WPA2 vs WPA3: the differences and which one to use

WPA2 and WPA3 are the two Wi-Fi security standards in use today. Both encrypt traffic between a device and the router with AES. The difference is how a device proves it knows the password, and what an attacker can do with a recording of that exchange. WPA3 closes the main weakness of WPA2’s home mode: with WPA2, someone in radio range can record a single login and try password guesses against it offline. With WPA3 they cannot. The catch is compatibility. Many older laptops, printers, cameras, smart plugs and other small devices only support WPA2, and switching a router straight to WPA3 can leave them offline. The table below sets out the differences; the sections after it explain each one and end with which setting to use. The smart home hub collects the rest of the guides on choosing and connecting devices.

WPA2 vs WPA3 at a glance

What WPA2 is

WPA2 arrived in 2004, built on the IEEE 802.11i amendment, and became mandatory for devices carrying the Wi-Fi CERTIFIED logo in 2006. It encrypts traffic with AES. In its home form, WPA2-Personal (also shown as WPA2-PSK), every device joins with the same pre-shared key derived from the network password. In its business form, WPA2-Enterprise, each user or device logs in with its own credentials through a RADIUS server.

What WPA3 is

WPA3 was announced by the Wi-Fi Alliance in 2018 and has been required for new Wi-Fi CERTIFIED devices since July 2020. It keeps AES encryption and changes three things:

• A new login for passwords. WPA3-Personal (also shown as WPA3-SAE) uses Simultaneous Authentication of Equals instead of the pre-shared key handshake.
• Forward secrecy. Each session gets fresh keys, so learning the password later does not unlock traffic recorded earlier.
• Protected management frames. The control messages that tell a device to disconnect or reassociate are authenticated, which blocks the forged “disconnect” messages that many Wi-Fi attacks start with. WPA2 networks can use this too, but only as an option.

The weakness WPA3 fixes

With WPA2-Personal, a device and the router prove to each other that they share the password through a four-way handshake. Anyone within radio range can record that handshake, and it contains enough information to test password guesses against it. The attacker does not need to stay nearby or talk to the router again: they take the recording away and try millions of guesses on their own hardware. A short or common password falls quickly; a long random one does not.

SAE removes that offline step. The exchange is built so that a recording of it reveals nothing to test guesses against; each guess requires a new live attempt with the router, which is slow and visible. A weak password is still a bad idea, because a determined attacker can keep trying online, but the cheap offline attack is gone.

Is WPA2 still secure?

Yes, with two conditions. The password has to be long and random, because that is what makes the offline guessing attack impractical, and the router and devices need current firmware. In 2017 the KRACK research (krackattacks.com) showed that the WPA2 handshake could be manipulated to reuse keys. That was fixed by software updates on devices and routers, not by WPA3, so an unpatched device is the weaker link, whatever the router is set to.

WPA2 is not deprecated for existing equipment, and most networks still run it in some form. It is the older standard: new certified devices must support WPA3, and the 6 GHz band does not allow WPA2 at all. If a router offers WPA3 and every device supports it, there is no reason to stay on WPA2. If a router offers only WPA2, use WPA2-Personal with AES (never TKIP or the older WPA), a password of 20 characters or more, and current firmware, and plan to replace the router when it stops receiving updates.

Disadvantages of WPA3

• Compatibility. The main drawback. Devices certified before July 2020, and many inexpensive Wi-Fi chips since, support only WPA2. A WPA3-only network locks them out.
• Transition mode keeps WPA2’s weakness. The mixed setting most routers offer still lets WPA2 devices join with the old handshake, so the offline password attack remains possible while any of them are on the network. The details are in the section on transition mode below.
• Early implementation flaws. In 2019 researchers published Dragonblood, a set of weaknesses in early SAE implementations and in transition mode, including side channels and downgrade attacks. They were addressed with software updates and a revised way of deriving the password element, which is one more reason to keep router firmware current.
• A weak password is still weak. WPA3 slows guessing down to one live attempt at a time, but it cannot make “password123” safe.

Does WPA3 slow down Wi-Fi?

Not in normal use. In Personal mode, WPA2 and WPA3 encrypt data with the same AES cipher, so throughput after a device has joined is the same. SAE takes more computation than the WPA2 handshake, but only while a device is joining, and that is rarely noticeable. A drop in speed after switching usually has another cause, such as an older device falling back to a slower connection or failing to join and retrying.

Personal, Enterprise, Enhanced Open and transition mode

Router menus and device settings use these names, often in combinations such as “WPA2/WPA3-Personal”.

WPA3-Personal

One shared password for the network, with the SAE login. This is the home setting. It may appear as WPA3-SAE.

WPA2-Enterprise and WPA3-Enterprise

Each user or device logs in with its own credentials, usually a username and password or a certificate, checked by a RADIUS server through 802.1X. Removing one person’s access does not mean changing the password for everyone. WPA3-Enterprise keeps that model, requires protected management frames, and adds an optional 192-bit mode with stronger cryptography for organizations with strict requirements, such as government and finance. Homes rarely need either.

