Which hostapd (wpad) is best in 2026

Installing and Using OpenWrt Network and Wireless Configuration
1

Can't seem to find an answer to this, other than Gemini which says hostapd-openssl and I know Gemini likes to be confidently incorrect sometimes.
As I don't have a need for wpa_supplicant on my access points, I have chosen to use hostapd (currently hostapd-mbedtls), but could someone advise me which is the recommended package for a device that doesn't really have any resource constraints?

So, hostapd-openssl, hostapd-wolfssl or hostapd-mbedtls?

The reason for my question is that I am using wpa_psk_file for a WPA2 station and am having problems with a dedicated WPA3 station

2

Well, none of them is the "best" as they are all just variants of the same code compiled with different options and linked against different ssl libraries.

You pick one based on your needs: if you have libmbedtls already installed for use by LuCI and apk, then might as well go with one of the mbedtls variants. If you need EAP or RADIUS, then you go with one of the "full" variants, not basic or mini.

3

Thank you for your reply @efahl. I understand the difference between mini and full versions.
If there is no "best" option, why do the variants exist?

4

So you can pick one that best fits the install environment. If you have a tiny flash device, you probably use libmbedtls and thus need to pick all the tools that are built against that. If you have lots of space and want to stick with the "proven standard", you go with openssl and all that entails.

$ apk query libwolfssl5\* libmbedtls21 libopenssl3 --fields name,file-size
# 3 items
- name: libmbedtls21
  file-size: 339011
- name: libopenssl3
  file-size: 2550563
- name: libwolfssl5.9.2.e624513f
  file-size: 634657
5

OK, but if they all do the same job, why go for a bigger package over a smaller one?
To put it another way, what is the benefit of hostapd-openssl over hostapd-mbedtls if they both do exactly the same job?

6

Some packages are built against some libraries and that can dictate your choices. For example, there's no apk-wolfssl variant, so if you use wpad-wolfssl and any variant of apk, you'll have to live with somewhat redundant ssl libraries installed.

7

So for example, openssl has broader adoption, therefore if you plan on using many packages that rely on ssl, it would be wiser to install openssl rather than having multiple ssl libraries. However, if you have space constraints and are therefore not planning on using many other packages that rely on ssl, mbedtls would be a better option?

The core features of hostapd remain the same however, with regards to its capabilities?

8

The key here is " doesn't really have any resource constraints"

The OpenWrt default is wpad-basic.mbedtls.
This supports all the usual AP<>Client encryption types.

The other mbedtls options are:
wpad-mesh-mbedtls supporting everything in "basic", with the addition of 802.11s mesh sae encryption.

and

wpad-mbedtls, supporting absolutely every option, including OWE (Opportunistic Wireless Encryption), very useful for public wireless networks.

OpenWrt's standard is mbedtls.
If you have no resource limitations, the best choice is wpad-mbedtls.
And as you have no resource limitations, if you also need, say, openssh-sftp-server, then no problems. Just do it.

So the answer to Which hostapd (wpad) is best in 2026, for your criteria, is wpad-mbedtls

9

I am with @hedzwillroll , my router has enough flash space and I use a lot of packages and are relying on openssl, so I use wpad-openssl.
Some other packages which use mbedtls (e.g. (lib)curl, apk ) I moved over to openssl, so no mbedtls for me but only openssl.
This is the most feature rich and for me the best option :slight_smile:

10

Presumably, mbedtls being the default because of it's smaller size? Or is there another reason why OpenWrt prefers mbedtls?

11

Probably because of size otherwise I would prefer OpenSSL as default

12

Please keep in mind that when OpenWrt started, 4 mb flash rom was luxury

Just a few years ago 8mb was dropped from support.

The project tries to support as many different even low budget devices for as long as possible.
As these kind of routers are 99% of the time embedded devices the overall footprint is minimized.

Course on my x86 router I also just do not care and just use the package which fits best. But on my old access points I choose the most minimal possible package combinations...