WPA2/WPA3 4-Way Handshake Animation

Step through Wi-Fi EAPOL-Key messages, nonce exchange, PTK derivation, GTK delivery, and WPA2/WPA3 risk differences

A guided WPA2/WPA3 4-way handshake workbench that shows what each EAPOL-Key frame carries, which secrets never travel, and how capture, replay, and password strength affect security.

Animation Wi-Fi Security

WPA2/WPA3 4-Way Handshake

Step through the EAPOL-Key exchange between a client and an access point. Watch nonces, MICs, PTK parts, GTK delivery, replay counters, and WPA2/WPA3 risk notes stay synchronized.

M1: ANonceActive frame

Client derivesPTK state

GTK pendingGroup key state

WPA2-PSKSecurity lens

Goal

Understand what the four messages prove and install.

Try First

Step from Message 1 to Message 4 and watch when each side can derive the PTK.

Watch

Password and PMK never travel. MICs prove possession of derived keys.

Why It Matters

A captured WPA2-PSK handshake can test weak passphrases offline; WPA3-SAE changes that setup.

Security Mode

Choose the Wi-Fi security setup before the 4-way handshake.

Study Lens

Choose what risk or behavior to inspect.

Playback

Play speed 900 ms

Risk Knobs

Passphrase strength Medium

Captured frames 0 of 4

Replay attempt 0

Message 1: the AP sends ANonce and a replay counter. The client can now build the PTK after generating SNonce.

ANonce travels.Visible over the air

Password and PMK stay local.Never transmitted

Client is preparing PTK.Current meaning

EAPOL-Key Exchange

Packets move between AP and client. The key ladder below shows which material is known, derived, verified, or installed at each step.

Stage 2 of 5 Message 1 -> ANonce

Frame Detail

The selected frame explains what is sent and what security property it gives.

Mode Meaning

Shows what happened before the 4-way exchange starts.

PSK-derived PMK

Key Ladder

Shows which key pieces are used for proof, wrapping, and data encryption.

PTK forming

Threat Lens

Shows how capture, weak passphrases, and replay counters change the lesson.

normal join

Beginner Ramp

The 4-way handshake does not send the Wi-Fi password. It confirms that both sides can derive the same session keys from shared setup material and fresh nonces.

Formula Reference

• WPA2-Personal PMK = PBKDF2(passphrase, SSID, 4096 rounds, 256 bits).
• PTK = PRF(PMK, label, AP MAC, client MAC, ANonce, SNonce).
• PTK is split into KCK for MICs, KEK for wrapping keys, and TK for data encryption.

WPA2 vs WPA3

WPA2-PSK starts from a PMK derived from the password and SSID. WPA3-SAE first performs a password-authenticated exchange that resists offline dictionary checks and gives forward secrecy.

MIC and Replay

The MIC proves the sender has the KCK without revealing it. Replay counters stop old EAPOL-Key frames from being accepted as fresh messages.

PTK and GTK

PTK protects unicast traffic between one client and the AP. GTK protects group and broadcast traffic and is delivered to the client encrypted in Message 3.

Deployment Clue

Strong passphrases, WPA3-SAE where supported, protected management frames, and current firmware reduce common Wi-Fi onboarding and capture risks.

Practice 1

Step from Message 1 to Message 4. At which message does the AP verify that the client has the same PTK?

Practice 2

Select Captured Handshake, set captured frames to 4, and lower passphrase strength. Why does WPA2-PSK become risky?

Practice 3

Select WPA3-SAE, then use Replay Attempt. What changes in the threat note, and what stays true about the 4-way messages?

Related Study

Wi-Fi FundamentalsReview Wi-Fi standards and security modes. IoT Network SecurityConnect handshake behavior to device security. Encryption ArchitectureSee where link encryption fits in layered security. Packet AnalyzerPractice reading protocol fields in captured traffic.