Short answer: use WPA3 if all your devices support it. If some older ones don’t, use the WPA2/WPA3 mixed (transition) mode, so newer devices get WPA3 and older ones still connect. WPA2 with a strong password is still acceptable where WPA3 isn’t available.
What WPA3 changes
The headline change is how the password is used. WPA3-Personal replaces WPA2’s pre-shared key with a handshake called SAE (Simultaneous Authentication of Equals). According to the Wi-Fi Alliance, that brings three practical improvements:
- No offline password guessing. With WPA2, someone who captures your devices connecting can take that recording away and test millions of passwords. With WPA3, an attacker gets only one guess per live attempt against your network.
- Forward secrecy. Even if your password leaks later, previously captured traffic can’t be decrypted with it.
- Protected management frames everywhere. WPA3 makes this protection mandatory in all its modes.
| WPA2-Personal | WPA3-Personal | |
|---|---|---|
| Password handshake | Pre-shared key (PSK) | SAE |
| Offline password guessing | Possible from a capture | Prevented |
| Forward secrecy | No | Yes |
| Protected management frames | Optional | Mandatory |
| 6 GHz band | Not allowed | Required |
Compatibility and transition mode
WPA3 support has been required in new Wi-Fi CERTIFIED devices since 2020, and it’s mandatory in the 6 GHz band, so most recent devices handle it. Older ones may not: ASUS notes that some older devices aren’t compatible with WPA3.
That’s what transition mode is for. It lets WPA2 and WPA3 devices join the same network with the same password, with each using the best method it supports. The catch is that the full benefits only apply in WPA3-only mode. One tidy approach the Wi-Fi Alliance mentions: run your main network as WPA3-only and leave a separate guest network in transition mode for visitors’ older devices.
What to choose
US guidance allows either: the FTC recommends WPA3 Personal or WPA2 Personal, and CISA recommends WPA3 Personal or WPA2 with AES. Apple recommends WPA3 Personal, or WPA2/WPA3 transitional mode for compatibility.
The setting is usually next to the Wi-Fi password; see how to change your Wi-Fi password. For the full set of settings, see our router security checklist. The 6 GHz band only works with WPA3; see Wi-Fi 6 vs Wi-Fi 6E.