A shared Wi-Fi password is fine for a very small office with few devices and low turnover. Once people leave regularly, contractors visit, or you need to know which device connected, per device credentials through 802.1X are worth the setup. Certificates on managed devices give the cleanest result.
The problem with one shared secret
Everyone who knows the passphrase has the same access. When someone leaves, you either change it for everybody or accept that a former employee still has it. Most small teams choose the second option without saying so.
A shared password also tells you nothing in logs. You see a device joined, not who it belongs to.
What 802.1X changes
802.1X moves authentication from a shared secret to an individual credential checked by a RADIUS server. There are three common credential types:
- Username and password, which is easy but exposed to phishing and to evil twin access points if clients do not validate the server.
- Certificates installed on the device, which are strong and tied to that device.
- Identity provider integration, where the RADIUS layer talks to your directory.
The Wi-Fi Alliance describes WPA3-Enterprise as offering higher grade security protocols for sensitive data networks, which is the mode this approach sits in.
When it is worth the effort
Move to 802.1X when any of these are true:
- More than a few dozen people use the network.
- Staff or contractors leave often.
- You need to tie network access to a person or a managed device.
- A customer or auditor asks how you revoke wireless access.
Stay with a strong passphrase when you have a small team, few devices, and a rotation routine you actually follow.
Setup costs to plan for
- A RADIUS service, hosted or cloud based, with its own availability needs.
- A way to issue and revoke certificates, often through device management.
- Client configuration, since mistakes here lead to users clicking through warnings.
- A fallback for devices that cannot do 802.1X, such as some printers.
The last item is where projects stall. Put those devices on a separate network with a passphrase and firewall rules that only allow what they need.
Make clients check the server
Whatever credential type you choose, configure clients to validate the RADIUS server certificate and pin the expected name. Without that check, an attacker can run a copy of your network name and collect credentials. See evil twin access points for how that attack works.
Quick check
Do certificates remove the need for MFA?
Not for everything. A device certificate proves the device. You may still want user MFA for access to applications behind the network.
What happens when a laptop is lost?
Revoke its certificate and the device loses network access without touching anyone else. That is the main operational win over a shared passphrase.
Sources
Last reviewed: 19 October 2026.
