EAP-TLS vs. PEAP: Which Authentication Protocol Is Right for Your Network?

Choose EAP-TLS when you control the devices. Each device proves its identity with a certificate, so there is no password to phish or crack. Choose PEAP when you cannot issue certificates, such as on personal devices, and enforce server certificate validation on every client. Neither suits anonymous guests, so use a captive portal or OpenRoaming instead.

Should you choose EAP-TLS or PEAP?

Both protocols run inside IEEE 802.1X, the standard for port-based network access control. 802.1X makes a device prove who it is before the access point forwards its traffic. That proof travels as EAP (Extensible Authentication Protocol) messages to a RADIUS server, the service that approves or rejects each connection.

EAP-TLS and PEAP are two ways of carrying that proof. The difference is what the device presents.

• EAP-TLS is defined in RFC 5216 and updated for TLS 1.3 in RFC 9190. The server and the device each present a digital certificate. Identity rests on a private key that never leaves the device.
• PEAP (Protected EAP) asks only the server for a certificate. The device builds an encrypted tunnel to the server, then sends a username and password inside it, almost always with MSCHAPv2.

The short recommendation:

• Managed laptops, tablets, scanners and payment devices: EAP-TLS.
• Personal phones and contractor devices you cannot enrol: PEAP, with server certificate validation locked on.
• Guests, fans, passengers and shoppers: neither. Use a captive portal or OpenRoaming through Guest WiFi.

Most estates run both methods on one RADIUS service, separated by device ownership. The rest of this guide shows where that line falls and what each side costs to run.

How do EAP-TLS and PEAP differ in practice?

How the EAP-TLS handshake works

The RADIUS server sends its certificate first. The device checks it against a trusted root certificate authority (CA). The device then sends its own certificate and proves it holds the matching private key.

The server confirms the device certificate is valid and has not been revoked. It checks revocation with a certificate revocation list (CRL) or OCSP (Online Certificate Status Protocol, RFC 6960). Only then does the access point admit the device.

No password crosses the network at any point. A phished password cannot open the network, because the network never asks for one.

How the PEAP handshake works

The RADIUS server sends its certificate and the device validates it. The two sides build a TLS tunnel. Inside that tunnel, the device runs MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2) against a directory such as Active Directory. If the credentials match, the device gets access.

Microsoft, Cisco and RSA Security developed PEAP together. It never became an IETF standard. Microsoft publishes the version most devices use in its MS-PEAP protocol specification.

Why server certificate validation decides PEAP's security

The tunnel protects the password only if the device checks who is at the other end. Skip that check, and an attacker can broadcast your network name from a rogue access point, known as an "evil twin". The device then completes MSCHAPv2 with the attacker and hands over a challenge and response.

In 2012, Microsoft Security Advisory 2743314 warned that unencapsulated MSCHAPv2 exchanges can be cracked. Microsoft's mitigation was to wrap them in PEAP with server certificate validation enforced. That remains the rule today.

EAP-TLS does not share this weakness. A device that reaches a rogue access point has no reusable password to give away.

EAP-TLS vs PEAP side by side

Two platform changes that tilt the decision

Windows. Microsoft's Credential Guard documentation states that MSCHAPv2-based WiFi and VPN connections cannot use saved credentials when Credential Guard is on. Credential Guard is enabled by default on eligible Windows 11 Enterprise and Education devices from version 22H2. Microsoft recommends moving to certificate-based methods such as EAP-TLS.

Android. Recent Android versions removed the option to skip server certificate validation. PEAP profiles must now name a CA certificate and a server domain. That closes the evil twin gap, but it makes manual setup harder for staff.

When is EAP-TLS the right call?

Choose EAP-TLS when three conditions hold. You own the devices, you can push configuration to them, and a compromised password would cause real harm.

• Corporate-owned laptops managed through an MDM (mobile device management) platform such as Microsoft Intune.
• Point-of-sale terminals and handheld scanners on networks in scope for PCI DSS.
• Clinical tablets and carts in Healthcare, where a shared ward password is a standing risk.
• Back-office, front-desk and housekeeping devices in hotels.
• Networks built for WPA3-Enterprise 192-bit mode, which the WPA3 specification ties to EAP-TLS cipher suites.

Certificates also make offboarding precise. Revoke one certificate and one device loses access, while the person's other devices keep working. That maps cleanly to joiners, movers and leavers in your MDM and directory.

Store private keys as non-exportable, in the device's TPM (Trusted Platform Module) or secure enclave where the hardware supports it. A certificate that cannot be copied off the device cannot be reused elsewhere.

Worked scenario: a 30-property hotel group

The scenarios in this guide are composites of common deployments, not named customer results.

Situation. A hotel group runs 30 properties of about 200 rooms each. Back-office laptops, housekeeping tablets and front-desk PCs share one Staff WiFi network. Devices sign in with PEAP using a handful of shared Active Directory accounts. When a tablet goes missing, IT resets the shared password and reconfigures every device that uses it.

