WPA2, short for Wi-Fi Protected Access 2, is the Wi-Fi security certification that implements the IEEE 802.11i amendment and protects wireless traffic with AES-based CCMP encryption. It became mandatory for Wi-Fi certified devices in 2006 and remained the dominant security mode for well over a decade, until WPA3 began to replace it.
WPA2 defines how a client and an access point prove that they share a secret, how they derive fresh encryption keys for each session, and how every frame is encrypted and integrity-protected. It exists in two variants: WPA2-Personal with a pre-shared key and WPA2-Enterprise with individual logins through 802.1X.
How WPA2 protects a wireless connection
WPA2 protects a connection in three stages: authentication, key derivation with the four-way handshake, and encryption of every data frame with CCMP. The design follows the robust security network model of IEEE 802.11i, which separates long-term credentials from the short-term keys used on the air.
Authentication produces a pairwise master key (PMK). In WPA2-Personal the PMK is derived from the passphrase and the SSID with PBKDF2 using 4,096 iterations of HMAC-SHA1, giving a 256-bit key. In WPA2-Enterprise the PMK comes out of an EAP exchange with a RADIUS server, so every user and session receives a different master key.
During the four-way handshake, the access point and client exchange random numbers called ANonce and SNonce and combine them with the PMK and both MAC addresses to derive the pairwise transient key (PTK). The PTK encrypts unicast traffic, while a separate group temporal key (GTK) delivered in the same handshake encrypts broadcast and multicast frames. The PMK itself never crosses the air.
| Key | Origin | Purpose |
|---|---|---|
| Pairwise master key | Passphrase or EAP session | Long-term secret for one client |
| Pairwise transient key | Four-way handshake | Encrypts unicast frames for one session |
| Group temporal key | Generated by the access point | Encrypts broadcast and multicast frames |
| Key confirmation key | Part of the PTK | Authenticates handshake messages |
| Key encryption key | Part of the PTK | Protects delivery of the GTK |
WPA2-Personal and WPA2-Enterprise
The two WPA2 modes share the same encryption but differ completely in how users are identified. WPA2-Personal, also called WPA2-PSK, uses one passphrase of 8 to 63 characters for everyone, whereas WPA2-Enterprise authenticates each user or device against a central directory.
| Property | WPA2-Personal | WPA2-Enterprise |
|---|---|---|
| Credential | Shared passphrase | Per-user password or certificate |
| Infrastructure | Access point only | RADIUS server and directory |
| Offline guessing risk | High with weak passphrases | Low with certificate-based EAP |
| Revoking one user | Requires changing the passphrase for all | Disable one account |
| Typical setting | Homes and small offices | Companies, universities, hospitals |
Enterprise mode supports several EAP methods. EAP-TLS with client certificates is the strongest choice, while PEAP-MSCHAPv2 is widespread but safe only when clients strictly validate the server certificate; otherwise a rogue access point can capture credentials.
WPA2 compared with WEP, WPA and WPA3
WPA2 sits between the broken legacy protocols and the current WPA3 standard. The table shows what changed from one generation to the next.
| Standard | Encryption | Key exchange | Current status |
|---|---|---|---|
| WEP | RC4 with static keys | None | Broken, never acceptable |
| WPA | TKIP based on RC4 | Four-way handshake | Deprecated |
| WPA2 | AES-CCMP 128-bit | Four-way handshake | Acceptable with a strong passphrase |
| WPA3 | AES-CCMP or GCMP-256 | SAE dragonfly handshake | Recommended for new networks |
The decisive improvement of WPA3-Personal is Simultaneous Authentication of Equals (SAE), which removes the offline dictionary attack on the handshake and adds forward secrecy. WPA3 also requires Protected Management Frames, which are optional in WPA2. Many networks therefore run WPA2/WPA3 transition mode so that older clients can still connect, at the cost of keeping the WPA2 weaknesses for those clients.
Known weaknesses of WPA2
The AES encryption in WPA2 has not been broken; its weaknesses lie in the handshake and in how it is used. The most practical attack against WPA2-Personal is offline password guessing: an attacker who captures one handshake, or a PMKID from the first handshake message, can test passphrases on GPU hardware without further contact with the network.
In 2017 the KRACK key reinstallation attacks showed that manipulated handshake messages could force clients to reuse nonces, allowing decryption of some traffic. The flaw was in implementations of the standard and was fixed through client and access point updates, which is why patch level matters as much as the security mode.
- Weak passphrases: short or dictionary-based keys fall quickly to offline cracking.
- No forward secrecy: anyone who knows the passphrase can decrypt captured traffic of other clients.
- Unprotected management frames: deauthentication floods can disconnect clients unless 802.11w is enabled.
- TKIP fallback: mixed WPA/WPA2 modes with TKIP weaken security and limit speeds to 54 Mbit/s.
Configuring WPA2 securely
A WPA2 network remains defensible when it is configured carefully, and the following settings make the largest difference.
| Setting | Recommended value | Reason |
|---|---|---|
| Cipher | AES-CCMP only | TKIP is deprecated and slows the network |
| Passphrase length | At least 20 random characters | Makes offline guessing impractical |
| Protected management frames | Optional or required | Limits deauthentication attacks |
| WPS | Disabled | PIN method can be brute-forced |
| Enterprise EAP method | EAP-TLS or validated PEAP | Prevents credential capture |
| Firmware | Current vendor release | Includes KRACK and other fixes |
Where every client supports it, moving to WPA3 or at least to transition mode is the better long-term choice. WPA2 remains common in industrial devices, printers and older phones, so segmenting such clients onto a separate SSID is a practical compromise.
Stripped to the essentials
WPA2 is the lock on a Wi-Fi network. When a phone joins, it and the router first check that both know the same secret, then agree on fresh keys that scramble everything they send. Someone listening nearby sees only noise.
The lock is only as good as the key. A long, random Wi-Fi password keeps WPA2 safe, while a short or common one can be guessed by a patient attacker. Newer equipment offers WPA3, which closes that gap.
Where it is applied
A small accounting firm with twelve employees runs one access point secured with WPA2-Personal and an eight-letter passphrase that has not changed in five years. A security review captures a handshake and recovers the passphrase in under an hour using a common wordlist.
The firm responds by moving staff laptops to WPA2-Enterprise with EAP-TLS certificates issued from its existing directory, so each device has its own credential. An older label printer that supports only WPA2-Personal moves to a separate SSID with a 24-character random passphrase and access limited to the print server. As a result, leaving staff can be revoked individually, and the shared secret no longer opens the main network.