WPA2 vs WPA3: which should you use?

WPA2 and WPA3 are the two WiFi security modes you will see today. Here is what actually differs, what to choose on your router, and how much it matters on public WiFi.

Short answer

Use WPA3 where you can. CISA calls it the strongest WiFi encryption, and the Wi-Fi Alliance says WPA3-Personal gives stronger protection against password guessing and requires Protected Management Frames. If older devices can’t join, use WPA2/WPA3 Transitional, as Apple recommends. WPA2 (AES) is still acceptable; anything older is not.

The difference in one table

Password handshake	WPA2-Personal: pre-shared key. WPA3-Personal: Simultaneous Authentication of Equals (SAE), which the Wi-Fi Alliance says gives “stronger protections for users against password guessing attempts”
Management frames	Optional on WPA2. WPA3 networks require Protected Management Frames (PMF)
Legacy protocols	WPA3 networks disallow outdated legacy protocols
Enterprise	WPA3-Enterprise offers an optional mode with the equivalent of 192-bit cryptographic strength
Compatibility	WPA3 keeps working with WPA2 devices through a transitional mode
Status	The Wi-Fi Alliance says WPA3 is mandatory for Wi-Fi CERTIFIED devices

All rows come from the Wi-Fi Alliance’s security page and its 2018 WPA3 announcement, linked below.

What that means in practice

Weak passwords hurt WPA2 more. SAE is designed to resist password-guessing attempts, so WPA3 is more forgiving of a short password. A long password still matters on both.
PMF makes some disruption attacks harder. Management frames are the control messages between your phone and the router; protecting them is required on WPA3 and optional on WPA2.
Old modes are the real problem. Apple’s router guide says WEP, TKIP, WPA Personal and WPA/WPA2 mixed modes are no longer secure and make iPhones show a weak-security warning.

What to choose on your router

Open your router’s app or admin page and find the WiFi security (or authentication) setting.
Pick WPA3 Personal. Apple notes it works with all devices that support Wi-Fi 6 (802.11ax) and some older ones.
If an older printer, TV or laptop can’t join, switch to WPA2/WPA3 Transitional. Newer devices still use WPA3; older ones fall back to WPA2.
If your router offers neither, use WPA2 Personal (AES). Avoid TKIP, WEP and “WPA/WPA2” mixed settings.
Use a long, unique WiFi password and update the router’s firmware. Then rejoin on each device.

Router labels, decoded

Router makers don’t all use the same words. These are the labels you are most likely to see, and how they map to the advice above:

WPA3-Personal, WPA3-SAE	WPA3 Personal. The best choice for a home network
WPA2/WPA3, WPA3 Transition, WPA2/WPA3-Personal	Transitional mode: WPA3 for devices that support it, WPA2 for older ones. Fine
WPA2-Personal, WPA2-PSK (AES)	WPA2 with AES. Acceptable when WPA3 isn’t available
WPA2 (TKIP), TKIP+AES, WPA/WPA2	Includes TKIP or the original WPA. Apple flags these as weak; change them
WEP, Open, None	Outdated or no WiFi security. Change them on your own router
OWE, Enhanced Open	Encryption for open networks without a password. Mainly used for public hotspots

Checking which mode a network uses

iPhone: iOS doesn’t list the security mode as a plain label, but it does warn you: if a network shows “Weak Security” under Settings > Wi-Fi, it uses one of the outdated modes above. No warning means at least WPA2 (AES). Android: open Settings > Network & internet > Internet and tap the settings icon next to the network. On many phones the details screen shows the security type; wording varies by manufacturer.

Does WPA3 matter on public WiFi?

Less than you might think. Most airport, hotel and café WiFi has no WiFi password, so neither WPA2 nor WPA3 Personal applies. Some open networks use Wi-Fi CERTIFIED Enhanced Open, which encrypts the link without a password. Where a password is shared on a sign at the counter, everyone has the same key, so the network’s security mode doesn’t make the people next to you trustworthy.

That is why the FTC focuses on other things for public WiFi: most sites and apps now encrypt traffic themselves, so the risks that remain are lookalike networks, fake sign-in pages and apps or pages that aren’t encrypted. SentryFi doesn’t change phone or router settings. It checks the network you are on for warning signs — an unexpected sign-in page, DNS answers that differ from trusted DNS, certificate problems, a hidden proxy — and gives a 0–100 risk score with plain next steps.

Frequently asked questions

Is WPA3 better than WPA2?

Yes. WPA3-Personal uses SAE for stronger protection against password guessing, requires Protected Management Frames and disallows legacy protocols. WPA2 with AES is still acceptable when WPA3 isn’t available.

Should I use WPA2/WPA3 mixed (transitional) mode?

Yes, if some of your devices can’t join WPA3. Apple recommends WPA2/WPA3 Transitional for compatibility with older devices. Don’t confuse it with WPA/WPA2 mixed mode, which Apple flags as weak.

Is WPA2 still safe in 2026?

WPA2 Personal with AES is still acceptable; Apple calls it appropriate when you can’t use a more secure mode, and CISA says to use at least WPA2. Avoid WPA2 with TKIP.

Does WPA3 make public WiFi safe?

Not on its own. Most public hotspots have no password, and on shared-password networks everyone has the same key. Use HTTPS apps and sites, and check the network before banking.

Sources

Last checked: 2026-10-18. SentryFi is not affiliated with the venues, brands or providers named on this page.