From e0396764223377c0bbd0f6bb2a2503bb7a52e0a3 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Sun, 8 Feb 2026 06:44:45 -0600 Subject: [PATCH] [wizard] Use secrets module for fallback AP password generation Replace random.choice() with secrets.choice() for generating the fallback hotspot password. The random module uses Mersenne Twister which is not cryptographically secure. The secrets module is the correct choice for credential generation. The file already imports secrets for other credential generation. --- esphome/wizard.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/esphome/wizard.py b/esphome/wizard.py index 4b74847996..f83342cc6a 100644 --- a/esphome/wizard.py +++ b/esphome/wizard.py @@ -1,6 +1,5 @@ import base64 from pathlib import Path -import random import secrets import string from typing import Literal, NotRequired, TypedDict, Unpack @@ -130,7 +129,7 @@ def wizard_file(**kwargs: Unpack[WizardFileKwargs]) -> str: if len(ap_name) > 32: ap_name = ap_name_base kwargs["fallback_name"] = ap_name - kwargs["fallback_psk"] = "".join(random.choice(letters) for _ in range(12)) + kwargs["fallback_psk"] = "".join(secrets.choice(letters) for _ in range(12)) base = BASE_CONFIG_FRIENDLY if kwargs.get("friendly_name") else BASE_CONFIG