If you've bought a router in the past few years, you've likely seen "WPA3" mentioned. WPA3 is the current generation of WiFi security, replacing WPA2 — but what actually changed, and does it matter for your home network? This guide explains both protocols in plain English and tells you whether you need to upgrade.
A brief history of WiFi security
- WEP (1997) — Wired Equivalent Privacy. Completely broken. Crackable in minutes with freely available tools. Never use WEP.
- WPA (2003) — Wi-Fi Protected Access. A temporary fix for WEP's failures. Vulnerable to several attacks.
- WPA2 (2004) — The dominant standard for 18 years. Uses AES-CCMP encryption. Secure if used with a strong password, but vulnerable to offline dictionary attacks.
- WPA3 (2018) — Current standard. Eliminates offline attacks, adds forward secrecy, and improves security for weak passwords.
How WPA2 works (and where it fails)
WPA2-Personal (the home version) uses a Pre-Shared Key (PSK) — your WiFi password. When a device connects, it performs a 4-way handshake with the router to prove it knows the password without transmitting the password itself.
The vulnerability: an attacker within range can capture this handshake — a 4-packet exchange that's broadcast over the air. They then take this handshake offline and run it through a password-cracking tool (Hashcat, Aircrack-ng) that tests millions of guesses per second until one produces a matching result.
WPA2 offline attack speed (approximate):
The 4-way handshake data is public — anyone sniffing network traffic can capture it. The security depends entirely on your password being too long to brute-force.
How WPA3 fixes this
WPA3-Personal replaces PSK authentication with SAE (Simultaneous Authentication of Equals), also called "Dragonfly." SAE is a password-authenticated key exchange protocol that provides two critical improvements:
1. No offline attacks
SAE requires an interactive exchange with the router for every authentication attempt. An attacker cannot capture a handshake and test passwords offline. Every guess requires active communication with your router, which makes large-scale brute-force attacks impractical — most routers rate-limit or block repeated failed attempts.
2. Forward secrecy
WPA2 uses the same session key derivation for all connections. If an attacker records encrypted traffic today and later discovers your password, they can decrypt all that historical traffic.
WPA3 generates a unique session key for every connection through Diffie-Hellman key exchange. Even if your password is later compromised, recorded traffic from previous sessions cannot be decrypted. This property is called Perfect Forward Secrecy (PFS).
WPA2 vs WPA3 comparison
| Feature | WPA2 | WPA3 |
|---|---|---|
| Authentication | PSK (Pre-Shared Key) | SAE (Dragonfly) |
| Offline attacks | Vulnerable | Not possible |
| Forward secrecy | ❌ No | ✅ Yes |
| Weak password protection | Poor | Better (but strong passwords still recommended) |
| Encryption | AES-CCMP (128-bit) | AES-GCMP-256 (256-bit) |
| Open network protection | ❌ None | ✅ OWE (opportunistic encryption) |
| Enterprise features | WPA2-Enterprise (802.1X) | 192-bit security suite |
| Router support | Universal | Routers from ~2018+ |
Known vulnerabilities in WPA3
WPA3 isn't perfect. Researchers discovered the Dragonblood vulnerabilities (2019) in early WPA3 implementations, including side-channel attacks that could allow password recovery under specific conditions. These were patched in updated router firmware. WPA3 also introduced transition mode (WPA2/WPA3 mixed) which can introduce downgrade attack vulnerabilities.
Despite these issues, WPA3 with updated firmware is significantly more secure than WPA2 — particularly for the offline attack scenario that affects WPA2.
Should you upgrade to WPA3?
✅ Enable WPA3 if your router supports it
Most routers from 2019+ support WPA3. Check Settings → Wireless → Security Mode. If WPA3 is available, enable it (or WPA2/WPA3 transition mode for compatibility with older devices).
✅ Use a strong password regardless
Even with WPA3, a 16+ character random password is important. WPA3 limits the rate of guessing attempts, but a strong password eliminates even theoretical risk.
⚠️ Older devices may not support WPA3
Devices manufactured before 2019 often don't support WPA3. Use WPA2/WPA3 transition mode to support both, or keep WPA2 with a very strong password (16+ characters, mixed types).
Generate a strong WiFi password
Our WiFi Password Generator creates strong random passwords optimised for WPA2 and WPA3 networks. Even on WPA2, a 16-character random password makes offline attacks infeasible.
Frequently asked questions
How do I check if my router supports WPA3?
Log into your router's admin interface (usually 192.168.1.1 or 192.168.0.1 in a browser), navigate to the wireless security settings, and look for WPA3 or SAE in the security mode dropdown. You can also check your router model on the manufacturer's spec page.
Is WPA2 with a strong password still safe?
Yes, for practical purposes. A 16-character random password using mixed character types would take billions of years to brute-force even with offline GPU attacks. WPA3 provides additional protection (forward secrecy, no offline attacks at all), but WPA2 with a genuinely random password remains secure.
What is WPS and why should I disable it?
WPS (Wi-Fi Protected Setup) is a feature that lets devices connect by pressing a physical button or entering an 8-digit PIN. The PIN method has a known brute-force vulnerability that allows attackers to guess it in hours. Disable WPS in your router settings regardless of whether you use WPA2 or WPA3.
Does WPA3 make my password less important?
No. WPA3 eliminates offline brute-force attacks, but you should still use a strong random password of 16+ characters. WPA3 prevents attackers from testing millions of guesses offline, but a weak password like 'sunshine123' is still trivially guessable by someone who tries common passwords interactively.