Generate a WPA PSK Safely with wpa_passphrase

Typing a Wi-Fi passphrase straight into a config file works until someone reads over your shoulder, which is what wpa_passphrase is for. It turns an ASCII passphrase and its SSID into a ready-to-paste network block containing a 256-bit pre-shared key (PSK), without the plain passphrase ending up in a command's arguments. Allow about five minutes. You need the wpasupplicant package and the exact network name.

Before you start

This guide uses wpa_passphrase from Ubuntu's wpasupplicant package, version 2:2.10-21ubuntu0.4 on the machine used for these examples. The installed manual page documents two positional arguments: ssid and passphrase. Omit the passphrase argument and the program reads it from standard input instead.

The SSID is the wireless network name, including spaces, capitalisation and punctuation, and it feeds directly into the key derivation. A spelling difference produces a different PSK. The passphrase is not merely converted to hexadecimal: the SSID and passphrase together determine the result.

1. Derive the network block

1. Run the command with only the SSID. Type the passphrase when prompted, replacing YOUR_SSID with the exact network name.

   wpa_passphrase 'YOUR_SSID'
   

   Nothing is echoed while you type. End the input with Enter. For example:

   $ wpa_passphrase 'Example Wi-Fi'
   # reading passphrase from stdin
   correct horse battery staple
   network={
   	ssid="Example Wi-Fi"
   	#psk="correct horse battery staple"
   	psk=a67e4e76154d2f3fbd535340d6a69e4978c805f2c5a8137eb7c3cdd6ecf040f2
   }
   

2. Copy the whole block. Paste the complete network={...} block into the configuration file or command that will consume it. The commented #psk line shows the original passphrase for reference; the uncommented psk line is the derived hexadecimal key.

2. Keep the passphrase out of shell history

Prefer the prompt form above. A passphrase supplied as the second argument sits in shell history and can be briefly visible to other local users through process inspection. It is also easy to paste into the wrong terminal or log by accident.

The argument form is supported and can be useful in a controlled, non-interactive context:

wpa_passphrase 'YOUR_SSID' 'YOUR_PASSPHRASE'

3. Verify before using the key

1. Check the shape of the output. It should contain the expected SSID and exactly one uncommented psk= line. The hexadecimal value should be 64 characters long for the generated 256-bit PSK.

2. Repeat the derivation if unsure. Compare the complete psk value; the same inputs always produce the same value, but a different capitalisation, an extra space or a changed punctuation mark does not.

3. Clean up afterwards. Remove any temporary output containing the passphrase or PSK once you have checked it, and confirm the file is not being backed up or shared.

A safe verification run does not require root:

printf '%s\n' 'YOUR_PASSPHRASE' | wpa_passphrase 'YOUR_SSID'

This pipeline is convenient for a one-off check, but the passphrase can still be exposed through the shell command itself if it is written literally. Use a disposable test value, or feed the input from a protected source. The diagnostic line # reading passphrase from stdin confirms the input path was standard input.

4. Use the result in wpa_supplicant

The generated block is a configuration fragment, not a complete instruction to the wireless service. If you add it to an existing wpa_supplicant.conf, preserve the file's ownership and permissions: a configuration containing a clear-text passphrase in a comment, or a derived PSK, is sensitive and should never be world-readable.

Writing a system configuration or restarting a wireless service normally needs elevated privileges and can interrupt the connection. Confirm the destination before using sudo, keep a backup of the existing file, and restore it if the change stops the expected network from connecting. wpa_passphrase itself does not need sudo.

If the network is not accepted, check the SSID and passphrase with the network owner first, then check the block was copied without changing quotes, tabs or the PSK value. A generated PSK is deterministic, so recalculating it with the same inputs is a useful comparison; do not regenerate keys while changing several inputs at once, because that only makes the real error harder to find.

Common traps

• Wrong network name: hidden spaces and case matter. Copy the SSID from a trusted network listing, then quote it in the command.
• Passphrase shown in output: the commented #psk line is intentional but sensitive. Treat the entire output as secret material.
• Unexpected option error: this interface is positional. The documented form is wpa_passphrase [ssid] [passphrase]; do not invent option flags for it.
• Failed input: when the passphrase argument is omitted, enter it on standard input. An empty or interrupted input does not prove the network credentials are correct.