You need your WiFi router’s admin panel (the
router-security tutorial shows how to
find and log into it) and, for one step, Python 3 to generate a strong
passphrase — check with python3 --version. Two steps also show optional
Linux terminal commands.
The Python command’s output was captured on a real machine; the router-panel screens vary by brand, so those steps describe what to look for rather than an exact button. Changing your WiFi password disconnects every device until you re-enter the new one, so do this when that is convenient.
Understanding WiFi Encryption
WiFi encryption protects the data transmitted between your devices and your router. Without encryption, anyone within range can intercept your traffic.
Choosing a Strong WiFi Password
Your WiFi password is the primary barrier against unauthorized access. Follow these guidelines:
- Length: At least 12 characters, ideally 16 or more
- Complexity: Mix of letters, numbers, and symbols
- Avoid: Dictionary words, names, addresses, phone numbers, or common patterns
- Consider: A passphrase like "Sunset-Coffee-Mountain-42!" is strong and memorable
The password printed on your router's sticker is often generated from predictable patterns. Always set your own unique password.
MAC Filtering
MAC filtering restricts network access to devices with specific MAC addresses (hardware identifiers). While it adds a layer, it is not a strong security measure because:
- MAC addresses can be easily spoofed (faked) by attackers
- It creates management overhead when adding new devices
- It provides a false sense of security
Verdict: Use MAC filtering as an additional measure, but never rely on it as your primary protection. Strong encryption and a good password are far more important.
Hidden SSID: Pros and Cons
Hiding your network name (SSID) makes it invisible in the normal WiFi scanner list.
- Pro: Casual users will not see your network
- Con: Any attacker with basic tools can still detect hidden networks
- Con: Your devices must broadcast the hidden SSID name to connect, which can actually leak information
- Con: Causes connection issues on some devices
Verdict: Hiding your SSID provides minimal security benefit and can cause usability issues. Focus on strong encryption and passwords instead.
Monitoring Connected Devices
Periodically check which devices are connected to your network. Most routers show a connected devices list in the admin panel (often under "DHCP" or "Connected Clients").
What to look for:
- Recognize every device on the list (by name, MAC address, or IP)
- Unknown devices may indicate unauthorized access
- If you find unknown devices: change your WiFi password immediately
On Linux, you can scan your network to discover connected devices:
sudo nmap -sn 192.168.1.0/24On Windows, you can use:
arp -aNow Do It Yourself: Secure Your WiFi in Five Steps
WiFi encryption is the difference between a private conversation and one shouted across the street. In five steps you will check which encryption your network uses, switch it to the strongest your gear supports, generate a passphrase no dictionary attack can guess, understand why two popular “security” tricks barely help, and list the devices actually connected to you. The passphrase step was run on a real machine; the panel steps describe what every router offers.
Go: your router’s admin panel, Wireless or WiFi → Security. On Linux you can also read it from the terminal.
Do: note the Security Mode shown. On Linux, list nearby networks and their security with one command.
nmcli -f SSID,SECURITY device wifi listYou should see: a security value for your network — ideally
WPA3 or WPA2. If it says WEP, WPA, or
-- (open), that is the problem this tutorial fixes: WEP is broken and open
networks encrypt nothing.
If not: nmcli: command not found just means that convenience
command is absent — read the value straight from the router panel instead, which is the
source of truth anyway. On Windows, Settings → Network & Internet → WiFi
→ (your network) → Properties shows the security type.
Go: the same Wireless → Security screen.
Do: set Security Mode to WPA3-Personal. If your router or older devices do not support it, choose WPA2-Personal (AES/CCMP) — never “WPA/WPA2 mixed with TKIP”, because TKIP drags the whole network down to a weak cipher.
You should see: the mode saved, and the router warn that connected devices must reconnect. A “WPA2/WPA3 mixed” option is a reasonable compromise if one old device cannot do WPA3.
If not: if a device refuses to join after the switch, it is too old for the new mode; either use the mixed mode, or put that device on a separate guest network rather than weakening your main one. Never drop back to WEP to accommodate it.
Go: a terminal. A WiFi passphrase is typed once per device, so it can be long and random — that is the strongest kind.
Do: generate one with Python, then paste it into the router’s WiFi Password / Pre-Shared Key field.
python3 -c "import secrets; print(secrets.token_urlsafe(18))"You should see: a 24-character random string like
dN-DJV6aM7cOwAJG2lw1spBN (yours will differ). That carries about
144 bits of entropy — far beyond any brute-force. If you would rather
have something you can read aloud, use a real diceware list of 7,776 words and pick
six: that is about 78 bits, still strong. Four words from a tiny hand-made list is only ~18
bits — weak; do not do that.
If not: if the router rejects the passphrase, it may enforce a length
limit (WPA2 allows 8–63 characters) or forbid certain symbols; token_urlsafe
uses only letters, digits, - and _, which every router accepts, so
shorten it to fit rather than adding punctuation.
Go: the router’s Wireless settings, where you may be tempted by “MAC filtering” and “Hide SSID”.
Do: understand before you enable either. A MAC address is sent in the clear in every WiFi frame, so an attacker reads an allowed one and clones it in seconds. A hidden SSID is still broadcast by your own devices every time they look for the network, so it is trivially discovered — and it makes your devices more trackable, not less.
You should see: that neither adds real security; they add inconvenience and a false sense of safety. Your encryption (step 2) and passphrase (step 3) are what actually protect the network.
If not: if a guide tells you these are essential, it is out of date. Spend the effort instead on WPA3, a strong passphrase, and a separate guest network for visitors and smart-home gadgets.
Go: the router’s Connected Devices / DHCP Clients list, or a terminal on Linux/macOS.
Do: read the list and account for every entry. From a terminal, the devices your machine has recently talked to on the network appear in the neighbour table.
ip neighYou should see: one line per device, each with an IP and a hardware (MAC) address:
192.168.1.1 dev wlan0 lladdr a1:b2:c3:d4:e5:f6 REACHABLEThe router itself is usually 192.168.1.1. Match every other address to a
device you own — phone, laptop, TV, doorbell. The router’s own list is more
complete because it sees every client; the terminal shows only what your machine has spoken
to recently.
If not: an unfamiliar device is not always an intruder — smart plugs and TVs have unhelpful names. Cross-check by unplugging a suspect device and refreshing the list. Anything that remains and you truly cannot place is a reason to change the WiFi passphrase (step 3), which kicks every device off until it re-authenticates.
Without scrolling up: someone secures their WiFi by hiding the SSID and turning on MAC filtering, but leaves the encryption on WEP. How much harder have they made an attacker’s job? Answer: barely any. The hidden SSID is broadcast by their own devices and the allowed MAC addresses travel in cleartext to be cloned — both are bypassed in minutes — while WEP encryption is broken outright and can be cracked in under a minute. Real protection is WPA3/WPA2-AES plus a high-entropy passphrase; the other two are theatre.
Now do it without the page: generate a fresh passphrase with the step-3
command and work out its entropy yourself — token_urlsafe(n) gives roughly
8×n bits. Then decide the shortest passphrase you would accept for WiFi and
justify the number in bits, not in “it looks random enough”.
Summary
In this tutorial, you learned:
- WiFi encryption standards and why WPA2/WPA3 are essential
- How to choose a strong WiFi password
- The limitations of MAC filtering and hidden SSIDs
- How to monitor devices connected to your network
Combine these measures with the router security settings from the previous tutorial for comprehensive home network protection.