A slow internet connection is the most common reason people suspect a neighbor is piggybacking on their Wi-Fi. Yet speed drops are ambiguous evidence at best. Congestion, an aging router, and ISP throttling all produce the same symptoms. The reliable way to answer the question is to look at the router’s own records, not to guess from how Netflix behaves at 9 p.m.
That matters because unauthorized access is more than an annoyance. In the United States, knowingly accessing a network without authorization can fall under computer-misuse statutes such as the Computer Fraud and Abuse Act. The practical goal here is simple: confirm or rule out an intruder, then close the door.
Start With the Router’s Device List
Every consumer router keeps a client list. It usually lives under a menu labeled Connected Devices, Attached Devices, Client List, or Network Map in the admin interface. Each entry shows a MAC address, sometimes a hostname, and an assigned IP address.
This list is the single most useful diagnostic tool you have. If you can account for every entry, nobody else is on the network. If an entry does not match any device you own, you have a candidate intruder.
To reach the admin page, type the router’s gateway address into a browser. Common addresses are 192.168.1.1 and 192.168.0.1, though the exact one is printed on a sticker on the router itself. The same sticker holds the default username and password.
Build a Baseline Inventory First
The most common mistake is opening the device list, seeing eight unfamiliar names, and panicking. Most of those names are unhelpful by design. A smart plug might appear as `ESP_4A2F11`. A printer might show only a MAC address. A neighbor’s phone and your own phone can look identical in a list of raw hardware IDs.
Before drawing conclusions, walk through the house and write down every connected device: phones, laptops, tablets, TVs, streaming sticks, game consoles, smart speakers, thermostats, doorbells, security cameras, and robot vacuums. That inventory is your baseline. Anything on the router list that is not on the paper list deserves a second look.
A useful trick is to disconnect devices one at a time and refresh the router page. When an entry disappears, you have matched it to a real device. It is tedious, but it is far more reliable than guessing from hostnames.
Read the Warning Signs Correctly
Several symptoms get blamed on Wi-Fi theft when they usually mean something else. The table below separates the signals that carry real weight from the ones that mostly create false alarms.
| Signal | How reliable it is | What else could explain it |
|---|---|---|
| Unknown device in the router client list | Strong | Almost nothing; this is direct evidence |
| Sudden, persistent slowdown at all hours | Weak | Congestion, old router, ISP throttling |
| Router admin password no longer works | Moderate | Firmware update, forgotten change, family member |
| Settings changed without your action | Moderate | Auto-update, a household member, a compromised admin login |
| Data usage higher than your habits suggest | Moderate | Background updates, cloud backups, a new streaming device |
| Wi-Fi password shared by a guest | Strong (as a lead) | A guest who passed it on to someone else |
The pattern to watch for is combination. One weak signal means little. An unknown device plus a changed admin password plus unexplained data use is a different story.
Check the Router Logs
Many routers keep a log of DHCP leases and connection events. A lease log shows which devices received an IP address and when. A device that connects at 2 a.m. every night, when everyone in the house is asleep, is worth investigating.
Logs are often buried under Administration, System Log, or Advanced menus, and some budget routers keep almost nothing. If yours is sparse, the client list alone still does most of the work. (Wi-Fi)
Match MAC Addresses to Real Hardware
A MAC address is a hardware identifier, and its first half is assigned to a manufacturer. Looking up that prefix in a public vendor database tells you who made the device. If the unknown entry resolves to a brand nobody in the house owns, that is meaningful.
Be careful with this method. Randomized MAC addresses are now standard on phones and laptops for privacy, so a device may show a vendor prefix that means nothing useful. A random address often has a locally administered bit set, which some lookup tools flag.
Also remember that a MAC address can be spoofed. Filtering by MAC address is a deterrent, not security. Anyone determined enough to clone an allowed address will get past it. It raises the effort required, and that is all it does.
There is a broader lesson here about verifying digital claims. The same skepticism that helps you read a router log helps you judge anything online, whether it is a sales email or a suspicious message, as covered in this guide on how to tell if something is written by AI. Evidence beats vibes in both cases.
Use a Network Scanner as a Second Opinion
Router interfaces vary wildly in quality. A phone or laptop app that scans the local network can cross-check the router’s list. These tools ping every address in the subnet and report which ones respond, along with hostnames where available. (Ps portal 2 wifi alliance filing 2026)
The catch is that a scanner only sees devices that answer. A device that is idle or firewalled may stay invisible, while the router still knows it is associated. Treat the scanner as confirmation, not as the final word. The router’s association table is the authoritative record of who is connected to the wireless network.
Run the scan twice: once when the house is quiet, and once during a busy evening. Compare the results. New entries that appear only during peak hours are worth a closer look.
Lock the Network Down Properly
Once you have either found an intruder or decided you cannot rule one out, the fix is straightforward. Security guidance from the FCC’s consumer protection guide and from CISA’s secure-our-world resources converges on the same short list: change defaults, use strong encryption, and keep firmware current.
