What is the difference between PAP and MSCHAPv2 authentication?

Looking at picking a RADIUS protocol for authentication with Microsoft NPS and trying to understand to pros / cons for PAP and MSCHAPv2.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15, 2017 at 2:58

2 Answers 2


PAP uses a two-way handshake for authentication, CHAP uses a three-way handshake for authentication, and MS-CHAPv2 adds mutual authentication.

How you actually configure these depends on your router model, which you have not detailed in your question.


PAP sends the password to the RADIUS server (encrypted on the wire by the Radius protocol, but it is still decrypted on the server), MSCHAPv2 does not, it uses a challenge/response mechanism.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.