My router configuration panel won't allow me to use emojis in SSID, for some reason. Although, I can very easily bypass this restriction, using the browser developer tools (which makes me think if it's a company's security concern or what).

If it is a security concern: why is it so easy to bypass the router restriction?!

  • 2
    A SSID has nothing to do with security, if so probably very little, so don't think of it that way. It's just a name. – Henry WH Hack v3.0a Feb 6 at 13:54
  • A SSID is a sequence of 0 to 32 bytes. To include an emoji in it, you just have to encode it in whatever encoding you use, normally UTF-8. The problem is not security related but only encoding related (only ASCII is universal...) – Serge Ballesta Feb 6 at 16:30

The only reason it might be a security issue is if there's some WiFi software that incorrectly expects the SSID to be ASCII text or similar, in violation of the specification. Such buggy software could potentially face a memory corruption vulnerability while mis-processing the SSID, though the far more likely outcome would simply be that the station can't connect (or, if the bug is in the AP, that nobody can connect). Since APs need to be able to handle arbitrary connection requests and stations need to be able to handle arbitrary SSIDs from scans, any such vuln is either attackable by any user in range, or only reachable from the admin interface of your router; in the first case you're not putting yourself at risk (though you might identify some buggy systems), and in the second case... it's your hardware, if you want to risk making it malfunction, have fun.

The specification requires only that the SSID be no more than 32 octets (bytes); as https://stackoverflow.com/questions/4919889/is-there-a-standard-that-defines-what-is-a-valid-ssid-and-password points out, 32 null bytes is a valid SSID. That's potentially not very many emoji, since some are more than four bytes per character, but it's room for a few. Note that the standard does not specify how SSIDs are to be encoded, so if they don't expect UTF-8 (or whatever other encoding you use) then your SSID may not display correctly (probably just as boxes for unknown characters, but possibly as weird incorrect ones), but that's not a security risk per se.

  • Single emoji for two adults + 2 kids + each with their own skin color is 25 bytes if I remember right. So if a password was limited to 32 bytes, using emojis could leave you with very little entropy. SSID is just a name. – gnasher729 Feb 6 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.