One setting in your router decides whether your network is actually private or just a public broadcast with a password on top. It is the security mode, and its options are basically a timeline of Wi-Fi security: WEP, WPA, WPA2, WPA3.
Each was the right choice once. Three of the four are now broken to some degree. Here is what each one does, why the old ones fell, and what to actually pick.
Why Wi-Fi needs encryption at all
Wired traffic stays in the cable. Wi-Fi sends every frame into the air, where anyone with an antenna in range picks up the same radio waves your laptop does. The only thing between "in range" and "reading your traffic" is encryption. When it is weak, being nearby is the whole attack.
That is the lens for all four standards: each one tries to make the frames in the air useless to everyone except the device they are meant for.
WEP (1999): broken, and not fixable
Wired Equivalent Privacy shipped with the first Wi-Fi. The name promised "as private as a wire." It was broken almost immediately.
WEP uses the RC4 cipher with a short value called an initialisation vector, and it reuses that value far too often. Reusing the keystream is a basic crypto mistake, and by the early 2000s the attack was mechanical: capture enough frames - a busy network throws them off in minutes - and the key just falls out. No password guessing, no luck needed.
WEP is not weak security. It is no security. If a network still offers only WEP, the hardware predates 2004 and should be replaced. No setting fixes it.
WPA (2003): the emergency patch
WPA was a stopgap, built to run on the same hardware as WEP while the real replacement was finished. It wrapped RC4 in a system called TKIP that changed the key on every packet, which fixed WEP's specific flaw.
But it was still RC4 underneath, still built for 2003-era chips, and its own weaknesses turned up soon after. WPA was never meant to last, and you should not use it today. Like WEP, seeing it means the hardware is old enough to replace.
WPA2 (2004): the workhorse
WPA2 is what most networks still run, and for good reason: it was a real redesign, not a patch. It dropped RC4 for AES - the same cipher that protects classified data - in a mode called CCMP. For encrypting your actual traffic, WPA2 with AES is still solid in 2026.
Its weak points are around the edges, not in the cipher:
The password is the whole game. WPA2 Personal builds every key from your passphrase through a step called the 4-way handshake, run each time a device joins. An attacker in range can record that handshake, then guess passwords against it offline - on their own machine, at millions of tries per second, without ever touching your network again. A short or common passphrase falls; a long random one does not. The cipher is strong; a weak password just hands over the key. (How that attack works, and how WPA3 stops it, is the next post in this series.)
KRACK (2017) was a flaw in the handshake itself, and for a while it hit every WPA2 device on earth. It was fixed in software, so a device kept up to date is not exposed. The lesson: "sound in theory" still needs updates in practice.
WPS is a separate trap. The feature that lets you join by pressing a button or typing an 8-digit PIN has a PIN mode that can be brute-forced in hours, skipping your strong password completely. Turn WPS off. It is the most common way a good WPA2 password gets beaten without being guessed.
WPA3 (2018): closing the offline attack
WPA3 keeps WPA2's AES encryption - the part that still works - and replaces the weak handshake with one called SAE (Simultaneous Authentication of Equals, also known as Dragonfly).
Here is the change that matters: SAE needs a live exchange with the router for every single password guess. That one fact kills the offline attack. An attacker can no longer record a handshake and test billions of guesses on their own machine. Each guess now needs a fresh round-trip to your router, which is slow, rate-limited, and easy to spot. A weak WPA2 password that would fall in an afternoon can survive under WPA3.
WPA3 adds two more things worth knowing:
- Forward secrecy. Even if your password leaks later, traffic the attacker recorded in the past still cannot be decrypted. Under WPA2, a leaked password unlocks everything captured before it.
- OWE encrypts open networks - the coffee-shop kind with no password. It gives each device its own key, so "no password" no longer means everyone can read everyone else. The network is still open to join; the traffic is not.
WPA3 Enterprise adds a 192-bit mode for places that need it, but for a home or small office, SAE and forward secrecy are the real wins.
The mixed-mode caveat
Most routers that offer WPA3 default to WPA2/WPA3 mixed mode, so older devices that cannot do WPA3 can still connect. That is a fair compromise, but know the trade-off: a device that connects over WPA2 in this mode gets WPA2 security, offline-attack exposure included. Mixed mode is only as strong as WPA3 for the devices actually using WPA3. If everything you own supports WPA3, WPA3-only is strictly safer.
What to actually select
The dropdown, from safest down:
- WPA3-Personal - if every device supports it. Best case.
- WPA2/WPA3 mixed - the sensible default when you have both old and new devices.
- WPA2-Personal (AES/CCMP only) - still fine in 2026 with a strong passphrase. If the option says "WPA2 TKIP" or "WPA2 AES+TKIP", pick AES-only; TKIP is the old RC4 system carried forward.
- WPA, WEP - never. Seeing them means the hardware is old enough to replace.
Then, whatever mode you pick: turn WPS off, and use a long passphrase. Under WPA2 the passphrase is your entire defence against the offline attack; even under WPA3 a truly trivial one is one guess from useless. Length beats complexity - a few unrelated words outlast a short string of symbols.
Check what you are actually on
Router settings tell you what you configured. The only way to know what a device negotiated is to check from the device. A phone that reads the security type of the network it joined tells you whether you are on WPA2 or WPA3, which band, and which access point (BSSID) - handy when a mixed-mode network quietly puts an old device on the weaker path.
NetTools: Network Analyzer shows the security type, band and BSSID of the network you are on, so "I set WPA3" can be checked against "this device actually got WPA3". The next post pulls the WPA2 password weakness apart - how the offline attack works, and how to make your own network fail it: Why WPA2 passwords crack and WPA3 resists.
Cover photo by Mitchell Y on Unsplash.
