Wi-Fi security: WPA2, WPA3 and the right password

In short: Wi-Fi encryption protects what is transmitted wirelessly; modern routers should use WPA3 or at least WPA2 with a strong password.

In more detail: Radio waves can be received by anyone within range. Only encryption prevents neighbours or strangers from reading along or hooking into the home network. The Wi-Fi Alliance’s standards have improved over the years.

In Depth

The standards

• WEP: ancient, crackable in minutes. Never use.
• WPA: transitional, also outdated.
• WPA2 (AES/CCMP): standard for years, still sufficient with a strong password. Weakness: recorded handshakes can be tried offline with dictionary lists; weak passwords fall.
• WPA3: new exchange (SAE) protects against offline guessing, offers forward secrecy and protects open networks with OWE. The standard for new devices. WPA3 and WPA2 can be combined in mixed mode until all devices support WPA3.

The password

Length counts: at least 16 characters, better a passphrase of several words. Do not use the factory password if it was assigned by a pattern, and change the router admin access (not only the Wi-Fi password). A guest network for visitors separates them from the home network and IoT devices. Change the password if it has been passed on or a device was lost.

Further measures

• Switch off WPS (button/PIN); the PIN variant is attackable.
• Keep router firmware up to date.
• Remote access and UPnP only when needed.
• Hiding the SSID and MAC filters bring hardly any security.
• For companies: WPA2/WPA3-Enterprise with RADIUS and individual accounts instead of a shared password.

Public networks

In a café or hotel Wi-Fi without encryption, others can read along. Websites with HTTPS stay protected, but the addresses visited are partly visible. A VPN or the mobile data network is safer. Beware of fake access points with similar names (“evil twin”) and login pages that ask for passwords.

See also: RADIUS, UPnP, Wi-Fi standards, VPN