Should Smart Home Devices Go on a Guest Wi-Fi Network?

For most smart home devices, yes. Cameras, plugs, TVs and speakers that only need an internet connection are better off on a guest network, where they can’t reach your laptops and phones. The trade-off is that the same separation can break features that need your phone and the device on one network. Move one device, test it, then move the rest.

Smart home devices are often called IoT devices, short for Internet of Things. They vary widely in how well they are secured and how long they are updated, and they usually sit on the same network as the computers that hold your email, banking and files. Separating the two groups is called network segmentation.

What do security agencies recommend?

Two US agencies give the same advice.

The National Security Agency (NSA), in home network guidance published in February 2023, says: “your wireless network should be segmented between your primary Wi-Fi, guest Wi-Fi, and IoT network. This segmentation keeps less secure devices from directly communicating with your more secure devices.”

The FBI’s Portland field office, in a public notice dated December 3, 2019, said: “Your fridge and your laptop should not be on the same network. Keep your most private, sensitive data on a separate system from your other IoT devices.”

Neither agency says smart devices are unsafe to own. The point is containment. If a device is compromised, it should not have a direct route to the machines that matter most.

How does a guest network separate devices?

A guest network is a second Wi-Fi network from the same router, with its own name and password. Devices on it get internet access but are walled off from your main network. How strict the wall is depends on the brand.

Settings and wording differ on other brands, and some routers have an option that lets guest devices see the main network. If yours has one, leave it off. That option removes the protection you are setting the network up for.

What can break when smart devices are on a guest network?

The wall works in both directions. Your phone on the main network may not be able to find a device on the guest network. Whether that matters depends on how the device is controlled.

The examples are typical patterns, not guarantees for any model. We have not tested devices for this guide, so check with one device before moving everything.

Google’s approach reduces the problem. Its guest network lets you select shared devices, described as “a Google streaming device, smart TV, wireless speaker, or printer,” that guests can still use.

Setup is the other snag. Many devices are set up by a phone app that expects the phone and device on the same Wi-Fi. If setup fails, join your phone to the guest network for the setup, then switch the phone back.

Which devices should go where?

This table is our application of the NSA and FBI principle to common devices. It is a starting point, not a rule from either agency.

Should visitors and smart devices share one guest network?

Ideally not. The NSA guidance names three networks: primary, guest and IoT. A visitor’s laptop and your cameras have no more reason to share a network than your own laptop does.

Many home routers offer only two: main and guest. In that case, putting smart devices on the guest network and giving visitors that password is still a clear improvement over a single network. On a system that isolates guest devices from each other, as eero does, the two groups can’t reach one another anyway.

If your router has a separate IoT network or supports VLANs (virtual networks that divide one router into several isolated ones), use that for smart devices and keep the guest network for people.

How do I set it up?

1. Turn on the guest network in your router’s app or admin page. On eero it is under Settings, then “Guest wifi network.” On Deco it is under More, then Guest Network. On Google’s systems it is in the Google Home app’s Wi-Fi settings.
2. Give it a different password from your main network. Eero and Google both say to do this. Use a long one; the NSA guidance recommends at least 20 characters for Wi-Fi passphrases.
3. Check the security mode. Use WPA3 or a WPA2/WPA3 mixed mode where the guest network offers it. Our WPA2 vs. WPA3 guide explains the options. Avoid an open guest network with no password.
4. Make sure 2.4 GHz is available on it. Many smart devices connect only on 2.4 GHz. Deco lets you choose which bands the guest network uses. See our guide to the Wi-Fi bands.
5. Move one device and test it. Remove it from the main network in its app, set it up again on the guest network, then check every feature you use, from both home and away.
6. Move the rest, leaving on the main network anything that failed the test and matters to you.
7. Leave any “access local network” option off.

Is a guest network enough on its own?

No. It limits where a compromised device can reach. It does not stop the device from being compromised, and it does not protect what the device itself sees or records.

The FBI notice lists the other steps: change default passwords, use a strong and unique password for each device, review what the companion app collects, and turn on automatic updates. Its advice on default passwords is blunt: if you can’t find out how to change one, consider a different product.

For the router’s own settings, work through our router hardening checklist. For how smart home devices connect in the first place, see Matter and Thread, explained.

Fact-check notes

Bottom line

Put smart home devices that only need the internet on a guest or IoT network, and keep computers, phones and storage on the main one. That is the separation the NSA and FBI describe. Expect a few features, mainly casting and local control, to need a workaround, and test with one device before you move the rest. Then finish the job with unique passwords and automatic updates.