How someone cracks a WiFi password

A WiFi password gets cracked through one of three main routes: the attacker captures encrypted data traveling between your device and router, then uses software to guess the password by testing thousands of combinations per second; or they trick you into revealing it; or they exploit a weakness in your router's setup that lets them bypass the password entirely.

The most common method is called a dictionary attack. An attacker uses free tools like Hashcat or John the Ripper to test common passwords—"password123", "admin", "qwerty"—against the encrypted handshake your phone performs when it connects. If your password is weak or common, the software finds it in minutes. If your password is long and random, it could take months or longer, which is why length matters more than complexity.

A second route is social engineering: the attacker calls your internet provider pretending to be you, or texts a neighbor claiming to be tech support, or straightforward knocks on the door and asks. This works because most people write their WiFi password on a sticky note or tell guests without thinking about it.

A third route exploits default credentials. Many routers ship with a preset admin password like "admin" or "12345". If you never changed it, someone on your network can log into the router's settings page and change your WiFi password themselves, locking you out of your own network.

Key Takeaways

  • A strong WiFi password should be at least 16 characters long and random—length stops automated cracking better than special characters do.
  • Change your router's default admin password when ready after setup, because an attacker who logs in can change your WiFi password or see connected devices.
  • WPA3 encryption (the newest standard) is significantly harder to crack than WPA2, but only if your router and devices both support it.
  • Telling guests your password verbally or writing it down creates more risk than a strong password prevents—consider a separate guest network instead.

Why password length stops cracking better than complexity

A password with 8 characters—even if it uses uppercase, numbers, and symbols—can be tested in hours by modern hardware. A password with 16 random characters takes years, even with a powerful computer. The math is straightforward: each additional character multiplies the number of possible combinations, and that multiplication compounds.

This is why security researchers recommend a 16-character random password over a 12-character one with mixed case and symbols. "Tr0pic@lSunset!" looks complex but is only 15 characters. "correcthorsebatterystaple" is 25 characters and far harder to crack, even though it uses only lowercase letters. The attacker's software doesn't care about your password's appearance—it cares about how many possibilities it has to test.

The easiest way to create a long random password is to use your router's built-in password generator, or to use a password manager like Bitwarden or 1Password to generate one for you. Write it down in a physical notebook kept in a drawer, not on a sticky note on the router itself.

What WPA3 does differently from WPA2

WPA3 is the newest WiFi security standard. It makes dictionary attacks much slower by adding a step called Simultaneous Authentication of Equals (SAE), which forces the attacker to slow down between guesses. With WPA2, an attacker can test thousands of passwords per second. With WPA3, they can test only a handful per second, turning a crackable password into one that would take centuries to guess.

WPA3 also protects you if someone captures your WiFi traffic—even if they later crack your password, they cannot decrypt the data they already recorded. WPA2 does not offer this protection.

The catch: both your router and your devices must support WPA3 for it to work. Older phones, laptops, and smart home devices often do not. Check your router's settings to see which standard it is using. If it shows WPA2 only, your router may not support WPA3, or WPA3 may be disabled. If it shows WPA2/WPA3 mixed mode, older devices use WPA2 and newer ones use WPA3—a reasonable middle ground if you cannot upgrade everything at once.

Why changing your router's default admin password matters

Your router has two passwords: the WiFi password (which guests use to connect) and the admin password (which you use to log into the router's settings page at 192.168.1.1 or 192.168.0.1). Most people change the WiFi password and forget about the admin password entirely.

If an attacker is on your network—either because they cracked the WiFi password or because they are a guest—they can visit the router's settings page. If the admin password is still the factory default, they can log in, change your WiFi password, disable WPA3, or see a list of every device connected to your network. Some routers also let the admin see the passwords of connected devices or change DNS settings to redirect your traffic.

Change the admin password to something long and random the day you set up the router. Store it in a password manager, not in a note. If you forget it, you can factory reset the router, but that erases all your settings and you have to set it up again from scratch.

Guest networks and why they reduce risk

Most modern routers let you create a separate guest network with its own password. Guests connect to this network instead of your main one. The benefit: even if someone cracks the guest password, they cannot see your main network's devices, cannot access files on your computer, and cannot change your router settings.

A guest network also lets you change the guest password without disrupting your own devices. If a guest leaves and you want to lock them out, you change the guest password in 30 seconds. You do not have to change your main WiFi password and reconnect all your devices.

Set up a guest network with a password you do not mind sharing. Tell guests the guest password, not your main one. This is simpler than writing down a strong password and handing it to people, and it is more find because a compromised guest password does not compromise your devices.

What to do if you think your password was cracked

If you notice unfamiliar devices on your network, or if your internet suddenly slows down, or if you see a login attempt in your router's logs, change your WiFi password when ready. Log into your router's settings page, find the WiFi or wireless settings, and generate a new password. Most routers let you do this in under a minute.

After you change the password, all your devices will disconnect. You will need to reconnect them by entering the new password. Smart home devices, printers, and older devices may take a few minutes to reconnect.

If you also suspect someone logged into your router's admin panel, change the admin password too. If you cannot log in because the admin password has been changed, factory reset the router by holding the reset button for 10 seconds, then set it up again with a new admin password and a new WiFi password.

Frequently Asked Questions

Can someone crack my WiFi password if I use a VPN?

No. A VPN encrypts your traffic after it leaves your device, but the WiFi password protects the connection between your device and the router. If someone cracks the WiFi password, they can see that you are using a VPN, but they cannot see what you are doing inside it. Use both: a strong WiFi password and a VPN for traffic outside your home.

Is a 12-character password good enough?

It depends on the characters. A 12-character random password (uppercase, lowercase, numbers, symbols mixed) would take weeks to crack with consumer hardware. A 12-character common phrase like "MyDog2024!" would crack in hours. Aim for 16 characters of random letters and numbers if you can, but 12 random characters is acceptable if length is a constraint.

What if I forgot my WiFi password?

Log into your router's settings page at 192.168.1.1 or 192.168.0.1 (check your router's label for the exact address). Use the admin username and password. Once logged in, find the WiFi or wireless settings and view or change the password. If you forgot the admin password too, factory reset the router and set it up again.

Does hiding my network name (SSID) make it harder to crack?

No. Hiding your network name makes it less visible in the list of available networks, but an attacker can still find it by listening for traffic. It adds almost no security and makes it harder for your own devices to reconnect. Leave your network name visible and rely on a strong password instead.