{"id":56449,"date":"2026-09-22T10:36:48","date_gmt":"2026-09-22T14:36:48","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56449"},"modified":"2026-09-22T10:36:48","modified_gmt":"2026-09-22T14:36:48","slug":"hidden-ssid-dangers-wifi-security-explained","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/hidden-ssid-dangers-wifi-security-explained\/56449\/","title":{"rendered":"Fact and fiction about hidden Wi-Fi network names"},"content":{"rendered":"

For more than two decades now, setting up a home router has meant going through the same old routine: pick a Wi-Fi band, name your network, choose a security type, and set a password. After you type in your network name, you often see an option next to it to hide the network name \u2014 sometimes labeled hide SSID<\/em>, or simply hidden<\/em> or closed network<\/em>. If you choose this option, the network you create won\u2019t show up automatically in the list of available Wi-Fi networks on any smartphone, computer, or smart-home device \u2014 you need to type in the correct network name by hand. Only then will the device be able to find that network and connect to it. At first glance, hiding your wireless network\u2019s name might seem like a smart precaution: keeping neighbors or passersby from hacking into your Wi-Fi<\/a> since they simply can\u2019t see it. But in fact things work differently: all your devices will give away the hidden network \u2014 and not just at home either.<\/p>\n

How devices connect to Wi-Fi<\/h2>\n

Every Wi-Fi access point broadcasts a short data packet roughly 10 times a second so your smartphone or computer can show you a list of nearby networks\u2019 names, like JohnWiFi<\/em>, TommyNet<\/em>, CafeDeArts_Guest<\/em>, or other, creative variants. This packet contains (i) the network\u2019s name (Service Set Identifier, or SSID), (ii) a unique identifier for the access point (Basic Service Set Identifier, or BSSID), and (iii) details about the radio channel the network uses. This info helps devices (i) pick the best network to connect to, and (ii) automatically join networks they already know; accordingly, none of the data in that packet is encrypted. Hidden networks also broadcast these advertising packets; they just leave the SSID field blank. This method of finding networks is called passive because a Wi-Fi client, like, say, your smartphone, just needs to listen to the airwaves to spot nearby access points.<\/p>\n

On top of that, the client can scan for Wi-Fi networks on its own, which is known as active discovery. Your smartphone or computer is constantly broadcasting the names of Wi-Fi networks it knows and would like to connect to. If one of those networks happens to be nearby, the access point answers back, and the connection is made.<\/p>\n

Active discovery can sometimes help save your smartphone\u2019s battery, and it\u2019s indispensable when you\u2019re working with hidden networks. Discovering a hidden network and connecting to it becomes a two-step process<\/a>. First, the smartphone \u201chears\u201d that there\u2019s a Wi-Fi access point nearby with a hidden network name. It then tries to reach that network by broadcasting the names (SSIDs) it already knows \u2014 either hidden networks it\u2019s connected to before, or the name the user typed in when first connecting to a hidden network. If the name matches, the router responds, and the connection goes through.<\/p>\n

A hidden network name (SSID) doesn\u2019t actually hide your Wi-Fi network<\/h2>\n

The regular list of available Wi-Fi networks on your smartphone or computer won\u2019t show networks that don\u2019t broadcast a public SSID. But any specialized Wi-Fi scanning software can spot them easily \u2014 it just won\u2019t show their names. And hidden networks are still easy to identify and tell apart thanks to each router\u2019s unique BSSID.<\/p>\n

So hiding a Wi-Fi network\u2019s name doesn\u2019t make it truly invisible, and it won\u2019t protect you from cybercriminals. It\u2019s worth noting that any large-scale analysis, such as mapping the geographic locations of Wi-Fi networks<\/a>, relies on BSSIDs, not SSIDs. Besides the huge databases kept by Apple and Google, there are public access-point-mapping projects too, like WiGLE<\/a>.<\/p>\n

If someone wants to break into a network at a specific location, specialized software lets them find out its SSID just by waiting for one of the legitimate clients to connect and listening in on the active discovery session. From there, they can connect to that Wi-Fi network \u2014 provided it uses a weak enough security protocol.<\/p>\n

Your devices leak hidden Wi-Fi network names and personal data<\/h2>\n

The main drawback of a hidden SSID is that smartphones and computers have to broadcast it before they can connect to the wireless network. And they do this everywhere \u2014 not just near the specific access point in question. As soon as any network with a hidden name shows up within signal range, the client attempts to connect, and during that attempt it broadcasts the names of every hidden network it knows. And this broadcast isn\u2019t encrypted, which means anyone nearby can pick up the data being transmitted.<\/p>\n

