802.1X is an authentication standard that asks every device connecting to a corporate network — wireless or wired — "who are you?" before letting it in. This guide explains what 802.1X actually is, how EAP-TLS proves identity with a certificate instead of a password, how WPA2-Enterprise differs from WPA2-Personal (a shared password), and what role a RADIUS server plays in all of it.

What is 802.1X, in short?

802.1X is the authentication standard that asks every device wanting onto a corporate network "who are you?" at the network door — on wireless, the access point asks the question; on a wired connection, the switch asks it. Whichever one is asking does not judge the answer itself: it checks with a RADIUS server behind the scenes, and access opens only if that server confirms the identity, staying closed otherwise. It applies on the wired side too: a laptop plugged into an office Ethernet port goes through the same RADIUS check via the switch. EAP-TLS is the protocol that decides how identity gets shown at that door: instead of a username and password, the device presents a digital certificate installed on it, which removes the risk of a password being stolen, shared, or forgotten. WPA2-Enterprise is simply the name 802.1X takes on wireless networks; its difference from WPA2-Personal, where everyone connects with one shared passphrase, is that every user is authenticated individually with their own identity.

How does 802.1X authentication actually work?

Three parties are involved: the connecting device (the supplicant), the access point or switch asking the question (the authenticator), and the RADIUS server that judges the answer. In practice:

  • The device tries to connect to the network — wireless or wired.
  • The access point or switch asks the device to prove its identity; no real network traffic is allowed through before this step.
  • The identity the device presents (a certificate, in EAP-TLS) is forwarded to the RADIUS server.
  • If the RADIUS server confirms the identity, access opens; if it can't, the connection is rejected.

The result: you always know exactly who connected, with which device, and when — not some anonymous "someone" hiding behind a shared password.

EAP-TLS: a certificate instead of a password

EAP-TLS is the protocol 802.1X uses at the authentication step, and it decides how identity gets "shown." Password-based methods send a piece of text that can be stolen, guessed, or shared. EAP-TLS instead uses a digital certificate already installed on the device, proven with a cryptographic signature. The certificate is tied to a specific person and device — copying it onto another device isn't as simple as telling someone a password. When someone leaves, the only thing that needs to happen is revoking that one certificate; access closes immediately, and there's no shared password left to change.

WPA2-Enterprise vs WPA2-Personal: what's the difference?

WPA2-Personal is the model used at home and in most small businesses: one passphrase is generated, and everyone connecting types the same one. The network knows the right password was entered — not who entered it. WPA2-Enterprise brings 802.1X into play instead: rather than one shared passphrase, each user is authenticated with their own identity (their own certificate, under EAP-TLS), verified by a RADIUS server behind the scenes.

The practical difference shows up here: with WPA2-Personal, once one person knows the password, everyone who has it shares the same access, and there's no way to tell who did what. With WPA2-Enterprise, every session is tied to one user — when someone leaves, only their identity is revoked, and everyone else's access continues unchanged.

What is a RADIUS server, and what does it do?

RADIUS (Remote Authentication Dial-In User Service) is the "referee" server in the 802.1X flow. The access point or switch never judges an identity on its own — it forwards it to the RADIUS server. That server checks the identity against a directory (such as Active Directory/LDAP) or its own records, returns an "accept" or "reject," and typically logs who connected and when along with that decision. In short, RADIUS is what lets every authentication decision on the network come from one consistent, central place.

The practical problems with a shared password

WPA2-Personal's simplicity on paper turns into a real operational burden as a business grows:

  • Sharing goes unchecked. The password ends up in a group chat, a sticky note, someone's phone — no one really knows who has it.
  • Rotation affects everyone. Change the password, and dozens of connected people need the new one delivered to them one by one.
  • A departing employee is a risk. When someone leaves, the shared password they knew stays valid — their access effectively continues until it's changed.
  • Who did what stays unclear. With logging tied to a shared account, there's no way to tell which of the dozens of people connected at once performed a given action.

How Useroam handles this

The Staff WiFi module in Useroam Cloud Connector sets up the 802.1X / WPA2-Enterprise / EAP-TLS flow described above, ready to go on the organization's own network. Staff identity can be synced from Active Directory/LDAP or added manually in the panel — AD is not required. During onboarding, staff enter their username and AD password (or one you gave them) exactly once; at that point a per-user certificate installs on the device, and they're never asked for a password again. Onboarding is supported on iOS, macOS, Android and Windows; on iOS and macOS the profile installs with one tap. Wireless and wired connections are identified with the same certificate, and every session is logged per user. See the Staff WiFi page for details.

Frequently Asked Questions

What does 802.1X mean?

802.1X is a standard that requires every device connecting to a corporate network to prove its identity at the network door. The access point asks on wireless, the switch asks on wired, and a RADIUS server judges the answer.

What is 802.1X authentication?

It's the process where a connecting device is asked to prove its identity (a certificate, under EAP-TLS) by the access point or switch, that identity is forwarded to a RADIUS server, and access opens or is refused based on the server's decision.

WPA2-Enterprise vs WPA2-Personal — what's the difference?

WPA2-Personal uses one shared passphrase for everyone, with no way to tell users apart. WPA2-Enterprise uses 802.1X: each user is authenticated individually, with a RADIUS server verifying their own identity.

Is there such a thing as passwordless WiFi authentication?

Yes — with 802.1X and EAP-TLS, a device authenticates with a certificate installed on it instead of a password. In Useroam's Staff WiFi module, staff enter a password once during onboarding to install that certificate, then connect automatically without ever being asked for one again.