Default router passwords: the pattern isn't the problem

Back in 2023 someone on a forum asked whether a router's factory Wi-Fi password was weak because it always followed the same shape: five lowercase letters, four digits, then five more letters. Anyone who's seen two of those stickers can spot the pattern, so it feels like a shortcut.

It isn't much of one. Knowing where the digits sit takes the search down from roughly 64 quintillion guesses to 1.4 quintillion. On one high-end graphics card that's still about 17,700 years of guessing. The pattern leaks around 5.5 bits and leaves 60.3.

When I went through the published cases where default router passwords did fall, the shape of the password was never the reason. The maker built the password from something an attacker could read off the air, used a generator with a tiny internal state, or used the same secret for the admin login. Those are process failures, and you can't see any of them by looking at the sticker.

Ten positions take one of 26 letters and four take one of 10 digits, so the format allows 26^10 × 10^4 = 1,411,670,956,533,760,000 passwords. That works out to 60.3 bits. Fourteen random lowercase letters with no fixed layout would give 26^14, about 6.45 × 10^19. So the layout cuts the space by a factor of 45.7x, which is about 5.5 bits.

For speed I used a community Hashcat benchmark: one stock RTX 4090 ran WPA-PBKDF2-PMKID+EAPOL at 2.5333 MH/s. [S1] Dividing the space by that rate gives about 17,700 years to try everything. A real attacker could rent far more hardware than one card, and the rate moves with the driver, the device and the capture, so treat the times below as a way to compare formats. They aren't a prediction for any particular password.

Regulators have moved on to the generator too. The UK's PSTI regime has applied since April 29, 2024. Passwords have to be unique per product or set by the user, and a unique password can't be built from counters, public information or product identifiers unless encryption or keyed hashing protects the derivation. [S6] [S11]

ETSI TS 103 848 says the same for home gateways: preconfigured Wi-Fi and admin passwords must differ from one gateway to the next. [S7] NIST IR 8425A sets out a baseline for consumer routers. [S8] California has counted a unique preprogrammed password, or a forced change on first use, as a reasonable security feature for connected devices since January 1, 2020. [S9]

In the EU, the Cyber Resilience Act brings in reporting as well. Its Article 14 duties for actively exploited vulnerabilities and severe incidents apply from September 11, 2026, and the product requirements follow on December 11, 2027. [S12]

I'm citing these to show where the requirement now sits. Whether a given product or manufacturer meets any of them is a separate question, and this report doesn't answer it.

This is desk research. I checked a research packet against the sources it cited and kept only claims I could trace to a source or reproduce by arithmetic. I dropped live counters, unconfirmed vendor attributions and incident totals nobody could source.

I calculated the candidate counts and bit strengths myself from the character sets. The times divide those spaces by the published benchmark, so they aren't measurements from my lab.

The April 2023 forum post that started this is no longer online, and I never confirmed which router brand it described, so I don't name one. The CVEs and papers describe the models and dates they tested. They don't show that any router on sale today is affected.

I didn't touch router hardware, network services, wireless traffic or anyone's credentials. On September 25, 2026 I rewrote the report for readability. Every figure and source is the same as in the August edition.