WPA2 vs WPA3: what's the difference and which should you use

Short answer: WPA3 replaces the handshake WPA2 uses to prove you know the WiFi password, closing off an offline guessing attack that’s always been possible against WPA2. If your router and your devices both support WPA3, turn it on. If not, a strong WPA2 password is still reasonably secure.

What actually changed

WPA2 has protected home WiFi networks since 2004, and the encryption it uses to scramble traffic once you’re connected — AES — hasn’t been the weak point. The weak point is the handshake: the exchange a device and router go through to confirm the device knows the password. With WPA2, an attacker who captures that handshake can take it away and try to crack the password offline, guessing as many times as they want with no rate limit and no risk of getting locked out.

WPA3 replaces that handshake with a different method, called SAE (Simultaneous Authentication of Equals). Each login attempt requires talking to the router directly — there’s no handshake to capture and crack later. Guess wrong, and you have to try again against the live router, which can throttle repeated failures. That single change removes the most practical way networks like this get broken into.

WPA3 also adds forward secrecy: even if someone eventually learns your password, they can’t decrypt WiFi traffic they captured in the past. Under WPA2, a leaked password can retroactively unlock old captured traffic. Under WPA3, each session generates its own encryption key, so old traffic stays unreadable.

Do you actually need it

For most households, the real risk WPA2 carries is small — someone has to be within WiFi range, capture your handshake, and then spend real computing time cracking a good password. A long, non-dictionary WiFi password makes that impractical regardless of which protocol you’re on. WPA3 removes the attack rather than just making it slower, which matters more if you live somewhere dense (an apartment building, a shared office) where a lot of strangers are in range.

It also matters more if your password isn’t that strong to begin with. A short password or a real word with a number tacked on is exactly what an offline WPA2 crack is built to find. WPA3 takes that shortcut away from an attacker even when the password itself is weak, which is the scenario where the two protocols diverge the most.

Checking or changing yours

Open your router’s admin page — find the address and log in if you haven’t already — and look for a section called Wireless Security, WiFi Security, or similar. The security-protocol dropdown usually lists options like WPA2-Personal, WPA3-Personal, and a mixed WPA2/WPA3 mode.

• Router and all your devices support WPA3: pick WPA3-Personal.
• Not sure, or you have older gadgets (smart plugs, an older laptop, a games console): pick the mixed WPA2/WPA3 mode. Newer devices connect with WPA3, older ones fall back to WPA2, and nothing gets locked out.
• Router doesn’t offer WPA3 at all: it’s an older model. WPA2-Personal (AES) is still the correct choice — just avoid WEP or WPA (no number), both of which are broken and shouldn’t appear as options on anything sold in the last decade.

Exact menu names vary by brand, and some manufacturers only added WPA3 support in a firmware update rather than at launch, so check for a pending update if you don’t see it listed. The router login directory has per-model admin pages if you need help finding yours.

After switching

Changing the security protocol disconnects every device on the network, the same as changing the password itself — each one needs to rejoin under the new setting. If an older device fails to reconnect after you switch to WPA3-only, that’s usually the sign it doesn’t support WPA3 yet, and mixed mode is the fix.