A network device, the network device comprising: - a key memory storing a cryptographic public key and a corresponding private key, - a credential memory for storing credentials after the credentials have been received by the network device, - a wireless communication unit having a master mode and a client mode, the wireless communication unit being configured to enter master mode before the credential memory stores the credentials and to enter client mode after the credential memory stores the credentials, the network device being associated with a network device identifier, the wireless communication unit being configured for a first wireless communication protocol, - in the master mode, the wireless communication unit being configured to receive a wireless connection request from a configurator device, and, if the connection request is addressed to the network device identifier, establish a first wireless connection with the configurator device, - in the client mode, the wireless communication unit being configured to set up a second wireless connection with a wireless access point using the credentials from the credential memory, - a provisioning unit configured to - send the public key to the configurator device over the established first wireless connection, - receive encrypted credentials wirelessly from the configurator device, decrypting the encrypted credentials through the private key to obtain the credentials, and storing the credentials in the credential memory, and - a data storage element storing digital data, a cryptographic hash of the public key being derivable from the digital data, wherein - the data storage element is optically readable by the configurator device, or - the data storage element is wirelessly readable by the configurator device and configured for a second wireless communication protocol different from the first wireless communication protocol. - a key memory storing a cryptographic public key and a corresponding private key, - a credential memory for storing credentials after the credentials have been received by the network device, - a wireless communication unit having a master mode and a client mode, the wireless communication unit being configured to enter master mode before the credential memory stores the credentials and to enter client mode after the credential memory stores the credentials, the network device being associated with a network device identifier, the wireless communication unit being configured for a first wireless communication protocol, - in the master mode, the wireless communication unit being configured to receive a wireless connection request from a configurator device, and, if the connection request is addressed to the network device identifier, establish a first wireless connection with the configurator device, - in the client mode, the wireless communication unit being configured to set up a second wireless connection with a wireless access point using the credentials from the credential memory, - a provisioning unit configured to - send the public key to the configurator device over the established first wireless connection, - receive encrypted credentials wirelessly from the configurator device, decrypting the encrypted credentials through the private key to obtain the credentials, and storing the credentials in the credential memory, and - send the public key to the configurator device over the established first wireless connection, - receive encrypted credentials wirelessly from the configurator device, decrypting the encrypted credentials through the private key to obtain the credentials, and storing the credentials in the credential memory, and - a data storage element storing digital data, a cryptographic hash of the public key being derivable from the digital data, wherein - the data storage element is optically readable by the configurator device, or - the data storage element is wirelessly readable by the configurator device and configured for a second wireless communication protocol different from the first wireless communication protocol. - the data storage element is optically readable by the configurator device, or - the data storage element is wirelessly readable by the configurator device and configured for a second wireless communication protocol different from the first wireless communication protocol.