RADIUS Authentication Methods Compared: PAP vs CHAP vs MS-CHAPv2 vs EAP
RADIUS only carries credentials. The method you choose decides who gets to see the password along the way and how your AAA server has to store it. Both questions matter more in 2026 than they have in years, because the IETF is now moving to retire some of the oldest methods still running in operator networks. Our new guide compares the four main RADIUS authentication methods side by side and explains where each one still belongs. It starts with PAP and CHAP, the two methods inherited from PPP that still dominate PPPoE broadband. CHAP keeps the password off the wire, so it has long been treated as the safer option. To verify a login, though, the AAA server must keep every password in reversible form, which means one stolen password store exposes every subscriber. PAP lets you keep salted hashes instead. That’s why the latest IETF RADEXT draft now recommends PAP over CHAP when you judge the system as a whole, as long as the RADIUS link is protected. MS-CHAPv2 gets a harder verdict...