What Is WPA3 and How Does It Differ From WPA2? | SAE And PMF

WPA3 is the Wi-Fi Alliance’s newer security standard, adding SAE logins and mandatory protected management frames on top of WPA2.

WPA3 arrived in 2018, and the Wi-Fi Alliance has required it in newly certified devices since 2020. Both standards encrypt the traffic between your laptop and your router, so the difference sits in the password exchange and in how much a snooper can pull out of it.

Here’s what changed, which gear supports it, and where the setting hides on your router.

How WPA3 Differs From WPA2: The Changes That Matter

WPA3 keeps WPA2’s core job of scrambling wireless traffic, but swaps out the password handshake and forces protection onto management frames that WPA2 left optional.

The headline change is SAE, or Simultaneous Authentication of Equals. WPA2-Personal authenticates with a pre-shared key, and one captured handshake is enough to attack the password offline: record the exchange, then grind through guesses on your own hardware. SAE is built so a recorded handshake gives an attacker nothing useful to test guesses against. Mandatory Protected Management Frames are the other half, making forged deauthentication frames harder to inject, which is the trick behind a lot of mystery disconnects.

WPA3-Enterprise takes a separate path. It doesn’t replace WPA2-Enterprise protocols wholesale; it tightens policy enforcement and adds an optional 192-bit suite for networks handling sensitive data. That mode needs matching clients, access points, and authentication infrastructure, so home gear doesn’t pick it up by default.

Should You Switch Your Router To WPA3?

Switch if every device on your network supports it. If one older printer, camera, or console doesn’t, run the mixed transitional mode until you retire that device.

Most phones and laptops from the past several years are fine. Apple lists WPA3 support on iPhone 7 and later, iPad 5th generation and later, Macs from late 2013 with 802.11ac or later, Apple TV 4K first generation and later, Apple Watch Series 3 and later, and every HomePod. On Windows, Android, and Linux, it comes down to the adapter, driver, and OS build. The product has to state WPA3 support, because the Wi-Fi generation alone doesn’t guarantee it.

Mixed mode is where people get tripped up. In WPA3-Personal transition mode, WPA2 devices still connect with the same password, but they only get WPA2-level protection. The Wi-Fi Alliance’s WPA3 deployment guide suggests separate network names with different passwords when you want the newer devices fully covered, since a transitional network can leave older clients on weaker footing.

A router that shipped without WPA3 and never received a firmware update won’t grow the feature later. If yours falls in that group, our tested WPA3 Wi-Fi router picks cover the models that handle it without fuss.

Where To Find The WPA3 Setting On Your Router

The control lives in the router’s wireless security menu, usually labeled Security Mode or Encryption. Set it to WPA3 Personal.

1. Log in to the admin interface. The address, often 192.168.1.1 or 192.168.0.1, plus the default username and password sit on the sticker under the router.
2. Open Wireless (or Wi-Fi Settings), then the Security submenu.
3. Set Security Mode to WPA3 Personal. If the only newer-looking option reads WPA2/WPA3 Mixed or Transition, that’s the compromise mode described above.
4. Save, let the router restart, and reconnect each device with the existing Wi-Fi password.
5. If nothing newer than WPA2 appears, pick WPA2-PSK (AES) or WPA2-Personal. Never leave WEP, original WPA, or WPA2-TKIP selected.
6. Change the router’s default admin password, and give the Wi-Fi network a password you don’t reuse anywhere.

Success looks like every WPA3-capable device reconnecting on its own, with the router’s client list labeling it WPA3 instead of WPA2.

Two limits are worth knowing. WPA3 protects the wireless link, not the traffic after it leaves the router, so HTTPS still does the heavy lifting. And SAE makes offline guessing expensive without making a reused password safe, because a password that already leaked elsewhere is still leaked.