What was done. Every device was already enrolled in an MDM. The team stood up a cloud PKI (public key infrastructure, the system that issues and revokes certificates). They pushed device certificates using SCEP (Simple Certificate Enrollment Protocol, RFC 8894). The Staff WiFi profile then switched to EAP-TLS. PEAP stayed live on the same RADIUS service throughout the cutover. Dynamic VLAN assignment placed housekeeping tablets on a different segment from finance laptops.

Outcome. Shared WiFi accounts fell to zero. A lost tablet now costs one certificate revocation instead of a password reset across dozens of devices. Password rotation no longer breaks WiFi, because no WiFi password remains. More on hospitality networks is on our Hotels page.

When is PEAP the right call?

Choose PEAP when you cannot put a certificate on the device and the person signing in has a directory account.

• Staff on personal phones under a BYOD (bring your own device) policy, where MDM enrolment is not acceptable.
• Contractors, temporary event staff and agency workers with short-lived accounts.
• Estates with Active Directory but no PKI, as an interim step towards EAP-TLS.

PEAP is acceptable for these cases only with three controls in place.

1. Lock server certificate validation on every device. Name the trusted CA and the exact server name. Deploy it through Group Policy, an MDM profile or an onboarding tool, never by hand.
2. Keep the server certificate predictable. Issue it from a CA your devices already trust, and keep the server name stable across renewals.
3. Harden the directory password. PEAP is only as strong as the password inside the tunnel. Enforce length, and block known-compromised passwords at the directory.

Worked scenario: a conference centre with seasonal staff

Situation. A city-centre conference and events venue hires around 300 temporary staff each peak season. They use their own phones for rostering and radio apps. The venue cannot ask them to enrol personal phones in an MDM. Until then, a shared WPA2-Personal password hung on the staff room noticeboard.

What was done. IT created a directory account with an end date for each temporary worker. Staff WiFi moved to PEAP. A one-time onboarding profile fixed the CA and server name on each phone. Accounts disable automatically on the contract end date. Attendees stayed on a separate captive portal network.

Outcome. The shared password was retired. Leavers now lose access on their end date, not at the next password change. Every staff connection maps to a named account in the RADIUS logs, which the security team can audit after each event.

What do EAP-TLS and PEAP cost to run?

Neither protocol carries a licence fee. Both are built into Windows, macOS, iOS, Android and ChromeOS. The cost sits in infrastructure and staff time.

Where EAP-TLS spends

EAP-TLS front-loads the cost. You pay for a PKI and the staff time to design certificate templates, enrolment and revocation. If you already run an MDM, much of the delivery cost is covered. After launch, the main recurring task is certificate renewal, which an MDM automates.

Where PEAP spends

PEAP starts cheaply but costs more as you go. Each password change can leave stale credentials on phones and laptops. Repeated failed attempts can then lock the account in Active Directory, which generates a helpdesk ticket. Those costs scale with headcount and password rotation frequency.

Watch the server certificate lifetime

If your RADIUS server certificate comes from a public CA, its lifetime is getting shorter. The CA/Browser Forum's Ballot SC-081 cuts maximum public TLS certificate lifetimes in stages. The limit falls to 200 days from March 2026 and to 47 days from March 2029. Many teams issue the RADIUS certificate from a private CA instead, which keeps renewals on their own schedule.

The cost of getting it wrong

IBM's Cost of a Data Breach Report 2024 put the global average breach cost at USD 4.88 million. Stolen or compromised credentials were among the most common initial attack vectors in that report. EAP-TLS removes WiFi passwords from the attack surface for every device it covers.

Worked scenario: a 120-store retailer

Situation. A retailer runs 120 stores with handheld scanners and mobile point-of-sale devices on PEAP. The devices share a service account. Each scheduled rotation of that account caused overnight authentication failures in stores where devices kept the old password.

What was done. IT moved scanners and payment devices to EAP-TLS, using the MDM it already ran. Each device received its own certificate. Store staff phones stayed on PEAP, on a separate VLAN with no route to the cardholder data environment.

Outcome. Rotation-day outages stopped, because in-scope devices no longer depended on a shared password. Revocation became per device rather than per store. Quarterly rogue access point checks under PCI DSS requirement 11.2.1 continued unchanged. See our Retail page for more on store networks.

What breaks each protocol, and how do you prevent it?

Expired certificates

If the CA certificate or the RADIUS server certificate expires, every authentication fails at once. This affects EAP-TLS and PEAP alike. Set alerts 90, 30 and seven days before each expiry date, and name an owner for every certificate.

Server validation left off

A PEAP profile that skips server validation hands credentials to any evil twin. Audit device profiles regularly and add the check to your security review. Remove any manual setup instructions that tell staff to tap "Don't validate".

RADIUS latency and single points of failure

Authentication sits on the critical path. High latency between controller, RADIUS server and directory causes EAP timeouts. Run RADIUS with redundancy, or use cloud RADIUS with more than one region. For distributed estates such as stations and rolling stock on Trains, place a local RADIUS proxy close to the access points.

Rogue access points

Use the wireless intrusion detection built into your access point platform to flag rogue devices continuously. If you take card payments, PCI DSS requirement 11.2.1 requires you to test for unauthorised access points at least every three months.

