Your Router Is a Shared Secret—This One Gives Every Device Its Own Password

If you've ever handed out your WiFi password to a guest, a smart plug, or a friend's phone and immediately felt a small pang of regret, you already understand the problem. Everyone on your network shares the same key, which means everyone can, in theory, see everyone else. SPR (Secure Programmable Router) takes a different approach: it's a router that gives each device its own password and isolates them by default.

What It Does

SPR is an open-source router built around the idea of micro-segmentation. Instead of one flat network where every device can talk to every other device, it treats each WiFi device as its own segment with its own credentials. The project describes itself as a way to "create an adaptive, micro-segmented network for managing WiFi devices, remote VPN access, and wired systems."

Architecturally, it's a collection of Docker containers running on Linux, which means it isn't tied to a specific hardware vendor—it runs on "a wide variety of Linux systems with Docker." There's a React-based UX for management and an iOS app available. The whole thing is BSD 3-Clause licensed, and the README emphasizes that there's "almost no unmanaged code" to keep the attack surface small.

Why It's Cool

The headline feature is genuinely uncommon: one password per WiFi device, including with WPA3. The README calls this "a SPR first." That's a meaningful shift from the usual model, where you either share a single PSK with everyone or set up a separate SSID per group. Here, each device gets its own key, which makes it much easier to revoke access for one device without disrupting everything else.

• Isolation by default. The firewall section is blunt about it—devices don't talk to each other unless you create rules that allow it. You get bidirectional groups and unidirectional service rules, so you can open exactly the path you need and nothing more. It's zero-trust thinking applied to a home or small-office network.

• Per-device DNS rules and ad blocking. You can set DNS overrides and block lists on a per-device basis. That means the kids' tablets and your work laptop don't have to share the same filtering policy. There's also DNS rebinding protection, which is the kind of detail that suggests someone thought carefully about real-world threats.

• Policy-based routing with real observability. Traffic insights by country and ASN, uplink health monitoring, alerts, and DNS logs. For a router, that's a surprisingly rich picture of what's actually happening on your network.

• Parental controls that aren't an afterthought. Family DNS rules and device time limits are listed as first-class features rather than something bolted on.

• Modern WiFi support. WPA3/2 with WPA1 backwards compatibility, plus WiFi 6 and 7 support including MLO and 320MHz channels on supported hardware. There's also WireGuard VPN, multi-WAN load balancing, and a wireless uplink.

The interoperability angle is worth noting too—an API plugin system means you can extend it rather than being stuck with whatever ships in the box.

How to Try It

The most direct path is the live demo, which the README links to at demo.supernetworks.org. That's the fastest way to get a feel for the React interface and the topology view before committing to hardware.

Beyond that, the project is designed to run via Docker on Linux. The README includes build badges for both Docker images and a Raspberry Pi ISO, so there are evidently prebuilt paths for common setups. Head to the repository for the current install instructions and release artifacts:

• Repository: github.com/spr-networks/super
• Latest releases: github.com/spr-networks/super/releases/latest

Since the README is a feature overview rather than a step-by-step guide, check the releases page and the docs folder for the specifics on flashing and configuration.

Final Thoughts

SPR isn't aiming at the plug-it-in-and-forget-it crowd. It's for people who are comfortable with Docker, who want to actually understand their network's traffic, and who find the single-shared-password model genuinely insufficient—whether for privacy, parental controls, or just good hygiene. The per-device WPA3 passwords and default isolation are the real draws, and the observability features make the whole thing more useful than a typical consumer router. If that describes you, the demo is a low-cost way to see whether the workflow fits how you think about your network.