Wi-Fi Protected Access (WPA) is a family of security protocols – WPA, WPA2 and WPA3 – that authenticate devices and encrypt traffic on wireless networks.
How WPA works
The Wi-Fi Alliance introduced WPA in 2003 as an urgent replacement for WEP, whose encryption could be cracked in minutes. The generations differ significantly:
- WPA – an interim fix using TKIP, now considered insecure.
- WPA2 (2004) – based on the IEEE 802.11i standard with AES-CCMP encryption; still the most widely deployed version.
- WPA3 (2018) – replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals), which resists offline password guessing and provides forward secrecy.
Each version has a Personal mode, where all users share one passphrase, and an Enterprise mode, where every user authenticates individually through 802.1X and a RADIUS server.
Why WPA security matters
An attacker within radio range of a Wi-Fi network can capture the WPA2-Personal four-way handshake (or, since 2018, a PMKID from the access point) and then run an offline dictionary attack against the passphrase with tools such as hashcat – weak passphrases fall quickly. Protocol flaws also appear: the KRACK attacks (2017) abused key reinstallation in WPA2, and the Dragonblood research (2019) found side-channel and downgrade weaknesses in early WPA3 implementations. Once inside, an attacker can mount man-in-the-middle attacks against other devices.
How to secure a wireless network
- Use WPA3, or WPA2 with AES only, and disable WEP, TKIP and WPS.
- Choose a long, random passphrase for Personal mode.
- Use WPA2/WPA3-Enterprise in companies so access can be revoked per user.
- Keep router and access point firmware up to date.
