.

On some routers, isolation between guests is a separate option too, usually called AP isolation or client isolation. With it, two guests can't see each other either. Turn it on if it's there.

Who belongs on the guest network

• Visitors and relatives. The reason the feature exists, and the most obvious.
• Your children's friends who come over. You don't know what's installed on their phones, and you don't need to.
• Temporary workers, such as tradespeople or household help who need internet.
• Smart devices. The most often forgotten. Bulbs, smart plugs, TVs, and robot vacuums rarely get security updates, and most never need to talk to your laptop at all. The risks are covered at length in smart home device security.

There's an exception to the last one. Devices that must be reached from a phone over the local network, such as printers or some app-controlled speakers, stop working on the guest network because your phone can no longer see them. Leave those on the main network and secure them another way, as explained in securing a network printer and Wi-Fi CCTV camera security.

Turning it on

Menus differ by brand, but the order is almost always the same:

1. Log into the router's admin page. If the admin account still uses the default password, change it first; the reasons are in securing your home router.
2. Find the menu called Guest Network, Guest Wi-Fi, or similar. On ISP routers it's sometimes SSID 2 or Multi-SSID.
3. Give it a clear name, such as the household name plus "Guest", so visitors don't pick the wrong one.
4. Use WPA2 or WPA3, same as the main network. A guest network without a password means neighbours and passers-by join too.
5. Make sure local network access is switched off. It goes by various names: "Allow guests to access local network", "Intranet access", and so on. If it's on, the guest network loses its purpose.

Once saved, test with one phone: join the guest network, then try opening the router's admin page or finding the home printer. If neither is visible, isolation is working.

A password that's easy to share

Because this password is meant to be shared, it can be easier to say than the main one, as long as it stays long. A few ordinary words strung together is enough; the principles are in strong Wi-Fi passwords.

Even more convenient: print a Wi-Fi QR code for the guest network and stick it up in the living room. Visitors just scan, and nobody has to spell anything out.

Change the password now and then, say every few months or after a busy family event. Here's the advantage people rarely notice: changing the guest password disrupts none of the family's devices. Changing the main one means reconnecting every device in the house, with steps in changing your Wi-Fi password.

Two extra settings worth using

• A speed cap. Guests still use the same internet connection. One visitor downloading a game update can make your video meeting stutter. Many routers let the guest network be capped, covered in limiting Wi-Fi speed.
• A schedule. A guest network nobody is using doesn't need to stay on. Some routers can switch it off automatically after a few hours or at set times, as in scheduling Wi-Fi on and off.

What it doesn't protect

A guest network separates devices; it doesn't make everything clean. Three things still apply:

• Guest traffic still leaves through your connection. To the ISP, all traffic from the house comes from the same address.
• A device on the main network that's already compromised stays compromised. The guest network keeps problems from coming in with visitors; it doesn't clean what's already inside.
• The router itself is still one device. If an old router no longer gets updates, its weaknesses apply to both networks at once.

Now and then, look at the list of connected devices. An unfamiliar device on the main network, not the guest one, is a sign the main password has been passed around. How to check is in finding out who's using your Wi-Fi.

When the ISP's router doesn't support it

Some ISP-supplied routers hide or disable this feature, or only let it be changed with an admin account the ISP holds. That situation is covered in default ISP router admin accounts.

If it really isn't available, the simplest route is installing your own router or access point with a guest feature behind the ISP router, and making it the main Wi-Fi transmitter. The difference between the two approaches is explained in access point vs an extra router.

For businesses such as cafés, boarding houses, or small offices, the needs are broader: many unknown users, logging duties, and a login page. That's covered separately in separating the guest network and, for cleaner separation, in what a VLAN is.

Frequently asked questions