WPA3 is the current WiFi security standard, and 802.1X is the method enterprise networks use to check who each user or device is before letting it on. For a staff network, the strongest practical setup is WPA3 Enterprise (or WPA2 Enterprise during a transition) with 802.1X authentication against a RADIUS server tied to your directory. Shared passwords belong only on networks where individual identity does not matter.
Personal vs Enterprise: the basic split
Every WiFi security mode falls into one of two families.
- Personal uses one passphrase shared by everyone. It is simple, but anyone who knows the passphrase is on the network, and changing it means updating every device.
- Enterprise gives each user or device its own credentials. The access point passes the login to an authentication server, which approves or rejects it. Removing one person's access is a single change in your directory, and logs show who connected and when.
For corporate staff, healthcare, schools and any network carrying business data, Enterprise is the right choice. Personal mode still has a place for small offices, some IoT devices that cannot do Enterprise, and isolated networks where every device is treated the same.
What WPA3 changed
WPA3 replaced WPA2 as the certification requirement for new WiFi equipment. The main improvements are:
- SAE in place of the pre-shared key handshake. WPA3 Personal uses Simultaneous Authentication of Equals. It resists offline dictionary attacks, where an attacker captures the handshake and tries passwords at leisure. A weak passphrase is still a weak passphrase, but it is much harder to crack from a capture.
- Protected Management Frames required. Management frames, such as the ones that disconnect a client, are protected. This blocks the simple forged-deauthentication attacks that were common against WPA2.
- Enhanced Open. Opportunistic Wireless Encryption (OWE) encrypts traffic on open networks, such as a guest network with no password, so nearby users cannot read each other's traffic. It does not identify anyone, but it is better than no encryption.
- A 192-bit mode for Enterprise. WPA3 Enterprise includes an optional higher-security suite intended for government and other sensitive environments.
The 6 GHz band, used by WiFi 6E and WiFi 7, does not allow WPA2 or plain open networks. If you plan to use 6 GHz, your SSIDs there must use WPA3 or Enhanced Open. See WiFi 6, 6E and 7 explained for more on the newer standards.
How 802.1X works
802.1X has three parts:
- The supplicant is the client device: a laptop, phone or scanner.
- The authenticator is the access point or wireless controller. It blocks the client's traffic until authentication succeeds.
- The authentication server is usually a RADIUS server, which checks credentials against a directory such as Active Directory and sends back an accept or reject.
The conversation between client and server uses EAP (Extensible Authentication Protocol). The method you choose matters more than most people expect.
Common EAP methods
| Method | Client proves itself with | Notes |
|---|---|---|
| EAP-TLS | A certificate installed on the device | The strongest common option. No passwords to phish. Needs a way to issue and renew certificates, usually through device management. |
| PEAP (MSCHAPv2) | Username and password | Widely supported and easy to roll out. Only safe if clients are set to validate the server certificate. |
| EAP-TTLS | Usually username and password | Similar role to PEAP, common on some non-Windows platforms. |
Validate the server certificate. With PEAP or TTLS, a client that does not check the RADIUS server's certificate will happily send credentials to a fake access point set up by an attacker. Push the correct certificate settings to managed devices rather than letting users tap "trust" on a prompt.
Useful things 802.1X makes possible
- Dynamic VLAN assignment. One SSID can place staff, contractors and devices on different VLANs based on who they are, instead of broadcasting a separate SSID for each group. Fewer SSIDs means less airtime overhead.
- Per-user policies. The RADIUS server can return firewall roles or bandwidth limits for each group.
- Accounting and audit. You can see which account was on which device, at what time, from which access point.
- Clean offboarding. Disable the directory account or revoke the certificate and access ends.
Planning the move from WPA2
Most networks cannot switch overnight, because older devices (barcode scanners, printers, medical or building devices) may not support WPA3. A practical sequence:
- Inventory devices. List every type of client on the network and what security modes it supports.
- Use transition mode where needed. WPA3 transition mode lets WPA2 and WPA3 clients share an SSID. It is a bridge, not a destination, because the network is only as strong as its weakest allowed client.
- Separate legacy devices. Put devices that will never support WPA3 or 802.1X on their own SSID and VLAN with tight firewall rules.
- Test before rollout. Some older drivers fail when Protected Management Frames are enabled. Test a sample of each device type before changing production SSIDs.
- Make RADIUS resilient. If the RADIUS server is down, nobody can join. Run at least two servers, and keep them reachable from every site.
Roaming also deserves attention: a full 802.1X login on every access point change can be slow enough to drop a voice call. Fast roaming features address this, covered in WiFi roaming and handoff.
Guests are a separate case: they should never share the staff SSID or VLAN. See guest WiFi done safely.
How ehZee can help
Security is part of the checklist on every WiFi survey and design we do: we ask how users will authenticate, whether RADIUS or Active Directory is in place, and what physical security the access points and network closets need. Our WiFi design and build service carries those answers into the SSID plan, VLAN design and configuration, then verifies the result on site.
Common questions
Is WPA2 still safe to use?
WPA2 Enterprise with properly configured 802.1X is still reasonable while you transition. WPA2 Personal with a short or widely shared passphrase is the weak spot. Plan to move to WPA3 as devices allow, and you must use WPA3 or Enhanced Open on 6 GHz.
Do we need certificates for 802.1X?
The RADIUS server always needs a certificate. Client certificates are only needed for EAP-TLS. Many organizations start with PEAP and move to EAP-TLS once device management is in place.
What about devices that cannot do 802.1X?
Put them on a separate SSID with a strong passphrase, or use per-device passphrases if your equipment supports them, and restrict that VLAN to only what those devices need to reach.