WiFi Security Protocols: WEP, WPA, WPA2, and WPA3

WiFi Security Protocols

The security protocol you use determines how strongly your WiFi connection is encrypted and how resistant it is to attack. This guide explains each protocol from oldest to newest.

WEP (Wired Equivalent Privacy) — Avoid

WEP was the first WiFi security protocol, introduced in 1997. It uses RC4 stream cipher encryption. WEP is now completely broken — any WEP-protected network can be cracked in minutes using freely available tools. If your router offers WEP as an option, never use it.

WPA (WiFi Protected Access) — Outdated

WPA was introduced in 2003 as an emergency replacement for WEP. It uses TKIP (Temporal Key Integrity Protocol) encryption. While significantly better than WEP, WPA has known vulnerabilities and should no longer be used if WPA2 is available.

WPA2 — Current Standard

Released in 2004, WPA2 uses AES (Advanced Encryption Standard) encryption and is the current baseline standard. WPA2-AES (also called WPA2-CCMP) is secure for most home networks when used with a strong password. Avoid WPA2-TKIP — it uses the older, weaker TKIP cipher.

Note: WPA2 is vulnerable to KRACK (Key Reinstallation Attacks) if the router firmware is not patched. Keep your router firmware up to date.

WPA3 — Best Available

Released in 2018, WPA3 significantly improves on WPA2 in several ways:

• SAE (Simultaneous Authentication of Equals): Replaces the WPA2 PSK handshake. Attackers cannot capture a handshake and crack it offline.
• Perfect Forward Secrecy: Each session uses a unique key. Past traffic cannot be decrypted even if the main password is compromised later.
• 192-bit security: WPA3-Enterprise uses 192-bit encryption for high-security environments.

What You Should Use

Use WPA3 if your router and all your devices support it. If you have older devices, use WPA2/WPA3 Mixed (also called Transition Mode) — newer devices use WPA3 while older ones fall back to WPA2. At a minimum, always use WPA2-AES. Never use WEP or WPA-TKIP.