What the WPA modes protect
Wi-Fi security does two jobs: it decides who may join the network, usually with a password, and it encrypts the radio traffic so that people within range cannot read it. WPA2 did both for many years. WPA3 is its successor, and the Wi-Fi Alliance, which certifies Wi-Fi equipment, now makes WPA3 mandatory for any device carrying the Wi-Fi CERTIFIED label.
The modes you will see
| Mode | Where it is used | What it adds |
|---|---|---|
| WPA3-Personal | Home and small office networks with a password | The Wi-Fi Alliance says it gives increased protection from password guessing attempts |
| WPA3-Enterprise | Company networks with individual logins | Higher-grade security protocols for sensitive data networks, in the Wi-Fi Alliance's words |
| Wi-Fi Enhanced Open | Open networks in cafés, hotels and airports | Encrypts traffic without a password, so there is no shared passphrase to manage |
| WPA2 | Older routers and devices | CISA lists it as the fallback when equipment does not support WPA3 |
Beyond better protection against password guessing, the Wi-Fi Alliance lists two structural changes in WPA3 networks: they require Protected Management Frames, which protect the network's own control messages, and they disallow outdated legacy protocols. CISA's summary for home users is short: WPA3 is currently the strongest encryption, and the other protocols could leave a network open to exploitation.
Which setting to pick
- WPA3-Personal if the router offers it and all your devices support it.
- WPA2/WPA3 mixed or transitional if some older devices cannot connect with WPA3 alone. Newer devices use WPA3, older ones fall back.
- WPA2-Personal only if the router has no WPA3 option, as CISA describes the fallback. Plan to replace the router.
- Never leave a home network open or on an older mode than WPA2.
The password still matters
CISA calls a complex password the first line of defence for a wireless network. WPA3 makes guessing much harder, but a mixed-mode network still lets older devices connect with WPA2, where a weak password remains the weak point. Use a long random passphrase, which the password generator produces and the password strength checker rates; the password length guide explains why length beats complexity. Guests do not need to type it: the QR code generator makes a Wi-Fi code that phones join with a scan, which also makes a long password painless.
The rest of the router checklist
CISA's guidance for home networks adds a few settings that take minutes:
- Change the default admin password. Defaults are easy to find online, so they protect nothing.
- Change the default network name. A factory name advertises the router model, which tells an attacker which weaknesses to try.
- Update the firmware from the manufacturer's site, or turn on automatic updates if the router has them.
- Use a guest network with its own password for visitors and smart-home gadgets, so they never share the network your computers use.
- Keep firewalls on, on the router and on each device.
The what is my IP tool shows the public address your router presents to the internet, which is the address every site you visit sees.
On public Wi-Fi
Open networks have no password, and historically no encryption between your device and the access point. Wi-Fi Enhanced Open, in the Wi-Fi Alliance's description, provides unauthenticated data encryption: traffic is encrypted even though anyone may join. Where a network does not offer it, assume others nearby could see unencrypted traffic, and rely on HTTPS, which encrypts the connection to the site itself; the HTTP vs HTTPS guide explains what that does and does not protect.
Frequently asked questions
What is the difference between WPA2 and WPA3?
WPA3 is the newer security standard for Wi-Fi. The Wi-Fi Alliance says WPA3-Personal gives increased protection from password guessing attempts, and WPA3 networks require Protected Management Frames and disallow outdated legacy protocols. CISA calls WPA3 the strongest encryption currently available and recommends WPA2 only where WPA3 is not supported.
Should I switch my router to WPA3?
If the router and your devices support it, yes; CISA advises using WPA3 where the equipment allows. Many routers offer a WPA2/WPA3 mixed mode so older devices can still connect, which is a reasonable step until every device supports WPA3. The Wi-Fi Alliance says WPA3 is now mandatory for Wi-Fi CERTIFIED devices, so new hardware supports it.
How long should my Wi-Fi password be?
Long. CISA calls a complex password the first line of defence for a wireless network. A random passphrase of several words or a long random string resists guessing far better than a short word with a number on the end; the password generator makes one, and the guest network can have its own.
Is public Wi-Fi safe?
An open network without a password has traditionally sent traffic unencrypted between your device and the access point. Wi-Fi Enhanced Open fixes that by encrypting the connection without a password, but only where the network supports it. HTTPS sites stay encrypted end to end either way, which is why the padlock matters most on public Wi-Fi.
What else should I change on a new router?
CISA lists the basics: change the default administrator password, which is easy to find online; change the default network name so the router model is not obvious; keep the firmware updated from the manufacturer; use a guest network for visitors; and keep a firewall on the router and on each device.
Sources
- CISA: Securing wireless networks (WPA3 is currently the strongest encryption; WPA2 as the fallback; change the default administrator password and network name; complex passwords as the first line of defence; guest network; firmware updates; firewalls). Archived page from February 2021
- Wi-Fi Alliance: Security (WPA3 mandatory for Wi-Fi CERTIFIED devices; WPA3-Personal protection from password guessing; WPA3-Enterprise; Protected Management Frames required; outdated legacy protocols disallowed; Wi-Fi Enhanced Open)