WPS: The Convenient Button, and Why to Turn It Off

Nearly every router has a small button marked WPS. Some people use it to connect a printer or a smart device without typing a long password; most never touch it at all.

What's rarely noticed is that the button isn't a shortcut sitting idle. It changes how your network admits guests.

Two ways WPS works

WPS comes in two forms whose security is wildly different, and they're routinely treated as one thing.

The button method

You press the button on the router, then a matching button on the device. For roughly two minutes, the router accepts anyone asking to join, with no password.

That two-minute window is the entire protection, and it rests on one assumption: that nobody else is within range of your Wi-Fi at that moment. In a detached house, reasonable. In a block of flats, a boarding house, or a row of shops, your Wi-Fi reaches a dozen people you don't know.

The PIN method

This is the broken one. The device sends an eight-digit PIN and the router checks it.

The flaw is in the design, not the usage: the router checks that PIN in two separate halves: the first four digits, then the next three, with the last digit only a check digit. Instead of guessing ten million possibilities, an attacker needs about eleven thousand.

That isn't years of work. It's a few hours, by a device standing outside the fence. On routers that generate their random values poorly, the whole PIN can be computed in seconds: an attack known as pixie dust.

What makes it worse than an ordinary leak: once the PIN is known, the router hands over the actual Wi-Fi password. Changing that password doesn't close the hole, the PIN still works, and the new password is handed over the same way.

Hasn't WPA3 fixed this?

Partly. Many new routers no longer enable WPS PIN from the factory, and WPA3 has a better joining method of its own. The difference is covered in the guide to WPA2 versus WPA3.

Two things keep it unfinished, though. First, most home networks still run in mixed WPA2/WPA3 mode for the sake of older devices, and in that mode the old WPS path is often still alive. Second, routers that have been in service for years, or bought second-hand, frequently carry old settings. What to check on used equipment is in the guide to second-hand router security.

So the answer stands: check for yourself rather than assume.

Checking and disabling it

1. Open the router's admin page. If you never have, the steps are in the guide to setting up a new router.
2. Find the WPS menu: usually inside the wireless settings, sometimes labelled Wi-Fi Protected Setup, or QSS on certain brands.
3. Disable the PIN method first. This is the one that matters. Some routers list it as "Router PIN" or "Client PIN".
4. Disable the button method too if you live close to many others, or simply never use it.
5. Save, then check again after the router restarts. Some routers re-enable WPS after a firmware update or a factory reset.

If there's no WPS menu at all, your router most likely doesn't have it, and that's good news.

If you genuinely still need it

Some devices are awkward to connect any other way: screenless printers, certain smart-home gear, and older equipment with no keyboard. For those:

• Turn WPS on only when needed, then off again once the device has joined. A few minutes is far better than several years.
• Use the button, never the PIN.
• Put such devices on a separate network, not the main one your laptop and phone live on, the guide to separating a guest network covers how. Why is covered in the guide to smart home device security.

For most modern devices there's a better route: share the password with a Wi-Fi QR code. It removes the typing without opening anything on the router.

After turning it off

If WPS was enabled on your network for a long time, the PIN method especially, treat the old Wi-Fi password as no longer secret. Replace it, and pick a decent one: guide to strong Wi-Fi passwords.

While you're on that page, check the rest: remote management, UPnP, and the default admin password. The list is in the guide to securing your home router. WPS is rarely the only thing left open.

Conclusion

WPS saves you typing a password once. What it trades away is an entrance that hands your Wi-Fi password to anyone who guesses eight digits, digits designed, as it turns out, to be far easier to guess than they should be.

Disable the PIN method without a second thought. The button can stay if you live at a distance and actually use it; in dense surroundings, disable both.

And if WPS has been on for a long while, change the Wi-Fi password after switching it off. Closing the door isn't enough once the key has been circulating.

Frequently asked questions