Weak WiFi password: one captured handshake is all it takes

What the audit found

At least one WiFi security profile in your export has a pre-shared key that is weak: too short, made of common words or names, digits only, or otherwise on the shortlist of things an attacker tries first. The audit shows a masked form of the affected password in the report and notes if further profiles have the same problem.

The audit rates this high for a password that would fall quickly to an offline attack and medium for one that is merely below a comfortable margin. Passwords are only checked when the export was created with sensitive values shown; otherwise the audit cannot see them.

Why it matters

Guessing a WiFi password is not like guessing a login on a website. There is no server to slow the attacker down and no account to lock.

WPA2 with a pre-shared key works like this: when a device joins the network, it and the access point exchange a short four-message handshake that proves both sides know the password. That handshake can be recorded by anyone within radio range, and modern tools can even provoke a device into re-joining so the recording takes seconds. The attacker then leaves. At home, on an ordinary graphics card, the recorded handshake can be tested against candidate passwords at millions of attempts per second, indefinitely, with no trace on your network.

Against that, a password like Company2019, sunshine123 or 28062015 lasts minutes. A phone number lasts hours. Anything in a dictionary of leaked passwords is found on the first pass.

Once inside the WiFi, the attacker is on your LAN: printers, file shares, cameras, the router's own management interface, and every device that trusts "internal" traffic. For a small business that often means the accounting PC and the point-of-sale terminal. WPA3 improves this considerably, but most networks still run WPA2 and many client devices still require it.

What it looks like in Winbox

Open Wireless → Security Profiles and double-click the profile used by your interfaces. The WPA Pre-Shared Key and WPA2 Pre-Shared Key fields hold the password (shown as dots unless you tick Show passwords). On RouterOS 7 with the newer wifi package, look under WiFi → Configuration or the interface's Security tab instead.

In an export, the same fields appear only when the export was made with sensitive values shown, which is also what the audit needs.

How to fix it

Choose a new password that is long and random. Two approaches work well: a passphrase of four or five unrelated words, easy to read out to a colleague and hard to attack, or sixteen or more random characters from a password manager. Do not derive the new password from the old one — changing the year at the end gains nothing — and do not reuse a password from anywhere else.

Set it in the WPA2 Pre-Shared Key field of the affected profile under Wireless → Security Profiles; on RouterOS 7 with the newer wifi package, the equivalent is the passphrase in the interface's Security settings. While you are there, make sure the profile allows only WPA2-PSK (or WPA3-PSK where your clients support it) and not the older WPA-PSK, and that the unicast cipher is AES only, not TKIP.

Every client will need the new password, so plan the change for a quiet moment. If you are managing the router over the same WiFi you are changing, do it with Safe Mode on so that a typo in the passphrase does not leave you disconnected. Public guest networks belong on a separate SSID and VLAN with no access to internal systems; there the isolation is what protects you.

Afterwards, try to join the network with the old password from a phone — it should be rejected — and with the new one, which should work. Then re-run the audit with a fresh export that includes sensitive values; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My SSID is hidden and I filter by MAC address. Doesn't that protect me?

No. A hidden SSID is revealed by every client that connects, and MAC addresses are visible in the air and trivially cloned. Neither slows down the handshake attack described above. Only the password strength (and, where possible, WPA3) does.

Is a long password annoying for guests and staff?

Less than it sounds. A word-based passphrase is easy to type once, phones remember it, and you can print a QR code that joins the network automatically. If turnover is high, put guests on a separate SSID with client isolation and rotate that password on a schedule.

Should I switch to WPA3 instead of just changing the password?

Both, if your client devices support WPA3. WPA3 removes the offline handshake attack entirely. But older laptops, printers and IoT devices often need WPA2, so most networks run a mixed mode for a while — and in that mode the WPA2 password still has to be strong.