Infinite Passwords
EN

Wi-Fi Password Generator

A router key that survives every dictionary and handshake attack.

…

Random mode supports 4–128 characters.

Generate multiple

Shortcuts: R regenerate · C copy. Generated with crypto.getRandomValues() — never Math.random().

Wi-Fi handshakes are captured in seconds and cracked offline at leisure. A factory-default or birthday password falls fast. A random 20-character WPA2/WPA3 key never does.

Why Wi-Fi passwords get cracked

Attackers capture your network’s 4-way handshake and attack it offline — unlimited tries, no lockout, no alert to you.

Every default password format is in the attackers’ dictionaries. Only a long random string defeats offline cracking completely.

Deep dive

What a Wifi password generator is and how handshake attacks work

A Wi-Fi password generator creates a long, random passphrase for your wireless network, and here is why length is everything on Wi-Fi: WPA2 and WPA3 traffic can be captured by anyone within radio range, and that captured handshake is brute-forced offline on attacker hardware with no server to slow the attack and no lockout to trip. The only defense that truly holds up against that is a passphrase too long and random to crack within any practical lifetime.

Infinite Password Generator is free and runs 100% client-side with the Web Crypto API (crypto.getRandomValues). Nothing is stored or transmitted, not even to us, not ever. For a router you want a 20+ character result from the 20 character generator, or a long memorable passphrase you can type into TV and console remotes when six random words cover the daily case. Six to ten random words beat any clever single word you might invent.

How to set a strong WPA2 Wifi password on your router

Sign in to your router admin panel, usually at the gateway address printed on the device or in its manual, and find Wireless Security. Choose WPA3 if supported, otherwise WPA2 with AES only. Never WEP, never WPA with TKIP. Replace the default Wi-Fi password with your generated 20+ character passphrase, and disable WPS if your router offers it, since the WPS PIN brute-force path effectively bypasses your passphrase strength entirely.

While you are in the panel, change the router admin password from the factory default too, since anyone already on the network can otherwise reconfigure everything you set here. Update the firmware to the latest version, hide nothing that does not matter, and consider a separate guest network with its own generated passphrase for visitors and smart devices. Weak IoT gadgets should never share a network with your laptops and phones. Treat guest access as a favor, not a right.

After generating: storing, sharing and rotating your Wi-Fi password

Store the passphrase in your password manager, and share it with household members through the manager’s sharing feature or a Wi-Fi QR code, never by shouting it across the room or pasting it into a chat app. Rotate the passphrase whenever a housemate moves out, a device is sold or recycled, or you suspect a neighbor has cracked it. Rotation costs five minutes and forces every previously joined device through the new credential.

If something feels off, open the router’s connected-clients list and look very carefully for devices that are not yours, then change the Wi-Fi passphrase immediately and reconnect only your own gear one by one. If the admin password was ever the factory default, factory-reset the router entirely, update the firmware, and reconfigure from scratch. Weak WPA2 passphrases fall to offline cracking; yours now will not, and your guests’ devices should use the guest network instead.

WPA2 vs WPA3: choosing the security mode your router actually offers

Open your router's wireless security settings and you will find a menu of modes: open, WEP, WPA, WPA2, and WPA3, sometimes presented as a mixed WPA2/WPA3 transition mode. Most routers ship with WPA2 as the default, but knowing what each option genuinely means is the difference between a wall and a screen door. WEP is trivially broken by design and must never be selected at any time. The original WPA is deprecated for the same reason. These legacy modes exist only for ancient devices that truly cannot be replaced or updated. If your router is older than your phone, assume the menu offers fewer protections than it should. Anything with WEP on it is broadcasting its own house keys to anyone parked nearby. Security here is subtraction, not addition; remove what cannot be defended and stop there.

WPA2 with AES encryption remains broadly secure for home use, and its weakness is the one covered elsewhere in this file: offline cracking of captured handshakes against short passphrases. The strongest link in any chain is only as strong as its passphrase, and WPA2 depends on yours entirely for real safety. WPA3 upgrades the handshake with simultaneous authentication of equals, which defeats offline dictionary attacks entirely and even protects open guest networks through individualized encryption tied to each device. If every device in your home supports WPA3, choose it without hesitation and move on with your life. The chain is only as strong as its passphrase, so length carries WPA2's entire defensive weight. Choose WPA3 when your oldest device supports it, or transition mode when it does not, and be done deciding.

