WPA3 vs WPA2: Which Should You Use?

Your router's wireless settings screen has a WPA3 toggle now, and every guide you've read says "just turn it on." Then you remember the five-year-old smart plug in the kitchen, and you're not sure what happens if you flip it.

This is the second stop after locking down the rest of your router's settings — wireless encryption is one specific setting on that checklist, but it deserves its own explanation, because "just use WPA3" is correct advice that skips over the one thing that actually trips people up: compatibility. I run a mixed network myself, on the same Proxmox homelab setup referenced in that checklist, precisely because not everything I own supports WPA3 yet.

TL;DR

WPA3 replaces WPA2's handshake with SAE (Simultaneous Authentication of Equals), which blocks offline dictionary attacks against captured Wi-Fi traffic — WPA2's biggest real-world weakness.
If every device on your network supports WPA3, turn it on. There's no real downside.
If even one device doesn't support WPA3, an all-WPA3 network will drop that device silently — no error message, it just stops connecting.
The fix is a WPA2/WPA3 "transition" or "mixed" mode, which most routers from the last few years support, rather than an all-or-nothing switch.
WPA2-AES (CCMP, not the deprecated TKIP) is still genuinely safe for home use if your hardware doesn't support WPA3 at all.

KEY-STAT: 0 — Successful offline dictionary attacks possible against a captured WPA3-SAE handshake — each authentication attempt requires live interaction with the access point, unlike WPA2's PSK handshake.

What actually changed between WPA2 and WPA3

The headline difference is the authentication handshake, not the data encryption itself.

	WPA2	WPA3
Handshake	4-way PSK handshake	SAE (Simultaneous Authentication of Equals)
Offline dictionary attacks	Possible against a captured handshake	Blocked — each guess requires live interaction with the AP
Forward secrecy	No — one leaked password decrypts past captured traffic	Yes — each session uses unique keys, discarded after
Open network protection	None (public Wi-Fi is fully plaintext)	Individualized data encryption even on "open" WPA3 networks
Minimum recommended cipher	AES (CCMP) — never TKIP	AES (CCMP), mandatory

WPA2's weak point was never the AES encryption itself — it's the PSK handshake. If someone captures that handshake (trivial with commodity tools on a network you're already in range of), they can try password guesses against it offline, at whatever speed their hardware allows, with no rate limiting from the router at all. WPA3's SAE handshake closes that specific hole: every authentication attempt requires a live back-and-forth with the access point, so there's nothing useful to capture and crack later.

The compatibility trap nobody warns you about

I found this out the annoying way. After setting my router to WPA3-only following the same "just turn it on" advice everyone gives, a smart plug I'd had running for three years quietly stopped showing up on the network. No error, no log entry pointing at Wi-Fi — it just went offline, and I spent twenty minutes checking the plug itself before realizing the router was the actual problem.

Older IoT devices — smart plugs, some smart TVs, budget security cameras, anything running Wi-Fi firmware from before roughly 2020 — frequently don't support WPA3 at all. Point them at a WPA3-only network and they don't downgrade gracefully; they simply fail to associate.

Warning

Before switching your whole network to WPA3-only, check every device that connects to it — especially anything you set up once and never think about again (smart plugs, printers, older cameras). A silent drop is much harder to diagnose than an error message, because nothing on the device itself tells you Wi-Fi is the problem.

How to run a safe WPA2/WPA3 transition network

Most routers from the last several years support a "WPA2/WPA3 Mixed" or "Transition" mode rather than forcing an all-or-nothing choice. It's usually on the same wireless security screen as the WPA3 toggle covered in the router hardening checklist:

Open your router's wireless security settings.
Look for an option labeled "WPA2/WPA3 Mixed," "WPA3 Transition," or similar — the exact wording varies by manufacturer.
Select it instead of "WPA3 only." Devices that support WPA3 will use it automatically; older devices fall back to WPA2-AES without dropping off the network.
Confirm the fallback is set to WPA2-AES (CCMP), never WPA2-TKIP — a transition mode is only as secure as its fallback cipher.

This isn't a permanent compromise — it's the correct setting for almost every real home network, since almost nobody owns exclusively WPA3-capable hardware. Revisit it and move to WPA3-only once every device you own has been replaced or confirmed to support it.

Note

A mixed network doesn't weaken WPA3 devices' connections — each device negotiates its own handshake type. A WPA3-capable phone on a mixed network gets the same SAE protection it would get on a WPA3-only network; only the older devices use WPA2.

When WPA2-AES is still fine

If your router itself doesn't support WPA3 — common on hardware from before 2020 — WPA2-AES (CCMP) is still a reasonable choice for home use. It isn't immune to the offline-dictionary-attack weakness described above, but a genuinely strong, unique Wi-Fi password (not the sticker on the router) makes that attack impractical for an opportunistic attacker. The setting that actually matters more at that point is everything else on the router hardening checklist — default credentials, WPS, UPnP — none of which WPA3 alone fixes.

Wireless encryption is one layer, not the whole picture

Getting WPA2/WPA3 right stops someone from reading or forging your Wi-Fi traffic at the radio level. It doesn't touch what happens after a device is connected — for that, the same DNS resolver your devices use matters too. Plaintext DNS still tells anyone on the wire what domains a device is looking up, WPA3 or not, since Wi-Fi encryption and DNS encryption solve two different problems. Treat this article, the router checklist, and encrypted DNS as three separate layers of the same hardening pass — none of them substitutes for the others.

WPA3 vs WPA2 decision checklist

Every device on your network supports WPA3 → set WPA3-only.
Mixed old and new devices → set WPA2/WPA3 Transition/Mixed mode, fallback cipher AES (never TKIP).
Router doesn't support WPA3 at all → WPA2-AES with a strong, unique password is still reasonable.
Never select WPA2-TKIP or an open network, regardless of which of the above applies.

Frequently asked questions

Is WPA3 worth switching to?

Yes, if your router and devices support it — it closes WPA2's biggest practical weakness (offline dictionary attacks against a captured handshake) with no real downside for supported devices.

Will WPA3 break my older smart home devices?

An all-WPA3 network will silently drop any device that doesn't support WPA3 — no error, it just stops connecting. Use a WPA2/WPA3 transition or mixed mode instead of switching to WPA3-only if you have any older hardware.

What is WPA2/WPA3 transition mode?

A router setting that lets WPA3-capable devices use WPA3's SAE handshake while older devices fall back to WPA2-AES automatically, on the same network, without anything being dropped.

Is WPA2-AES still safe in 2026?

For home use with a strong, unique password, yes — WPA2-AES (CCMP, not TKIP) has no practical break. WPA3 is the better choice when available, but WPA2-AES isn't a dangerous fallback the way WPA2-TKIP or an open network would be.