<p>There is no way to store it that's &quot;more secure&quot;. In order to connect to the network, a device needs the password. The configuration tool you used likely just stored an encoded (which means roughly the <em>opposite</em> of encrypted, despite many people not understanding the difference) form of the password. To store it encrypted would require also storing a decryption key to decrypt and use it, but then whoever reads the SD card could just read the key too.</p>
<p>There is nothing special about a Raspberry Pi in this. Your PCs, phones, etc. all store wifi passwords in a form that can be read back, and that is read back every time they use them to connect to a network. If they don't make it easy for you the human user to read back the password, that's simply a user interface choice they've made to give you a false sense of safety, not any actual security boundary.</p>

CC BY-SA 4.0
2022-03-12T22:18:11.380Z
Thanks. I would just say that encoded and encrypted are two different things, not opposite, since they don't belong to the same "world". Anyways, would you say that "encoding" it in the way it was before is not any safer than having it in a human-readable way? At least a thief would have to know how it was encoded...
Myoch
CC BY-SA 4.0
2022-03-13T14:21:47.723Z
@Myoch: "Encoded" means stored with a particular convention for how the data is represented and to be interpreted. For example UTF-8 is an *encoding* of Unicode text not to obscure it but to ensure that senders and receipients agree on a convention for how to communicate. In the case of encoding of the password, I'm pretty sure that reading the docs for `wpa_supplicant` will tell you how it's encoded; if not the docs, surely reading the source code would. So it's unrealistic to expect someone not to be able to find out how to interpret it.
R.. GitHub STOP HELPING ICE
CC BY-SA 4.0
2022-03-13T19:59:12.860Z
Then clearly, it was not just simply encoded in any standard way. Too bad I did not copied it before changing it.
Myoch
CC BY-SA 4.0
2022-03-12T17:10:36.983Z
2022-03-12T17:10:36.983Z
R.. GitHub STOP HELPING ICE
<p>It's not a direct answer to the question but rather an alternative worth mentioning in this context. Avoid saving your password in plain text on the SD card of the Raspberry Pi by not to use WiFi and using an ethernet cable instead.</p>

CC BY-SA 4.0
2023-12-09T03:10:09.217Z
There may also be a way to whitelist the mac address for the raspberry pi's wifi interface, so that you don't need a password for it to connect
K Mmmm
CC BY-SA 4.0
2023-12-09T09:42:06.890Z
Perhaps but that would lower security even more. MAC address spoofing is ridiculously simple.
Bob Ortiz
CC BY-SA 4.0
2023-11-28T21:03:43.167Z
2023-12-09T00:49:17.093Z
2023-12-09T00:49:17.093Z
Bob Ortiz
<p>I recently changed the password of my WiFi and updated the file in the <code>/boot</code> folder of the OctoPrint's OS running on my Raspberry Pi.</p>
<p>Yet, it is now in plain text, and I would like to avoid storing it that way. What can I do to make the file more secure?</p>
<p>The automatic configuration from the Raspberry Pi imager generated an encrypted version of the password. But I'm not planning to flash everything again, so that's not an option.</p>

<octoprint><raspberry-pi><wi-fi><octopi>
How to encrypt the WiFi password in the OctoPi config file?
Myoch
# How to encrypt the WiFi password in the OctoPi config file?

(Asked by: username_0 on 2022-03-12)

I recently changed the password of my WiFi and updated the file in the `/boot` folder of the OctoPrint's OS running on my Raspberry Pi.

Yet, it is now in plain text, and I would like to avoid storing it that way. What can I do to make the file more secure?

The automatic configuration from the Raspberry Pi imager generated an encrypted version of the password. But I'm not planning to flash everything again, so that's not an option.

**Tags:** octoprint, raspberry-pi, wi-fi, octopi


---

## 2 answers

### Answer by username_1 on 2022-03-12. Score: 3

There is no way to store it that's "more secure". In order to connect to the network, a device needs the password. The configuration tool you used likely just stored an encoded (which means roughly the *opposite* of encrypted, despite many people not understanding the difference) form of the password. To store it encrypted would require also storing a decryption key to decrypt and use it, but then whoever reads the SD card could just read the key too.

There is nothing special about a Raspberry Pi in this. Your PCs, phones, etc. all store wifi passwords in a form that can be read back, and that is read back every time they use them to connect to a network. If they don't make it easy for you the human user to read back the password, that's simply a user interface choice they've made to give you a false sense of safety, not any actual security boundary.

> **Comments:**
> **username_0**: Thanks. I would just say that encoded and encrypted are two different things, not opposite, since they don't belong to the same "world". Anyways, would you say that "encoding" it in the way it was before is not any safer than having it in a human-readable way? At least a thief would have to know how it was encoded...  
> **username_1**: @username_0: "Encoded" means stored with a particular convention for how the data is represented and to be interpreted. For example UTF-8 is an *encoding* of Unicode text not to obscure it but to ensure that senders and receipients agree on a convention for how to communicate. In the case of encoding of the password, I'm pretty sure that reading the docs for `wpa_supplicant` will tell you how it's encoded; if not the docs, surely reading the source code would. So it's unrealistic to expect someone not to be able to find out how to interpret it.  
> **username_0**: Then clearly, it was not just simply encoded in any standard way. Too bad I did not copied it before changing it.  

---

### Answer by username_2 on 2023-11-28. Score: 1

It's not a direct answer to the question but rather an alternative worth mentioning in this context. Avoid saving your password in plain text on the SD card of the Raspberry Pi by not to use WiFi and using an ethernet cable instead.

> **Comments:**
> **username_3**: There may also be a way to whitelist the mac address for the raspberry pi's wifi interface, so that you don't need a password for it to connect  
> **username_2**: Perhaps but that would lower security even more. MAC address spoofing is ridiculously simple.  

---