The realistic middle path is transition mode: WPA2/WPA3 lets older laptops join while newer phones, tablets, and TVs negotiate WPA3 automatically in the background. Check the router manual for the exact menu label, update the firmware first so the option exists at all, then set a 20-plus character generated passphrase regardless of which mode you land on. Disable WPS in the same screen, because its PIN mechanism undermines either standard completely. Reboot, rejoin each device once, and confirm the negotiated connection mode the router reports. Do all of this once per router, and your future self stops thinking about Wi-Fi security for years. Because an unlocked router is a shared public utility, not a private home network with invisible boundaries, for you or for anyone driving past your house.

Wi-Fi password mistakes — and how the handshake attack actually works

Attackers do not need your Wi-Fi password to be on a sticky note — they capture the four-way handshake your device performs when it joins the network, then crack it offline at enormous speed. A weak Wi-Fi password falls to that offline attack in days; a generated 20-character one takes longer than the universe allows. The difference is entropy, and routers accept any WPA2/WPA3 passphrase between 8 and 63 characters, so there is zero excuse to live with “Starbucks2024” or the default on the sticker underneath the box.

Common mistakes: keeping the ISP default, using the network name as the password, reusing it as the router admin password (they are separate — fix both), and never updating it after guests come and go. Change the Wi-Fi passphrase via your router admin panel (usually 192.168.1.1 or 0.0.0.0-range default, check the sticker), paste in output from this page, and set a unique admin password too. While you are there, switch to WPA3 if your router and devices support it — it closes the offline-crack gap entirely.

Then harden the rest: create a separate guest network for visitors (it segments their devices from your NAS and laptops), disable WPS (trivial to brute-force), keep router firmware updated, and store the passphrase in your password manager instead of texting it around. If you ever suspect compromise — unknown devices in the client list — rotate the passphrase immediately and remove unknowns. Your Wi-Fi is the front door; a generated passphrase is the difference between a lock and a rumor.

Frequently asked questions

20+ characters. WPA2/WPA3 accepts up to 63 ASCII characters — there is zero reason to be short.
WPA2/WPA3 accepts most printable ASCII, including symbols. Use them, or just max out the length.
Capture the handshake, run offline GPU cracking. Short/common passwords fall in minutes; 20 random characters never do.
You’ll re-enter the new key on each device once — a small price for a permanently safe network.
The right password is one that is random, unique to a single account, and long enough to resist brute force — full stop. It is not about looking complex; it is about being unpredictable to both humans and machines. If you can recall your own password by meaning, it is the wrong one.
A powerful password maximizes entropy: length first, then true randomness, then character-class diversity — and it must be unique per account. A 16-character random mixed string (~95 bits) is powerful; an 8-character one with clever symbols is not. Uniqueness is the multiplier that makes raw strength matter.
A password generator is a tool that creates random, hard-to-guess passwords using a cryptographically secure source of randomness. This tool creates them locally in your browser with the Web Crypto API (crypto.getRandomValues) — free, instant, and nothing ever leaves your device or is stored.
Three steps: 1) Open this site or any browser-based generator built on the Web Crypto API. 2) Set the length to at least 16 characters and enable upper, lower, numbers and symbols (exclude ambiguous characters only if you must type it by hand). 3) Click generate and copy the result into a password manager — never reuse it.
Yes — provided they are built on a cryptographically secure random number generator. This tool uses the browser’s Web Crypto API (crypto.getRandomValues), the same source used for TLS keys. That output is indistinguishable from true randomness, so guessing attacks perform no better than pure chance against it.
Anything short (under 12 characters), human-invented, reused across sites, derived from a leaked corpus (123456, qwerty, password), or padded with predictable patterns — a capital first letter plus a trailing exclamation mark does nothing against modern rule-based crackers.
A unique password is one used nowhere else — never before, never again, never a variant with a swapped symbol. Reuse is the single highest-impact failure mode in real-world breaches: one leak opens every account sharing the password. Generate a fresh one per account and let a password manager remember them.
The best password generator is free, client-side, cryptographically random and never stores what it makes. Every serious option meets that bar — and this site is one of them: no signup, no limits, Web Crypto API, zero network calls. The worst “free” generators are ones that phone your new password home.
There is no single perfect password — but a practically perfect one is long (16+ characters), fully random, unique to one account, stored in a password manager, and backed by two-factor authentication. Anything short, human-invented or reused fails at least one of those.
“123456”, without contest — it tops NordPass’s annual lists and multi-year breach datasets. It is so dominant that security guides open with it. If you have ever used it anywhere, rotate those accounts today.
Across leaked-credential analyses, the top of the table is consistently: 1) 123456, 2) 123456789, 3) 12345 — with “password” never far behind. Those three appear in more breaches than all complex passwords combined. Anything resembling them is pre-guessed on every attacker’s rig.