I Thought I Knew How Wi-Fi Worked. I Didn’t.
It started with a dumb question I couldn’t shake.
I was sitting at my desk, phone connected to Wi-Fi like it has been every day for years, and I suddenly wondered — how does my router actually know it’s me? Like, what’s stopping my neighbor’s phone from just… walking in?
I assumed I knew the answer. Something about MAC addresses. I’d read that somewhere. Turns out I was mostly wrong, and figuring out why sent me down a rabbit hole for an entire evening.
Here’s what I found, explained the way I eventually had to explain it to myself: as a story about a gated society and a very organized security guard.
The guard at the gate
Picture your router as a security guard sitting at the gate of a housing society. Every device that wants in has to get past him first.
You walk up. He asks for ID. You give him the Wi-Fi password.
That’s it. That’s the actual security check.
This was my first surprise — it’s not your MAC address doing the verification. Your MAC address isn’t checked against some global registry of legitimate devices (there isn’t one). The password is the lock and key. On mobile networks it’s your SIM card doing the same job, with secret keys baked into the chip.
MAC filtering exists on some routers, sure, but it’s trivially spoofable and mostly security theater. The password is what matters.
Then he hands you a house number
Once you’re through the gate, the guard says: “Alright, you’re House #42.”
That’s your IP address. You didn’t pick it — it was handed to you the second you walked in. There’s a protocol behind this called DHCP, but honestly, “guard hands you a house number” covers it.
And then he writes something in his notebook:
Code
A4:5E:60:F2:3B:9C → House #42
That first bit is your MAC address — a permanent ID your device was born with at the factory. It’s not a credential. It’s a name tag. The guard only uses it after you’ve already proven yourself, so he can keep track of who lives where.
That distinction took me embarrassingly long to internalize.
Sending a letter
Now you want to message a friend who lives outside the society.
Get Prerna Mishra’s stories in your inbox
Join Medium for free to get updates from this writer.
You don’t walk out and deliver it yourself. You hand it to the guard: “Send this out for me.”
He takes it, and — this is the important part — makes a mental note: if a reply comes back, it belongs to House #42.
Later, the reply shows up at the gate. Guard checks his notebook. Finds #42. Delivers it. Done.
That’s the whole local loop, and it happens thousands of times a second without you ever thinking about it.
But here’s what I hadn’t considered
The guard doesn’t know every address on Earth.
So how does your little society connect to the rest of the world? This is where I realized my mental model had a giant hole in it.
If you’re on home Wi-Fi: your router isn’t floating in space. There’s a physical cable — fiber or coax — running out of your building into your ISP’s network. Your router hands the letter to that line, and your ISP takes over.
Your ISP is basically a regional postal hub. It doesn’t know every address either. It just knows the next hub to forward to. And that hub knows the next one. And so on, hopping across the planet — this is routing, driven by routing tables and a protocol called BGP — until your letter reaches whatever server your friend’s messages live on.
If you’re on mobile data: there’s no Wi-Fi guard. Your phone talks straight to a cell tower over radio. No password — your SIM proves who you are instead, using cryptographic keys stored inside it.
That tower is wired (usually fiber) back to your carrier’s core network — their own enormous sorting facility. From there? Exactly the same story. Hand off to the wider internet, hop, hop, hop, arrive.
That last row is the part I find genuinely beautiful. Once your data leaves your house or leaves the tower, the rest of the journey is the same. Wi-Fi, 5G, fiber, doesn’t matter. It’s all just routers passing packets to other routers using IP addresses, over and over, until it lands.
So, back to the original question
Does my router know my MAC address is legit?
No. It doesn’t verify legitimacy at all. It trusts the password, then uses the MAC as a label to keep its records straight. The gate is the security. The name tag is just bookkeeping.
Which, when you think about it, is a pretty reasonable design — you don’t need every layer to be a security checkpoint. You just need the right one to be.
The bit I keep thinking about
None of this is magic. It’s a chain of small, boring, extremely well-defined handoffs — prove who you are, take an address, pass it up, pass it along — repeated a few billion times a second across the world.
I’ve been using Wi-Fi for fifteen years and never once wondered about any of it. Now I can’t stop noticing it.
Anyway — if you also assumed MAC addresses were doing the security work, you’re not alone. That’s genuinely why I wrote this down.
