Wi-Fi Security Compatibility Explorer

Will this client join this SSID, and how securely? See the AKM, cipher and PMF being agreed, where a join fails, and who each WPA2, WPA3, Enhanced Open, 6 GHz or Wi-Fi 7 setting locks out.

How to use this tool controls and what to look for

Set up the SSID and the client, and see the AKM, cipher and PMF being agreed, where a join fails, and who can join.

Controls to change

  • Personal (password): choose the SSID's security from the Personal (password), Enterprise (802.1X) or No password modes, including transition modes.
  • Band: choose 2.4, 5 or 6 GHz.
  • PMF: set Protected Management Frames on the SSID to Disabled, Capable or Required.
  • Wi-Fi 7 (EHT/MLO) on: turn on Wi-Fi 7 and its stricter security rules.
  • Client: pick a client, from an old WPA2 laptop to a Wi-Fi 7 laptop or an IoT sensor, and set its Client PMF.

What to look for

  • The client picks an AKM and a cipher from what the AP offers. With nothing in common, the join fails.
  • PMF Required on the AP locks out clients that can't do PMF.
  • WPA3 transition mode lets older clients still connect with WPA2.
  • 6 GHz and Wi-Fi 7 allow only WPA3, Enhanced Open and PMF, so older security modes are refused.

Open full screen ↗

About this tool

Will this client join this SSID, and how securely? Choose a security mode for the network, from WPA2-Personal and WPA3 transition mode to WPA3-Enterprise 192-bit and Enhanced Open, the band and whether Wi-Fi 7 is on, then pick a client or set its capabilities yourself. The tool shows how the AKM, the cipher and protected management frames are agreed from the RSN element, the security the client ends up with, and, if it fails, exactly where and why. A matrix shows every mode against every example client, so you can see who a setting locks out.

What you'll learn

  • How a client picks an AKM and a cipher from what the AP advertises
  • How the MFPC and MFPR bits decide whether PMF is used, and when a join fails
  • What WPA3 transition mode does, and why older clients still connect with WPA2
  • Which security modes 6 GHz and Wi-Fi 7 allow

Common questions

Why can't my old device join a WPA3 network?
A WPA3-Personal only network offers only SAE and requires protected management frames. A device that supports neither has nothing in common with it, so it can't join. Transition mode also offers WPA2-PSK, so older devices connect with WPA2 while newer ones use WPA3.

What does PMF required mean?
The AP sets MFPR to 1, so every client must protect management frames such as deauthentication. A client without PMF doesn't try to join, and an older one that tries is rejected with status 31, robust management frame policy violation.

Which security can I use in 6 GHz?
WPA3-Personal with SAE, WPA3-Enterprise or Enhanced Open (OWE), always with PMF required. IEEE 802.11 doesn't allow PSK or open networks in 6 GHz, and the Wi-Fi Alliance doesn't allow transition modes there.

Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.