Wi-Fi, routers and smart devices

Why these secrets need different settings

A password manager can fill a 40-character string into a website form without anyone reading it. A Wi-Fi password has to survive being typed on a television remote, read out to a visitor, and entered into a printer's four-arrow keypad. In that world, two things matter more than raw entropy: characters that cannot be confused and a shape that is easy to say out loud.

1. The Wi-Fi network password

WPA2 and WPA3 accept up to 63 characters. Most routers will also happily accept far weaker ones, so the network password should be the strongest secret in the house that people still have to type.

• Settings: length 24, all four character sets on, and Exclude ambiguous characters ticked. That removes 0 O l 1 I — the characters behind most "the guest could not connect" calls.
• If the network is used by visitors or devices with painful keyboards, a five-word passphrase is friendlier: it is easier to dictate over the phone and to type on a game console. Length still gives you the strength; the shape just makes it usable.
• Do not use the router's factory sticker password once you have replaced it — and if the router came with the same default as thousands of others, replace it before the device is ever online.

2. The router's admin panel

This is the account that controls your network, so it deserves the strongest treatment: length 24 or more, symbols included, and never reused from anything else. Two practical points:

• Change it during setup, not "later" — an exposed admin panel is a full compromise of everything behind it.
• Turn off remote administration unless you genuinely need it. A password cannot protect an interface that is answering the whole internet.

3. Smart-home and IoT devices

Cheap devices are where reused passwords cause the most damage, because they are rarely updated and often talk to the cloud. Give each device its own app account password, generated and stored in your manager, and keep the network password separate from it. Where the router supports it, put these devices on a guest or "IoT" network — then a compromised bulb is not sitting next to your laptop.

4. The guest network

A guest network is a good place for a secret you are happy to say out loud: a short passphrase of three or four words, or a 16-character string with ambiguous characters excluded. Rotate it after an event when a crowd has had it, and keep it separate from the network your own devices use.

5. Printers, NAS boxes and cameras

These ship with defaults such as admin/admin or 1234 that are published in searchable lists. Give each one a generated password, and accept that some of them will never receive another update — which is exactly why the password they use elsewhere must not be a password anything else uses.

Settings cheat sheet

• Wi-Fi (typed by people): 24 chars, all sets, exclude ambiguous — or a 5-word passphrase.
• Router admin / NAS / camera: 24+ chars, all sets, unique.
• Guest network: 16 chars, exclude ambiguous — or a 4-word passphrase.
• Every app account behind these devices: 20+ chars, stored in the manager, never shared.

The offline detail people forget

Your Wi-Fi password protects data in transit, but the devices on your network also trust whatever they connect to. Changing a device's default password is what stops it from being enrolled into someone else's service. Neither setting is a substitute for keeping the router's firmware updated, which — unlike a password — you cannot fix by generating a new one.