In one embodiment, a method includes receiving, from a device via a wireless signal, a request to access a WLAN of a router, the request including a device identifier. The provisioning agent may be within wireless ranges of the device and of the router. The provisioning agent may request, from an authentication server, a password for the device. The password may be uniquely generated by the authentication server for the device. The provisioning agent may receive the password from the authentication server. The provisioning agent may send, to the router, the password and the device identifier. The provisioning agent may receive, from the router, an indication that the router has verified the password with the authentication server. The router may store the device identifier in association with the password. The provisioning agent may send, to the device, the password. The password may authenticate the device to the router.