A flat network after authentication

A successful 802.1X login should not open the whole network. Use dynamic VLAN assignment, where RADIUS returns the VLAN (virtual LAN) for each device using the attributes defined in RFC 3580. Payment devices, staff phones and building systems then land on separate segments with their own access controls.

How do you decide for your estate?

Start from device ownership, not protocol preference. The matrix below maps common situations to a recommendation.

iPSK (identity pre-shared key, also called PPSK) gives each device or group its own WiFi key on one network name. Use it for devices that cannot run an 802.1X supplicant.

A four-step route to a decision

1. Inventory devices by ownership. Split them into corporate-managed, personal, headless and guest.
2. Check what you already run. An existing MDM makes EAP-TLS for managed devices a modest project.
3. Set the target state. EAP-TLS for every managed device, PEAP only where enrolment is impossible.
4. Migrate in place. Run both methods on one RADIUS service, move managed devices to EAP-TLS, then retire their PEAP profiles.

Where does Purple fit?

Purple is hardware-agnostic. We run as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. There is no rip and replace. Purple layers on top of the network you run today.

For staff and residents, Purple's Identity-Based Networks tie Staff WiFi and Multi-Tenant WiFi access to identity. They work through cloud RADIUS linked to Microsoft Entra ID, Okta or Google Workspace. Joiners, movers and leavers are then handled from the directory rather than by hand. Devices that cannot run 802.1X get iPSK.

For guests, Purple's Guest WiFi offers a captive portal, a web page shown before access, with conscious-choice opt-ins. It also supports OpenRoaming, the Wireless Broadband Alliance federation built on Passpoint (Hotspot 2.0). OpenRoaming lets returning devices join automatically over an encrypted connection. Purple's Connect plan includes an identity provider for OpenRoaming. WiFi Analytics then turns those connections into first-party data on dwell time and repeat visits.

Purple runs across 80,000+ live venues and handled 440 million logins in 2024 (Purple's own data). Purple is ISO 27001 certified, GDPR compliant and Cyber Essentials certified.

Frequently asked questions

Is EAP-TLS more secure than PEAP?

Yes. EAP-TLS authenticates both sides with certificates, so there is no password to phish, guess or capture from a rogue access point. PEAP protects a password inside an encrypted tunnel. Its security depends on every device validating the server certificate. Configured well, PEAP is acceptable for personal devices. For corporate-owned devices, payment terminals and clinical equipment, EAP-TLS removes an entire class of credential attack.

Does PCI DSS require EAP-TLS for wireless networks?

No. PCI DSS v4.0 does not name an EAP method. It requires strong cryptography on wireless networks carrying cardholder data and quarterly checks for unauthorised access points under requirement 11.2.1. It also sets password controls wherever passwords are used. EAP-TLS takes WiFi passwords out of scope for in-scope devices, which shortens your evidence. PEAP can comply too, if server validation and password policy are enforced and documented.

Can we move from PEAP to EAP-TLS without downtime?

Yes. One RADIUS service can accept both methods on the same network name. Each device uses whichever method its profile specifies. Issue certificates and push the new EAP-TLS profile through your MDM, then watch RADIUS logs as devices switch over. When no managed devices still authenticate with PEAP, remove their PEAP profiles. Keep PEAP only for the personal devices you cannot enrol.

Do we need an MDM to run EAP-TLS?

For more than a handful of devices, yes in practice. Every device needs a certificate, a trusted CA and a WiFi profile. Each certificate must also be renewed before it expires. An MDM such as Microsoft Intune automates this through SCEP or a similar enrolment protocol. Without one, an onboarding tool can install certificates on personal devices, but manual installation does not scale beyond a pilot.

What does EAP-TLS cost compared with PEAP?

Neither protocol has a licence fee. The difference is infrastructure and staff time. PEAP needs a RADIUS service, one server certificate and a directory you probably already run. EAP-TLS adds a PKI, in the cloud or on-premises, and an MDM to deliver and renew certificates. If you already pay for an MDM, the extra cost is mainly the PKI. In exchange, WiFi password resets and rotation lockouts disappear.

Will Purple work with the access points we already own?

Yes. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. All of these support 802.1X with an external RADIUS server. Your access points do not limit the choice between EAP-TLS and PEAP. There is no rip and replace: Purple layers on top of the network you run today.

Should guests use EAP-TLS or PEAP?

No. Both protocols assume a known person or a managed device, and hotel, stadium and station guests are neither. Use a captive portal for opt-ins and terms of use. Use OpenRoaming, built on Passpoint, so returning devices connect automatically over an encrypted link. Purple's Guest WiFi covers both, and the Connect plan includes an identity provider for OpenRoaming.

Is PEAP still safe to use in 2026?

Yes, within limits. PEAP with locked server certificate validation and strong directory passwords remains a reasonable choice for personal devices. Its role is shrinking on Windows, where Credential Guard blocks saved MSCHAPv2 credentials. Microsoft recommends certificate-based authentication instead. Plan EAP-TLS for every managed Windows device, and keep PEAP for the devices you do not control.