I know there are three method for wifi security. What are the relative strengths of the password encryption in WEP, WPA and WPA2 PSK?

2 Answers 2


The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure.

  • WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make breaking WEP near-trivial. Anyone with a laptop and a $20 wifi antenna can send special de-auth packets, which cause legitimate clients to re-authenticate to the AP. The attacker can then capture the initialization vectors from these re-authentication packets and use them to crack the WEP key in minutes. Due to the severity of the break, WEP is now considered deprecated. See this question for more details on WEP security.
  • WPA improves upon this, by combining RC4 with TKIP, which helps defend against the IV-based attacks found in WEP. It also improves upon the old handshake mechanism, to make it more resistant to de-auth attacks. Whilst this makes a large improvement, vulnerabilities were found in the way that the protocol worked, allowing an attacker to break TKIP keys in about 15-20 minutes. You can read more about the attack at this other question.
  • WPA2 closes holes in WPA, and introduces an enhanced version of TKIP, as well as CCMP. The standard also bring support for AES, which provides even further security benefits. At current there are no known generic attacks against WPA2.
  • 1
    Let me add a bit of an intensifier regarding WEP. If you've been thinking about going with WEP, you should probably just go with an unencrypted wireless network instead. That way at least you're not fooling yourself into thinking you're secure.
    – user12272
    Commented Nov 28, 2012 at 4:18
  • 4
    WEP is better than no security at all in cases where you don't want your neighbours using it, assuming said neighbours aren't the types to know the difference between WEP and WPA.
    – Polynomial
    Commented Nov 28, 2012 at 6:52
  • Note that TKIP is nowhere near that insecure even now.
    – Yuhong Bao
    Commented Dec 21, 2016 at 9:13
  • Does this paper mean WPA2 is now broken? lirias.kuleuven.be/bitstream/123456789/547640/1/…
    – CAD97
    Commented Oct 16, 2017 at 3:54
  • @CAD97, one of the two attacks described is against an implementation error (an access point using a random-number generator that isn't very random). The other is against WPA-TKIP.
    – Mark
    Commented Mar 6, 2018 at 22:53

Updated answer: Now even WPA2 is broken
The KRACK Attack can breaks WPA2 WiFi protocol.
Router, access point, WiFi client need to be patched.

More info here:

Old answer here:
The short answer is that WPA2 is the only secure protocol.

But it's secure only if WPS (WiFi Protected Setup) on the access point is disabled.
WPS is broken, an access point with WPS enabled is crackable, no matter what kind of WiFi protocol it uses.

For more info: How to crack a WPS enabled WiFi network

Sadly, WPS is enabled by default on the majority of WiFi Router and Access Point...
The first thing I do on any router I put my hand on, is disabling WPS.

  • 2
    This is misleading. KRACK Attacks are not a flaw in the protocol but a vulnerability in the implementation of the hostap daemon. Even more, not all devices are affected and it has been patched AFAIK
    – Mr. E
    Commented Mar 6, 2018 at 16:42
  • @Mr.E to my knowledge "both the client and AP must be patched to defend against all attacks" link so the 'it has been patched' only apply to the very few people that know how to, and care about, keeping Firewall/router/AP + smartphone/computer/client updated. Sorry if my wording is not correct, do you think it's better if I say "The KRACK Attack can breaks your WiFi WPA2 security on many devices."?
    – Max
    Commented Mar 6, 2018 at 22:54
  • 4
    @Mr.E Actually, it is a flaw in the protocol. Any perfectly compliant WPA2 implementation will be vulnerable to KRACK. Luckily however, it is possible to mitigate it with a small change to the protocol that does not break backwards compatibility. This means that patched systems are no longer perfectly compliant, but they are still compatible with truly compliant implementations.
    – forest
    Commented Mar 7, 2018 at 2:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .