When you connect to a new Wi-Fi network in Ubuntu, the NetworkManager service automatically prompts you for the network password. By default, Ubuntu attempts to store this password securely within the GNOME Keyring, which is unlocked when you log into your user account.
However, if your system is configured to auto-login (bypassing the login screen password), the GNOME Keyring remains locked. To get around this and still connect to the Wi-Fi network automatically, NetworkManager frequently defaults to storing the Wi-Fi password in plain text (unencrypted) within a system configuration file located at /etc/NetworkManager/system-connections/.
From a security standpoint, storing a sensitive password in a plain text file is a massive vulnerability. Anyone with physical access to your machine (or root access via a compromised service) can simply open the text file and steal your Wi-Fi credentials.
How to Force Encrypted Wi-Fi Passwords
You must configure NetworkManager to strictly store the password for that specific connection within the encrypted user keyring, rather than for “all users.”
- Click on the Wi-Fi or Network icon in the top-right corner of the GNOME panel.
- Click on Wi-Fi Settings.
- Locate the Wi-Fi network you want to secure and click the Gear icon next to it.
- In the configuration window, click on the Security tab.
- Look for the small icon (usually a lock or a user icon) inside the password text field, or look for a dropdown regarding password storage.
- If you see a setting for “Store the password for all users,” you must change this. Select the option that says Store the password only for this user.
- Click Apply to save the changes.
By forcing the password to be stored “only for this user,” NetworkManager is forced to push the credential into the encrypted GNOME Keyring. The plain text configuration file in /etc/NetworkManager/ will no longer contain the actual password, significantly improving your system’s local security posture.