Glossary · Networking

WPA2 vs WPA3 (Wi-Fi Protected Access)

WPA2 and WPA3 are Wi-Fi security standards; WPA3 adds stronger password handshakes, protection against offline guessing and better open-network privacy.

Updated October 6, 2026

WPA2 and WPA3 are generations of Wi-Fi Protected Access, the security standards that authenticate devices and encrypt wireless traffic. WPA2 (2004) uses AES-CCMP encryption; WPA3 (2018) keeps strong ciphers but replaces the password handshake and tightens several weaknesses.

Why it matters

In WPA2-Personal, an attacker who captures the four-way handshake can try passwords offline against it, so weak passphrases fall quickly. WPA3-Personal uses SAE (Simultaneous Authentication of Equals), where each guess needs an interaction with the network, and past traffic stays protected even if the password later leaks (forward secrecy). WPA3 also offers Enhanced Open (OWE) for cafe-style networks without a password, and WPA3-Enterprise adds a stricter 192-bit mode. WPA3 support is expected on Wi-Fi 6 certified devices.

Example

A router set to "WPA2/WPA3 mixed" lets a new phone use WPA3 while an old printer stays on WPA2. The network is then only as strong as its weakest allowed mode, so a router set to WPA3 only is more secure but may exclude older hardware.

Common mistakes

  • Choosing short passphrases; length still matters most.
  • Using the obsolete WEP or WPA (original) modes, or TKIP.
  • Leaving WPS push-button or PIN features enabled when not needed.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · Networking802.1X (Port-Based Network Access Control)802.1X is an IEEE standard that blocks a network port until the connecting device authenticates, commonly with a RADIUS server.Glossary · NetworkingAccess Point (Wireless AP)A wireless access point is a device that connects Wi-Fi clients to a wired network, acting as the bridge between radio and Ethernet.Glossary · NetworkingAnycast RoutingAnycast announces the same IP address from many locations, so network routing sends each user to a nearby site and absorbs traffic floods.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.