Wi-Fi Security: WEP, WPA, WPA2, WPA3
Wi-Fi security has evolved through four generations, from the thoroughly broken WEP to the modern WPA3. Each step fixed weaknesses in the last, and the older protocols are not merely weaker but actively unsafe. Knowing the lineage tells you exactly what to run — and what, if you find it, should be replaced immediately.
How the protocols compare#
| Protocol | Status | Notes |
|---|---|---|
| WEP | Broken | Key recoverable in minutes; never use |
| WPA | Obsolete | TKIP weaknesses; superseded |
| WPA2 | Acceptable | AES-based; strong passphrase essential |
| WPA3 | Current best | SAE handshake, forward secrecy, safer defaults |
The big leap in WPA3 is its handshake: SAE (Simultaneous Authentication of Equals) resists the offline dictionary attacks that let attackers capture a WPA2 handshake and grind the password offline. WPA3 also brings forward secrecy and encrypts even open “public” networks.
What should you actually use?#
Use WPA3 where every device supports it; otherwise WPA2 with a long, random passphrase, which remains reasonable. Disable WEP and WPA entirely — their presence is a liability. And remember that Wi-Fi encryption protects the wireless link only; end-to-end TLS still matters.
Wi-Fi protocols are the encryption layer of wireless networks, adjacent to attacks like deauth. More at the Network Security hub.
Frequently asked questions#
What is the most secure Wi-Fi protocol?
WPA3 is the current standard and the most secure widely available option. It strengthens the handshake against offline password-guessing (using SAE, or Simultaneous Authentication of Equals), provides forward secrecy, and encrypts even open networks. Where WPA3 is unavailable, WPA2 with a strong passphrase remains acceptable; anything older is broken.
Why is WEP insecure?
WEP (Wired Equivalent Privacy) has fundamental cryptographic flaws — weak, reused initialization vectors and a broken use of the RC4 cipher — that let attackers recover the key in minutes with freely available tools. It has been considered broken for two decades and must never be used; its presence is itself a vulnerability.