Is there a standard that defines what is a valid SSID and password?

Section 7.3.2.1 of the 802.11-2007 specification (http://standards.ieee.org/getieee802/download/802.11-2007.pdf) defines SSIDs.

A valid SSID is 0-32 octets with arbitrary contents. A 0-length SSID indicates the wildcard SSID (in probe request frames for instance).

There's no character set associated with the SSID - a 32-byte string of NUL-bytes is a valid SSID.

This implies:

• you should never use normal string functions when manipulating generic SSIDs (strcpy() and friends).

• you should not assume that the SSID is printable when, for instance, logging it to disk

According to last standard 802.11-2012 (Section 6.3.11.2.2), it can be 0-32 octets with an unspecified or UTF8 encoding.