The standard advice about passwords is nearly always the same: mix uppercase, lowercase, numbers, and symbols. The result is a password that's agony to type on a television remote — and it turns out not to be as strong as promised.
For Wi-Fi, one factor matters far more than any of that.
Length beats complexity
The reason lies in how Wi-Fi passwords are attacked. An attacker doesn't guess through a live connection — that's far too slow. What they do is record the opening exchange between a device and the router, then guess against it on their own computer with no speed limit.
In that situation, what matters is how many possibilities must be tried. And here length wins decisively: each additional character multiplies the number of possibilities, while adding one symbol to a short password barely shifts the figure.
| Example | Length | Resilience |
|---|---|---|
P@ssw0rd! | 9 | Very weak — a well-known pattern |
Home2024 | 8 | Weak |
k7Qm2xPz | 8 | Moderate, and hard to type |
coffee-umbrella-bicycle-rain | 28 | Very strong, and easy to say |
The last row is the interesting one. It's easier to read, easier to say aloud to a guest, easier to type on a television remote — and far harder to guess than the three rows above it.
Why common patterns don't help
Modern guessing tools don't try every combination at random. They use word lists, lists of previously leaked passwords, and rules that imitate human habits.
Habits those tools already account for:
- Swapping a for 4, e for 3, o for 0, i for 1
- Adding a year at the end
- Adding an exclamation mark at the end
- Capitalising the first letter
- Using place names, brands, or your own business name
A password combining all those habits looks complex to a human, but sits near the front of the list a machine works through.
The business name is the most commonly used password in business premises. The café's name plus its founding year, or the street name plus a number. It's the first pattern anyone tries, and it's written in large letters on the sign out front.
How to build one
Pick four unrelated words
Genuinely random, not a fragment of a sentence. table-mountain-candle-blue is far
better than welcome-to-my-home, because the second is a phrase guessable as a
unit.
Join them with hyphens
Hyphens make it easy to say aloud to a guest, and still count as characters. Avoid spaces, especially at the start or end — that invisible detail is a fairly common cause of "wrong password" complaints.
Add a number if you like
Fine, but not a year and not in an obvious position. It's a garnish, not the source of strength.
Check it's at least twelve characters
Four ordinary words comfortably exceed that. If yours comes in under twelve, add another word.
Any password needs the right encryption
This part often gets missed. A twenty-eight character password doesn't help much if the network still uses old encryption.
Make sure the router is set to WPA3, or WPA2-AES if older devices can't yet handle WPA3. Avoid WEP and TKIP entirely — both can be broken regardless of the password used. The differences are covered in the guide to WPA2 vs WPA3.
WPA3 has one advantage that's relevant here: it makes a recorded opening exchange useless for guessing the password later. That means even shorter passwords become far more resilient — though length remains the better habit.
Two different passwords
A router has two passwords, and they're frequently confused:
| Wi-Fi password | Admin password | |
|---|---|---|
| Purpose | Joining the network | Opening the settings panel |
| Shared? | Yes, with guests | Never |
| If it leaks | People can use your internet | People can change anything |
The admin password must be different, and should never be left at the factory default. Each brand's default combinations are publicly available online. The steps to change it are in the guide to securing a home router.
When to change it
Changing passwords on a schedule for no reason pushes people towards something easier to remember — which means weaker. Better to change it at particular moments:
- After it's been shared widely, such as during an event at home
- After a long-term guest or contractor has finished
- After an employee leaves, for a business network
- If an unrecognised device appears in the router's list — the guide to seeing who's using your Wi-Fi
- If the password is still the factory default or shorter than twelve characters
The steps to change it are in the guide to changing your Wi-Fi password.
For guests and businesses
The main password is best not shared with anyone outside the household. Create a separate guest network with its own password — that way the guest password can be changed at any time without reconnecting every device in the house. How to do it is in the guide to separating a guest network.
For a café or guesthouse, a QR code removes the typing problem entirely while allowing a long password without inconveniencing guests — the guide to making a Wi-Fi QR code.
In short
Four random words joined by hyphens, at least twelve characters, with WPA3 or WPA2-AES encryption. The router's admin password made different and never shared.
That alone surpasses nearly every complicated password normally recommended — and you can still say it aloud to a guest without spelling it out letter by letter.
Frequently asked questions
How long should a Wi-Fi password be?
At least twelve characters, and sixteen or more is considerably better. Length is the decisive factor — each added character multiplies the effort needed to guess it, far outweighing the benefit of adding symbols.
Does swapping letters for numbers make it stronger?
Barely. Substitutions like a for 4 or o for 0 have long been patterns that guessing tools account for. The result is hard for humans to type but not hard for machines to guess.
Should Wi-Fi passwords be changed regularly?
Not if the password is long and has never leaked. What matters more is changing it at particular moments — after it's been shared widely, after a long-term guest, or after an employee leaves.
Can the router admin password be the same as the Wi-Fi password?
It shouldn't be. They protect different things: the Wi-Fi password is shared with anyone who wants to connect, while the admin password grants full control over the entire network.