Enhanced Open

Open networks, such as those in cafés and airports, have no password and were traditionally unencrypted. Wi-Fi CERTIFIED Enhanced Open, introduced alongside WPA3, gives each device its own encryption on such a network, so other people on the same open network cannot read the traffic. It does not check who is connecting; it only stops passive eavesdropping.

Transition mode (WPA2/WPA3 mixed)

Most routers offer a WPA2/WPA3 mixed setting, called transition mode in the standard. The router accepts both: devices that support WPA3 join with SAE, older devices join with WPA2, and both use the same password.

It is the sensible way to start, with one caveat. Because the WPA2 clients still use the old handshake with the shared password, an attacker can record one of them joining and attack the password offline exactly as before, and the password they recover also works for the WPA3 devices. Transition mode protects WPA3 devices from some attacks, but it does not remove the offline password risk while any WPA2 device is on the network. So “WPA3-Personal or transition mode?” comes down to whether every device can join WPA3. If they can, WPA3-Personal alone is stronger. If they cannot, transition mode keeps them connected, and the password has to be strong enough for WPA2.

The 6 GHz band used by Wi-Fi 6E and Wi-Fi 7 allows no WPA2 at all, so a 6 GHz network is WPA3 only.

What happens if you switch your router to WPA3

Phones and laptops from the last few years reconnect normally, sometimes after asking for the password again. Devices that support only WPA2 behave in one of three ways:

• WPA3 only. Switch the router to WPA3-Personal alone and every WPA2-only device drops off and cannot rejoin. Older laptops, printers, game consoles, streaming sticks and most low-cost smart devices are the usual casualties.
• Transition mode still fails. Some older devices cannot join a transition-mode network even though they should be able to use its WPA2 side. The usual cause is how the router advertises management-frame protection, which a few older chips misread. A firmware update for the device sometimes fixes it; otherwise the device needs a plain WPA2 network.
• Setup apps that assume the phone’s network. Many smart devices are set up from a phone app that passes on the network the phone is using. If the phone is on a WPA3 or 5 GHz network the device cannot use, pairing fails without a clear error.

Smart plugs, bulbs, cameras, robot vacuums and appliances are the most common case. They are built around inexpensive Wi-Fi chips, many were certified before WPA3 was required or never received WPA3 support in firmware, and most also need the 2.4 GHz band, as the 2.4 GHz vs 5 GHz guide explains. None of this applies to Zigbee, Z-Wave or Thread devices. They do not use Wi-Fi at all and have their own security, covered in the Zigbee, Z-Wave and Wi-Fi comparison and the Thread border router guide. Only the hub or border router they connect through joins your Wi-Fi.

How to check what your router and devices support

• The router. The wireless security setting in its app or admin page lists the modes it offers. If WPA3 is missing, check for a firmware update; some routers gained it that way.
• A Windows laptop. In the Wi-Fi network’s properties, “Security type” shows WPA2-Personal or WPA3-Personal for the current connection.
• A Mac. Holding the Option key and clicking the Wi-Fi icon in the menu bar shows the security type of the current network.
• A smart device. Look for “WPA3” in the wireless security line of the specification sheet or box. “WPA2” alone, or “WPA/WPA2”, means no WPA3. The router’s list of connected clients sometimes shows the mode in use.
• The Wi-Fi Alliance certification database. Certified products list the security modes they passed.
• After an update. Some manufacturers have added WPA3 in later firmware. Update the device before deciding it cannot join.

A home network setup with older smart devices

The aim is to give phones, laptops and anything else that supports it the full protection of WPA3, without leaving older smart devices stranded or weakening the main network for their sake.

1. Update the router’s firmware first. WPA3 support and the Dragonblood fixes both arrive that way.
2. Set the main network to WPA3-Personal if every device on it supports WPA3, or to WPA2/WPA3 transition mode if a few trusted devices still need WPA2.
3. Create a second network for smart devices that cannot join the main one: WPA2-Personal, 2.4 GHz, and a long random password of 20 characters or more. You type it once per device during setup, so length costs nothing. A long random password is what keeps WPA2’s offline attack impractical.
4. Separate that network from the main one. Many routers offer an IoT or guest network that does this; the better option is a dedicated VLAN with firewall rules, explained in the separate VLAN guide.
5. Move devices across as they gain WPA3. When the IoT network is empty of WPA2-only devices, switch it to WPA3 or retire it.

The rest of the routine, changing default passwords, keeping firmware updated and switching off router features such as UPnP, is in the IoT device security basics.

Which should you use?

WPA3 is better than WPA2 wherever every device can use it. Where they cannot, the strongest protection belongs on the devices that hold your accounts and data, and the plugs and bulbs can sit on their own network until they are replaced. For how smart devices connect and what to check before buying one, start from the smart home guides, including the local-only smart home guide for keeping devices working without the cloud.