What are WPA, WPA2, and WPA3?
WPA, WPA2, and WPA3 are the three generations of Wi-Fi Protected Access, the security certifications that encrypt Wi-Fi traffic and control who can connect. A protocol is the agreed set of rules two devices follow to communicate. Encryption scrambles that traffic so only the intended device can read it.
Learn more -> Wi-Fi security guide
A short history: from WEP to WPA3
- WEP: Wired Equivalent Privacy (WEP), 1990s, broken years ago; avoid.
- WPA: Wi-Fi Protected Access (WPA), 2003, used Temporal Key Integrity Protocol (TKIP) built on the older RC4 cipher; a stopgap, now deprecated.
- WPA2: 2004, introduced Advanced Encryption Standard (AES); the long-standing default. In 2017 the KRACK attack exposed a handshake flaw that vendors fixed with software patches.
- WPA3: 2018, the current generation; also required for Wi-Fi CERTIFIED 6 (Wi-Fi 6).
WPA vs WPA2 vs WPA3: how the protocols compare
Each generation kept the same goal, encrypted Wi-Fi with controlled access, while hardening the weakest parts of the one before. The table below summarizes what changed.
The Wi-Fi Alliance introduced WPA3 on June 25, 2018. WPA3 uses Simultaneous Authentication of Equals (SAE). Per the Wi-Fi Alliance, SAE provides "stronger protections for users against password guessing attempts by third parties" (Wi-Fi Alliance WPA3 announcement).
WPA3 also adds forward secrecy, so captured traffic can't be decrypted later even if the password is exposed. Per the Wi-Fi Alliance, WPA3-Enterprise "offers the equivalent of 192-bit cryptographic strength" for sensitive sectors such as government and finance (Wi-Fi Alliance WPA3 announcement). Encrypted open ("guest") networks come from a companion certification, Wi-Fi Enhanced Open (Opportunistic Wireless Encryption, OWE), not WPA3 itself. WPA3 had its own 2019 "Dragonblood" weaknesses that were addressed through updates.
WPA2/WPA3 mixed mode and compatibility
Mixed mode: a single network that lets WPA3 devices connect over WPA3 while older devices fall back to WPA2. Many modern routers offer this. Two caveats apply: transition mode can let an attacker force a downgrade to WPA2, and some legacy clients struggle to join transition-mode networks.
Upgrade guidance: if every device supports WPA3, choose WPA3-only. Otherwise use mixed mode. On older or budget-constrained hardware, keep WPA2 until you can phase in WPA3-capable gear.
Personal vs Enterprise: WPA2 and WPA3 at work
Personal mode: WPA2-Personal and WPA3-Personal use one shared password (a pre-shared key, PSK, in WPA2; SAE in WPA3).
Enterprise mode: WPA2-Enterprise and WPA3-Enterprise use 802.1X for identity-based access. Each user authenticates with their own identity, often via certificates and a Remote Authentication Dial-In User Service (RADIUS protocol) server that verifies credentials. Shared passwords can't identify or revoke individual users, which is why enterprises prefer per-user authentication.
Cloudi-Fi's cloud-native platform delivers WPA2/WPA3-Enterprise security through identity-based access, with no local RADIUS servers or extra hardware. It integrates with existing infrastructure such as Cisco and HPE Aruba, and offers cloud-ready 802.1X authentication. Trusted by 200+ enterprises worldwide, across 90+ countries, 500M+ users and devices, and 100K+ secured sites.
Get Cloudi-Fi to secure every site with identity-based Wi-Fi access.
FAQ
Is WPA2 still safe in 2026?
Yes, it remains acceptable with AES and a long, unique password, but it is no longer recommended. WPA3 is stronger where supported.
Should I use WPA2 or WPA2/WPA3 mixed mode?
Use WPA3-only if all devices support it; otherwise mixed mode, so WPA3 devices get the stronger standard while older ones connect over WPA2.
Will older devices still connect if I enable WPA3?
In mixed mode most older devices fall back to WPA2, though some very old clients may fail the handshake and need WPA2 kept available.
What's the difference between WPA2-Personal and WPA2-Enterprise?
Personal uses one shared password; Enterprise uses 802.1X so each user connects with an individual, revocable identity.
