What Wi-Fi encryption does
Wireless signals travel through the air, so anyone within range can, in principle, pick them up. Encryption scrambles the data between a device and the router so that a bystander who captures it sees only unreadable noise. It also helps control who is allowed onto the network in the first place, because a device must prove it knows the password before it can join.
Your router’s wireless settings include a security mode. Choosing it well is one of the more consequential decisions in home network setup, and it is usually a single drop-down menu.
The common options
The names are confusing, but there are only a handful of options you are likely to meet.
Open (no security)
An open network has no password, and traffic is not protected in the usual way. Anyone can join. This is sometimes used by cafes and hotels, and is not suitable for a household network. The wider risks are discussed in the piece on open hotspot risks.
WEP
Wired Equivalent Privacy is the oldest standard. It has long-known design flaws, and tools to break it are widely available. It may still appear in a menu for the sake of ancient equipment, but it should not be used. If a device can only use WEP, consider replacing the device.
WPA (the original)
The first Wi-Fi Protected Access improved on WEP but was always a stopgap. It is also considered outdated and is best avoided. Some menus label a choice “WPA/TKIP”; TKIP is an older scrambling method that has been phased out.
WPA2
WPA2 has been the mainstream standard for many years. When paired with AES encryption (sometimes shown as CCMP), it is considered a solid choice when you use a strong password. Almost every device made in the past decade supports it. The main weakness is that a weak or guessable Wi-Fi password can still be attacked by someone who captures the connection process and tries many guesses offline.
WPA3
WPA3 is the newer standard. Among other improvements, it makes guessing a password offline considerably harder and gives better protection on certain kinds of networks. It requires support in both the router and the device. Newer phones, laptops and routers generally have it, while older gadgets may not.
Mixed mode (WPA2/WPA3)
Many routers offer a transitional setting that accepts both WPA2 and WPA3 devices. It lets newer devices use the stronger standard while older ones continue to work. The trade-off is that the network’s overall protection is limited by the older option for devices that use it, but it is a reasonable compromise during the changeover years.
Which one should you choose?
A sensible order of preference looks like this:
| Choice | Suitable for home use? |
|---|---|
| WPA3 only | Yes, if every device supports it |
| WPA2/WPA3 mixed | Yes, a practical middle ground |
| WPA2 with AES | Yes, with a strong password |
| WPA or WPA/TKIP | No, avoid |
| WEP | No, avoid |
| Open | No, not for a home network |
If all your devices are modern, WPA3 is a good choice. If you have a mix, use the mixed mode or WPA2 with AES. If you are not sure what your gadgets support, try mixed mode first and see whether everything connects.
The password still matters most
Encryption is only as strong as the password behind it. A short, common or guessable password weakens even the best standard. Choose a long passphrase that is not used anywhere else, and avoid anything that includes your name, address or phone number. Information on forming one appears in the article about memorable passphrases, and the habit of avoiding password reuse applies here too.
Settings that can confuse
Several other items sit near the encryption menu, and it helps to know what they are.
- Encryption method. If the menu offers both AES and TKIP, choose AES. Avoid settings that enable TKIP.
- WPS. This is a convenience feature for connecting devices with a button or a short code. If you do not need it, turning it off is a common recommendation.
Changing the setting safely
Changing the security mode will disconnect devices, since they remember the old configuration. A safe approach is:
- Make the change from a computer connected by network cable if you can, or from a device you are happy to reconnect first.
- Save the setting and let the router restart if it asks.
- Reconnect each device with the Wi-Fi password. If a device refuses, choose “forget this network” on it and join again.
- If one older gadget cannot connect, check whether it supports the chosen mode. Moving that gadget to a separate guest network that uses a more compatible setting is sometimes an option, though replacing it may be better in the long run.
Keep in mind that firmware matters: a router that has not been updated for years may not offer the newest options, and updated software can sometimes add them. Router firmware updates are worth checking before you decide the hardware is too old.
A note on realistic expectations
Strong encryption protects the wireless link between your devices and the router. It does not protect against everything. It cannot stop you from entering your details on a fake website, and it does not hide your activity from your internet provider or the sites you visit. For that reason, it works alongside habits such as safe browsing habits and careful treatment of phishing messages, rather than replacing them.
Choosing a modern security mode, using a strong Wi-Fi password and keeping the router updated cover the main points. Beyond that, rely on your router’s manual or your provider’s support for the exact steps on your model.