In 2021, researchers at the University of Hamburg ran an experiment<\/a> collecting radio signal data on a busy street. In just three one-hour listening sessions, they gathered 252\u00a0000 Wi-Fi connection requests from passersby\u2019s smartphones. Of those, 23% contained the SSID of a network the smartphone would have preferred to connect to.<\/p>\n

And that\u2019s where a factor few people think about comes into play: the network\u2019s name itself. Twelve percent of the SSIDs found were long numeric strings that looked a lot like passwords. So, once someone knows the SSID and BSSID, they can look up the BSSID in a service like WiGLE and find the access point\u2019s real-world address. Once there, an attacker can try to use such a string as both the SSID and the password to connect \u2014 with a good chance of success. The researchers\u2019 sample also included 106 SSIDs containing a first and\/or last name, 92 SSIDs that pointed to a home address, and three that revealed an email address.<\/p>\n

Given all this, it\u2019s no surprise that Apple<\/a> and Asus<\/a> recommend against using the hidden SSID feature.<\/p>\n

Other drawbacks of hiding your Wi-Fi network<\/h2>\n

Beyond the data leak issues, hidden SSID technology \u2014 a holdover from early Wi-Fi versions \u2014 also hurts the performance of modern versions of the radio protocol. In the 6GHz band, searching for a hidden Wi-Fi network across 59 possible channels becomes noisy and power-hungry: the client has to run through every option and send a lot of requests. As a result, performance drops for all nearby Wi-Fi networks in the 6GHz band, and the client itself burns through battery power sending out all those requests.<\/p>\n

Asus also points out<\/a> that Windows devices may tend to connect to visible networks first \u2014 even if a network with a hidden SSID is available and marked as preferred.<\/p>\n

When a hidden SSID actually makes sense<\/h2>\n

There aren\u2019t many scenarios where hiding your network name is genuinely useful. For example, if a router is meant for a small group of people but is installed in a very crowded location, a hidden SSID can cut down on the number of connection attempts and ease the load on the router. But keep in mind that this boosts performance, not security \u2014 and only slightly at that.<\/p>\n

Another similar case is a technical Wi-Fi network for a limited number of fixed devices \u2014 like a network of security cameras or smart home gadgets. These devices always stay in the same place, so whenever they try to connect to their assigned Wi-Fi, they find it right away, and no data leaks out\u00a0\u2014 unless an attacker is actually listening in on the radio signal near the router. At the same time, outsiders are less likely to try connecting to such a network.<\/p>\n

How to make your Wi-Fi more secure<\/h2>\n

To protect your Wi-Fi network from wireless hackers, don\u2019t hide the SSID: instead, use the modern WPA3 security protocol along with a long password. Attackers can intercept data over the air and then try to crack the password with brute force, so a strong Wi-Fi password should be at least 20 characters long<\/a>. The easiest way to generate and store such long, hard-to-crack passwords is with a password manager that syncs across your devices<\/a>; that way they\u2019re always at hand \u2014 no matter which gadget you\u2019re using.<\/p>\n

If some of your older devices don\u2019t support WPA3, it\u2019s fine to use WPA2 with protected management frames (PMF) turned on, which guard against many types of attacks on Wi-Fi networks.<\/p>\n

You should also make sure Wi-Fi Protected Setup (WPS) is turned off, since it essentially replaces your password with an easy-to-guess PIN code.<\/p>\n

To quickly spot unknown devices connected to your Wi-Fi network, use Smart Home Monitor<\/a> in Kaspersky Premium<\/a>.<\/p>\n

As for the network name, instead of hiding it, pick one that doesn\u2019t reveal your name, address, or any other personal details. It\u2019s also worth avoiding default network names like ISPName-XXXX<\/em> or dlink<\/em>, but for a different reason: generic names like these can confuse you and your guests alike. If you don\u2019t want your access point to show up on Wi-Fi geolocation maps from Apple, Google, and other providers, you can add the suffix _nomap<\/em><\/a> to the end of your network name, but there\u2019s no guarantee it will actually work.<\/p>\n

Apart from protecting your Wi-Fi, make sure your router is configured securely overall<\/a>. First and foremost, that means giving it a long, unique admin password, and keeping it updated with the manufacturer\u2019s latest firmware. And if you have a bit more time, you could even boost your Wi-Fi performance<\/a>.<\/p>\n

How Wi-Fi networks get hacked, and how to protect them:<\/p>\n