How WPA2 and WPA3 Wi-Fi Security Work: The 4-Way Handshake & SAE (Animated)

Wi-Fi sends everything through the air, where anyone nearby can receive it. WPA2 and WPA3 turn the shared Wi-Fi password into fresh encryption keys for every device. The 4-way handshake is where that happens, and its design explains why weak WPA2 passwords are dangerous.

1. Join the network: beacon, authenticate, associate

The access point advertises itself with beacons. The laptop picks the network and associates with it. Nothing is encrypted yet.

1. BEACON (Wi-Fi access point → everyone on the LAN): Broadcast several times a second to everyone in range, including the attacker.
2. ASSOCIATE (Your laptop → Wi-Fi access point): The laptop asks to join.
3. ASSOCIATED (Wi-Fi access point → Your laptop): Joined, but no traffic is allowed until the handshake proves the password.

Wireshark filter:

wlan.fc.type_subtype == 0x08

2. 4-way handshake: make fresh keys without sending the password

Both sides already share a key made from the passphrase and the network name (the PMK). They swap two random numbers (nonces) and mix everything into a fresh session key (PTK). The password itself never travels.

1. EAPOL 1/4 (Wi-Fi access point → Your laptop): Message 1: the access point’s random number.
2. EAPOL 2/4 (Your laptop → Wi-Fi access point): Message 2: the laptop’s random number, plus a check value (MIC) calculated with the new key.
3. EAPOL 3/4 (Wi-Fi access point → Your laptop): Message 3: the access point proves itself and sends the group key.
4. EAPOL 4/4 (Your laptop → Wi-Fi access point): Message 4: both sides install the keys.
5. DATA (Your laptop → Office network): Traffic is now encrypted over the air.

Wireshark filter:

eapol

3. Weak passphrase: attack: guessing offline

Anyone in range can record a WPA2-Personal handshake without connecting. The recording contains everything needed to test password guesses offline, at high speed, without the network ever noticing. A short or common passphrase will eventually be found.

1. EAPOL 1–4 (Wi-Fi access point → Your laptop): A device joins (or rejoins) the network.
2. OVERHEARD (Your laptop → Attacker nearby): The attacker never transmits anything. Offline, they test guesses against the recording until a weak passphrase matches.

Wireshark filter:

eapol && wlan.bssid == bb:01

4. Wpa3 & strong keys: defence: sae, long passphrases, enterprise

WPA3-SAE replaces the start of the handshake with a key exchange where a recording gives nothing to guess against; each guess needs a live attempt the access point can limit. Use long random passphrases, and WPA2/WPA3-Enterprise (802.1X) for staff.

1. SAE COMMIT (Your laptop → Wi-Fi access point): SAE commit and confirm messages replace the old shared-key check.
2. SAE CONFIRM (Wi-Fi access point → Your laptop): Then the normal 4-way handshake runs with the much stronger key.
3. OVERHEARD (Your laptop → Attacker nearby): The recording no longer helps the attacker.

Wireshark filter:

wlan.fixed.auth.alg == 3

FAQ