How WiFi Security Works (and Breaks)

The password never travels — so why is a weak one still risky?

WPA2-PSK never sends your WiFi password over the air. Instead the access point (AP) and the client prove they both know it through a math handshake. The weakness is that an eavesdropper can record that proof once and then test candidate passwords offline against it — with no further contact with the network and no rate limiting. A long random passphrase stays safe; a short or dictionary one does not.

The modern variant is the PMKID value: on some APs a single frame from the AP already contains enough material to attempt the same offline guessing, without any connected client. Understanding this is what lets you judge your own network's exposure and choose the right defence (WPA3, long PSK, or enterprise auth).

Safe practice setup

• Practise only on a WiFi network you own, or one you have explicit written permission to test. Capturing or cracking anyone else's WiFi is illegal in most countries.
• This course needs no radio and no attacks on live networks: every exercise is a small self-contained calculation you run on your own computer (Python 3) against values you create.
• Use an isolated test AP (an old home router or a spare travel router) if you want to see real frames — never a neighbour's or a workplace network without authorisation.
• Throughout we use documentation-only identifiers: example SSID MyLab-AP and locally-administered MAC addresses like 02:00:00:00:00:01.

Solution (try the challenge first)

A login form checks guesses online against a server that can rate-limit or lock the account. A captured handshake is checked offline: the attacker already holds the proof and computes guesses locally at full speed, so there is nothing to rate-limit them. That is exactly why passphrase length and randomness — not lockout policy — are what protect WPA2-PSK.