What Wi-Fi security is protecting
Radio signals travel through walls and beyond your front door, so anyone nearby can in principle pick them up. Wi-Fi security does two jobs. It controls who can join your network, and it scrambles the data between each device and the router so that others nearby cannot easily read it.
It does not protect everything. The protection covers the wireless hop between your device and your router. Beyond the router, data travels across the internet and is protected, if at all, by the websites and apps themselves. And it does not stop a malicious program on a device that has already joined. It is one layer of several.
Encryption modes
Routers offer several security modes. The names are abbreviations for generations of the standard.
- Open (no security). Anyone can join and traffic is not protected by Wi-Fi encryption. This is sometimes used by public hotspots and carries the risks discussed under public Wi-Fi. It should not be used for a home network.
- WEP. An old method with serious known weaknesses. It should not be used, and any device that supports only WEP is a candidate for replacement.
- WPA. An early replacement for WEP, now also considered outdated.
- WPA2. Widely used for years, generally regarded as acceptable when combined with a strong passphrase and the AES encryption setting. Some older options, such as TKIP, are weaker, so AES is the setting to prefer.
- WPA3. The newest generation, available on newer routers and devices. Among other improvements, it makes it harder for someone to guess a password by capturing network traffic and trying guesses offline.
Many routers offer a mixed “WPA2/WPA3” mode so that older and newer devices can connect to the same network. This is a common, practical choice. In a mixed mode, the older devices still use the older protections. If every device you own supports WPA3, a WPA3-only setting is the stricter option, but some older gadgets will not connect to it. If a device cannot join after a change, check its specifications before assuming something is broken.
Whichever mode you pick, the router needs to receive security fixes, which is another reason router firmware matters.
Choosing a good Wi-Fi password
The Wi-Fi password, often called a passphrase or key, is the main barrier to strangers joining. Sound principles apply:
- Length matters more than cleverness. A long passphrase made of several unrelated words is generally harder to guess than a short string of mixed characters, and is easier to type on a television or console.
- Avoid personal details, such as names, addresses, phone numbers and birthdays, and avoid common phrases.
- Do not reuse a password from an online account.
- Do not keep the factory password forever if it is printed on a sticker. Some manufacturers generate a unique one per unit, which is acceptable, but anyone who has seen the label, including previous owners or installers, knows it.
- Change it if you suspect others know it, for example after a house share ends. This means re-entering it on every device, so a password manager can help you keep a record.
Keep in mind that a Wi-Fi password is not the same as your router’s admin password. They protect different things, and each should be unique.
Other settings worth knowing
- Network name (SSID). A name that does not reveal your surname or address is sensible. Hiding the name provides little real protection and can cause connection quirks, so it is not usually recommended as a security measure.
- WPS. Convenient for connecting a device with a button or PIN, but the PIN method has known weaknesses on some routers, so many people turn it off.
- MAC address filtering. Allowing only listed devices sounds strong but is easy to get around, since device addresses can be copied, and it is awkward to maintain. It is usually not worth relying on.
- Router admin access. Keep the settings page separate from Wi-Fi access with its own strong password.
Guest networks
A guest network is a second Wi-Fi network on the same router, with its own name and password. It typically gives visitors internet access but keeps them apart from your main devices. Settings vary by router, and the option may be labelled “client isolation” or “access to local network”.
Why it helps:
- Visitors do not need your main password. You can share a simpler or temporary one, and change it without reconfiguring your own devices.
- Their devices are kept off your main network. A visitor’s phone or laptop might carry malware you cannot see, or simply be poorly secured. Isolating guests means those devices cannot normally reach your computers, file shares or printers.
- Fewer people know your main password. That limits how many places it could leak from.
- A home for lower-trust gadgets. Some people put cheaper smart devices, such as bulbs, plugs or cameras, on the guest network, so that a flaw in one of them has a harder time reaching laptops and phones. This can interfere with devices that need to talk to your phone or to each other on the local network, so test before moving them. Smart home hubs may also need to reach devices on the local network.
A guest network is not a perfect barrier. Its protection depends on the router doing its isolation properly, and it still needs a decent password and modern encryption. Some routers also let you limit guest speeds or set times when the network is available.
A short checklist
- Choose WPA3 or WPA2/WPA3 mixed mode, or WPA2 with AES if that is all your devices support.
- Set a long, unique Wi-Fi passphrase.
- Use a different, strong admin password for the router.
- Turn off WPS if you do not use it.
- Create a guest network for visitors, and consider it for lower-trust devices.
- Keep router firmware up to date.
No setting makes a network completely safe, and the right balance between convenience and caution differs between homes. These steps are inexpensive, though, and remove many of the easy openings.