Wi-Fi Encryption Explained: Types, Standards and Security Best Practices

Key takeaways

• Never use WEP or WPA/TKIP. Both can be broken with free tools, and WEP in minutes.
• WPA2-Personal with AES is acceptable if the passphrase is long and random. WPA3-Personal is better because it resists offline guessing of captured handshakes.
• Wi-Fi encryption protects only the wireless hop. It does not protect your traffic once it leaves the router, so HTTPS still matters.
• Offices should use WPA2/WPA3-Enterprise (802.1X with a RADIUS server) so each user has their own credentials.
• Turn off WPS, update router firmware and use a separate guest network for visitors and smart devices.

What is Wi-Fi encryption?

Wi-Fi encryption is the part of the Wi-Fi security protocol that turns your data into ciphertext before it goes through the air. Radio waves travel through walls, so anyone in range can receive them. Encryption means what they receive is unreadable without the key.

Two jobs are involved, and people often mix them up. Authentication decides who may join the network (the passphrase or the user login). Encryption protects the data of those who have joined. Modern standards do both, and each device gets its own session keys even when everyone shares one passphrase.

Wi-Fi security standards compared

WEP

WEP was the first Wi-Fi security standard. Its design reused short initialisation vectors with the RC4 cipher, so enough captured packets reveal the key. It has been obsolete for many years. If a router offers it, the router is too old to trust.

WPA and TKIP

WPA was a quick fix that let old WEP hardware run a safer protocol through a firmware update. TKIP improved on WEP but kept RC4 underneath, and it has known weaknesses. TKIP is also not allowed with the higher speeds of 802.11n and later, which is another reason to turn it off.

WPA2

WPA2 introduced mandatory AES encryption using CCMP, and it has protected most Wi-Fi networks for two decades. Its weak point in home use is the pre-shared key (PSK). An attacker who captures the four-way handshake can try passphrases offline at high speed. A short or dictionary-based passphrase falls quickly; a long random one does not.

WPA3

WPA3-Personal replaces the PSK handshake with SAE (Simultaneous Authentication of Equals). Each guess now needs a live exchange with the access point, so offline guessing from a captured handshake stops working. WPA3 also adds forward secrecy, so recording traffic today and learning the passphrase later does not reveal old sessions. For open networks such as cafes, the Wi-Fi Alliance's Enhanced Open (OWE) encrypts each client's traffic without a password. The Wi-Fi Alliance security page describes these features.

WPA3 is not the same as Wi-Fi 6. Wi-Fi 6 (802.11ax) is about speed and capacity. WPA3 is about security. Many Wi-Fi 6 routers support WPA3, but check the settings page instead of assuming. Devices using the 6 GHz band in Wi-Fi 6E must use WPA3.

AES vs TKIP

AES is a strong block cipher used in WPA2 and WPA3 through the CCMP or GCMP modes. TKIP is a patch around RC4. If your router has a "WPA/WPA2 mixed" or "TKIP + AES" option, choose AES only. Mixed mode keeps the weaker option available for older devices, and a network is only as safe as the weakest mode it accepts.

How the encryption works, step by step

1. The device finds the network and agrees on the security type with the access point.
2. Both sides prove they know the secret. In WPA2-Personal this is the passphrase; in WPA3-Personal it is the SAE exchange; in Enterprise it is the user's credentials checked by a RADIUS server.
3. They derive fresh session keys for this one device. These are different from the passphrase and change with each connection.
4. Every data frame is then encrypted and integrity-checked with those keys, so tampering is detected.

Personal vs Enterprise mode

Personal mode (PSK or SAE) uses one shared passphrase for everyone. That is fine at home. In an office it is a problem: when someone leaves you must change the passphrase on every device.

Enterprise mode uses 802.1X. Each user logs in with their own credentials or certificate, checked by a RADIUS server, usually with an EAP method such as EAP-TLS or PEAP. Removing a person's access means disabling one account. WPA3-Enterprise also has a 192-bit security mode for high-security environments.

How do you check your Wi-Fi encryption type?

• Windows: run netsh wlan show interfaces and read the Authentication and Cipher lines.
• Linux: run nmcli -f SSID, SECURITY dev wifi to see what nearby networks advertise.
• Phone: open the Wi-Fi network details. Android and iOS both name the security type, and iOS flags weak security.
• Router: log in to the admin page and open the wireless security settings.

How do you set up strong Wi-Fi security?

1. Log in to your router's admin page and change the default admin password.
2. Under wireless security, choose WPA3-Personal. If some devices cannot connect, use WPA2/WPA3 transition mode, or WPA2-AES only.
3. Set a passphrase of at least 14 characters; four or five random words work well and are easy to type on a TV. Do not use your name, phone number or the SSID.
4. Turn off WPS. The PIN method has design flaws that allow brute-force attacks.
5. Update the router firmware, and turn on automatic updates if the router has them.
6. Create a guest network for visitors and for smart bulbs, cameras and TVs, so they cannot reach your laptop.

Hiding the SSID is not a security measure. Hidden names are still visible to anyone who looks for them. Filtering by MAC address is also weak, because MAC addresses can be copied.

What does Wi-Fi encryption not protect?

• Traffic beyond the router. The encryption ends at the access point. After that your data crosses the internet, where HTTPS or a VPN protects it.
• Fake access points. An "evil twin" copies a real network name. Encryption does not help if you join the attacker's network, and it is the main reason to treat public Wi-Fi with care.
• Weak passphrases. The best standard cannot rescue a passphrase like 12345678.
• Compromised devices. Malware on your laptop sees data after it is decrypted.

Testing your own Wi-Fi security

Security professionals test wireless networks by capturing a handshake and checking passphrase strength, or by reviewing what encryption an access point advertises. Do this only on a network you own or have written permission to test. In India, accessing someone else's network without authorisation is an offence under the Information Technology Act, 2000. Our article on Aircrack-ng explains the tool used for this kind of audit. For guidance aimed at organisations, NIST publishes wireless security guidance in its Special Publications series.

Best practices checklist

• WPA3 where possible, otherwise WPA2 with AES only.
• Long random passphrase; change it if you suspect it leaked.
• WPS off, firmware current, admin password changed.
• Guest and IoT network separated from your main devices.
• Enterprise (802.1X) for any office with more than a handful of users.
• Use HTTPS everywhere, and a VPN on untrusted public Wi-Fi.

Next steps

Check your own router today: find the security type and confirm WPS is off. If you are heading into networking, wireless security is part of the CCNA 200-301 course, and our CCNA wireless interview questions help you practise explaining it.

Related reading

• Essential IT Security Abbreviations | A Complete Guide for Cybersecurity Experts
• Top Secure Mobile Communication Protocols You Should Know in 2026 | The Detailed Guide