An SSID, or service set identifier, is the name of a wireless network. NIST defines it as a name assigned to a wireless access point that lets stations tell one access point from another. It is a label, not a lock. Hiding it does not secure the network, and a lookalike name can fool devices.
What does an SSID do?
NIST's glossary entry, drawn from NISTIR 7621, defines the term in that single sentence. In the guide NIST SP 800-97 on 802.11i, the SSID is described as the name assigned to a WLAN, allowing stations to distinguish one WLAN from another. When your phone shows a list of networks, those are SSIDs.
One name can cover many access points. A large office may have 40 access points all broadcasting the same SSID so devices can roam.
Is the SSID secret?
No. SP 800-97 says SSIDs are broadcast in plaintext in wireless communications, so an eavesdropper can easily learn the SSID for a WLAN. It adds that the SSID is not an access control feature, and was never intended to be used for that purpose.
That answers the common advice to hide the network name. A hidden network stops broadcasting its name in beacon frames, but the name still appears in plaintext when a client probes or associates, as the same guide's frame descriptions show. Hiding it mostly hides the network from honest users and makes devices announce the names they are looking for.
Why does a name matter for security?
Because devices trust names. SP 800-97 points out that with open system authentication, the access point is not authenticated to the station. The station has to trust that it is talking to the real access point and not an impostor using the same SSID. The guide says this can be misused to trick users into connecting to a malicious WLAN.
This is the evil twin attack: an attacker sets up an access point with the same SSID as a legitimate one, often with a stronger signal, and users or their devices connect. From there the attacker can attempt a man-in-the-middle position. A public network called CoffeeShopWiFi that asks for no password gives your device no way to tell the real one from a fake.
What actually secures a wireless network?
Authentication and encryption. SP 800-97 describes how the original WEP was inherently flawed and explains the 802.11i approach that replaced it. Today the choice comes down to WPA2 or WPA3, and for organisations the key decision is between a shared passphrase and per-user credentials.
The guide notes that organisations should review any pre-shared key approach carefully, and that distributing keys in a large network can be infeasible. A common practice is a single PSK per SSID. When someone leaves, you must change the passphrase for everyone. Enterprise authentication through 802.1X ties access to individual accounts, so removing one account cuts off one person. NIST SP 800-153 collects guidance on configuring and monitoring WLANs through their lifecycle.
A constructed example
A small clinic hides its network name and uses a shared passphrase written on the break room whiteboard. A former contractor still knows it. A visitor's laptop probes for the clinic's name and, in doing so, reveals the name to anyone listening.
The clinic changes course. It broadcasts a normal name, moves staff devices to per-user authentication, and puts guests on a separate isolated network with its own passphrase that changes monthly. It also scans for unknown access points using the clinic's name, which is how it would spot an evil twin.
How should you name and run networks?
Choose names that are clear and not easy to imitate. Keep guest and corporate names distinct. Do not put sensitive details such as the company name plus a floor number in an SSID if you do not want them advertised. Monitor for access points broadcasting your SSIDs that you did not deploy, and configure managed devices to join only specific networks automatically.
How to check or apply this
- List every SSID you broadcast and what each is for.
- Stop relying on hidden names as a control and use WPA3 or WPA2 with strong authentication.
- Use per-user authentication such as 802.1X for staff networks.
- Put guests and IoT devices on separate, isolated networks.
- Scan regularly for unauthorised access points using your SSIDs.
- Configure managed devices not to auto-join open networks.
- Change shared passphrases when people leave.
Quick check
Does turning off SSID broadcast stop attackers?
No. NIST says the SSID is not an access control feature. Clients still reveal it when they connect.
What is an evil twin?
An attacker's access point that copies a real network's SSID so devices connect to it and the attacker can intercept traffic.
Sources
- NIST glossary, service set identifier
- NIST SP 800-97, Establishing Wireless Robust Security Networks
- NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks
Last reviewed: 18 October 2026.
