Wi‑Fi passwords appear in shell history and connection profiles readable by root. Use history -d or a secrets manager on shared admin accounts. Ensure NetworkManager is running before blaming nmcli.
What you will achieve
Join Wi‑Fi networks from the terminal using nmcli when the desktop applet is broken, you are on a minimal server install with wireless, or SSH'd into a machine with a local console.
1) Confirm NetworkManager and Wi‑Fi device
systemctl is-active NetworkManager
nmcli device status
nmcli radio wifiIf Wi‑Fi shows unavailable, enable the radio:
nmcli radio wifi on2) Scan for networks
nmcli device wifi listSignal strength is in the SIGNAL column. Note the BSSID and security type (WPA2, WPA3) of your target SSID.
3) Connect to a new network
nmcli device wifi connect "MyNetwork" password "SecretPass123" ifname wlp2s0NetworkManager saves the profile automatically. For hidden SSIDs:
nmcli device wifi connect "HiddenSSID" password "pass" hidden yes4) Manage saved connections
nmcli connection show
nmcli connection up "MyNetwork"
nmcli connection down "MyNetwork"
nmcli connection delete "OldNetwork"5) Static IP or DNS on a Wi‑Fi profile
nmcli connection modify "MyNetwork" ipv4.method manual \
ipv4.addresses 192.168.1.50/24 \
ipv4.gateway 192.168.1.1 \
ipv4.dns "1.1.1.1,8.8.8.8"
nmcli connection up "MyNetwork"6) Troubleshooting
journalctl -u NetworkManager -b --no-pager | tail -30
nmcli general reloadCommon fixes: wrong password (check /etc/NetworkManager/system-connections/ permissions), rfkill soft block (rfkill list), or missing firmware (ubuntu-drivers devices on Ubuntu).
7) Enterprise WPA2-Enterprise
nmcli connection add type wifi con-name "CorpWiFi" ifname wlp2s0 ssid "CorpNet" \
wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.identity "user@corp.com"PEAP and TLS enterprise networks need extra 802.1x settings — GUI tools often handle this more easily, but nmcli supports full profiles once you know the EAP type.
Prerequisites
NetworkManager installed and running, wireless firmware loaded, and Wi‑Fi radio enabled. Server installs may need sudo apt install network-manager if minimal image omitted it.
Verify
nmcli -f GENERAL.STATE,IP4.ADDRESS device show wlp2s0
ping -c 3 1.1.1.1State should be connected with a valid IP. Reboot and confirm auto-connect: nmcli connection up "MyNetwork" should succeed without re-entering the password.