In order to have my raspberry pi access using ssh (on wifi) i

  • Created a wpa_supplicant.conf file with necessary details
  • Created an empty file 'ssh'

My question was around security. Is it secure to let the wpa_supplicant.conf file there while the raspberry pi is serving some traffic, since the wifi network password is in there?

  • Not exactly sure what you mean by ` let the wpa_supplicant.conf file there while the raspberry pi is serving some traffic`. Where is that exactly? Keep in mind that the file will be moved from the boot partition to the root partition when booting the Pi with the card (and before wifi is activated). – Dirk Dec 6 '18 at 9:42
  • 2
    You can also use wpa_passphrase to generate the hashed version of your WiFi password so it's not there in plain text. – Roger Jones Dec 6 '18 at 9:54

Like Roger Jones commented: You don't need to store the wifi password as plain text. It's best practice to store it as encrypted pre-shared key. Your conf file /etc/wpa_supplicant/wpa_supplicant.conf should look like this:


Run wpa_passphrase "YourSSID" in a terminal and you should be asked for the password. Enter it and copy the encrypted PSK (it looks like gibberish, i.e. 4eab908e8f2b644a335c173e0f33d3864cb00cb5311434d6275592ed2cf6af0d).

Then open the conf file in an editor, i.e.:

sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

To play it safe:

Uncomment the psk line: #psk="YourPlainTextPassword"

Insert a new line: psk=4eab908e8f2b644a335c173e0f33d3864cb00cb5311434d6275592ed2cf6af0d

Save the conf file and reboot.

If your wifi connection still works fine, edit the conf file again and delete the line with the commented plain text password. Save the conf file and done!


The default way to protect password containing files on unix is to restrict read and write access only to root so nobody else can read this file. In your case you should do if not already done:

rpi ~$ sudo chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf

Few hints:

1. wpa_passphrase "YourSSID" will not work if you have ! or spaces in the SSID. So use simple quotes (') here.

2. I found there was added a wpa_supplicant.conf.save with still the plain old data.

So make sure to delete this as well.

  • That seems to be a comment to another answer. – RalfFriedl Jan 17 at 9:31
  • no, thats exactly the extension to the above statement. – Dr. Joe Jan 17 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.