A Practical Hardening Checklist
- Change the router admin password. The default is often `admin` or printed on the sticker. Anyone on your network who guesses it can change your Wi-Fi password and lock you out.
- Switch to WPA3, or WPA2-AES if your hardware is older. WPA3 arrived in 2018 to replace WPA2, which had known weaknesses exposed by the KRACK attack disclosed in October 2017. The Wi-Fi Alliance security page explains the difference. Avoid WEP and WPA-TKIP entirely; both are broken.
- Set a long Wi-Fi password. Length beats complexity. A passphrase of four or five random words is easy to type and hard to crack.
- Turn off WPS. The push-button pairing feature has a history of design flaws that make guessing the PIN feasible.
- Disable remote administration so the admin page is not reachable from outside the home.
- Update the firmware. Router flaws get patched; unpatched routers stay vulnerable for years.
- Create a guest network for visitors and smart-home gadgets, with a separate password you can rotate without disrupting your own devices.
That last point solves the most common real-world cause of “someone else is on my Wi-Fi.” The password was not stolen. It was shared with a guest, a contractor, or a neighbor who asked politely, and then passed along.
What to Do About a Confirmed Intruder
Change the Wi-Fi password first. Every legitimate device will need reconnecting, which is annoying but decisive. Then change the admin password, since the intruder may have seen it. Check for any settings that were altered, including port forwarding rules and DNS settings, which are a favorite target for redirecting traffic.
If the router shows a device that keeps reappearing after a password change, the intruder may have physical access or the router itself may be compromised. A factory reset and fresh configuration is the cleanest path.
Recognize the Limits of Your Evidence
It is worth being honest about uncertainty. Bandwidth slowdowns prove almost nothing on their own. A router that is five years old, a house full of video calls, and a congested 2.4 GHz band will all produce the same sluggishness as a stolen connection.
Likewise, a device list is a snapshot. It does not tell you intent. An unknown entry could be a neighbor, or it could be the smart TV you forgot about, or a device a family member brought home. Confirm before accusing anyone. Wrongly confronting a neighbor over a misread hostname is a genuinely awkward mistake, and it happens more often than people admit.
For anyone who enjoys the technical side, the exercise is a good entry point into network awareness. Understanding which devices talk to your network is the same skill set behind a cyber threat intelligence map, just scaled down to one household. The habit of checking what is actually connected, rather than assuming, transfers directly. (How To Secure My Home Wi-Fi Network)
Conclusion
The honest answer to whether a neighbor is on your Wi-Fi comes from one place: the router’s client list. Match every entry to a device you own, investigate the leftovers, and stop relying on speed tests as evidence. If the list is clean, your slow connection has a different cause, and the fix is probably a firmware update, a better channel, or newer hardware.
If the list is not clean, act quickly and quietly. Change the Wi-Fi password, change the admin password, move guests and gadgets to a separate network, and confirm the router is running WPA3 or WPA2-AES with WPS disabled. That combination closes the door that was left open. And if you are the one who has been borrowing a signal, remember that a kind conversation beats a confrontation. The best outcome is a network that is locked down and a relationship that is still intact.
Frequently Asked Questions
Can my neighbor use my Wi-Fi if I have a strong password?
A strong WPA2 or WPA3 password is very hard to crack remotely, so the realistic risk is sharing rather than hacking. Passwords get passed to guests, written on sticky notes, or stored in a text message. If someone has the password, password strength no longer protects you. Rotating it is the only reliable fix.
How many devices should show up on my router?
There is no standard number. A typical household with phones, laptops, a TV, a streaming stick, and a few smart plugs often lands between 10 and 25 connected devices. The count matters less than whether you can identify each one. An unexplained entry is the real signal.
Does a slow connection mean someone is stealing my Wi-Fi?
Usually not. Slow speeds are more often caused by congestion on crowded channels, an outdated router, distance from the access point, or ISP throttling. Check the device list before assuming theft. If every entry is accounted for, the slowdown has another explanation.
Can I block a specific device from my network?
Many routers let you block a device by MAC address in the admin interface. It works, but it is easy to bypass because MAC addresses can be spoofed. Changing the Wi-Fi password is stronger, since it forces every device to reauthenticate with the new credential.
Will changing my Wi-Fi password disconnect the intruder?
Yes. Every device must reconnect with the new password, including the unauthorized one. That is why a password change is the standard first response. Follow it with an admin password change and a check of port forwarding and DNS settings, in case the intruder made other changes.
Is it illegal for a neighbor to use my Wi-Fi without permission?
In many jurisdictions, yes. In the United States, unauthorized access to a protected computer system can fall under the Computer Fraud and Abuse Act. Enforcement varies, and a polite request to stop is usually the practical first step. Document what you found before confronting anyone.
