WPA3: What It Fixes

This is not a tour of WiFi security from the beginning. You have the background — you understand what a PSK is, what a handshake does, and why open networks are a bad idea. So we are going to be ruthless about scope: what does WPA3 actually fix, and what does it not?

The answer matters for offense because every WPA2 attack you know is an attack on a specific design decision. WPA3 reverses some of those decisions and leaves others untouched. Knowing exactly which is which tells you, on sight, whether a target is genuinely hardened or just wearing a newer label. By the end of this page you should be able to look at a network and predict which of your existing techniques still work, which are dead, and where the remaining seam is.

The single most important thing WPA3 changes is this: a captured handshake can no longer be cracked offline. Under WPA2-PSK, the four-way handshake can be captured off the air — passively, or by forcing a reconnection — and everything an attacker needs to verify a password guess is contained in that capture. From that moment the access point is irrelevant. You take the handshake home and grind a wordlist against it at GPU speed, millions of guesses per second, with no further contact with the network. That offline, unlimited-guess property is the entire basis of WPA2 cracking.

WPA3 removes the property at its root by replacing the key exchange with SAE — Simultaneous Authentication of Equals, the password-authenticated handshake known as Dragonfly. With SAE, the captured exchange contains no offline-verifiable proof of the password. Every guess must be tested with a fresh, live exchange against the access point itself, and the access point rate-limits those attempts and locks out floods.

The practical effect is enormous. A weak passphrase that falls in seconds against a WPA2 capture is dramatically harder to attack under WPA3, because the attacker is forced back into a slow, noisy, online channel that the AP actively throttles. The capture-and-grind workflow simply has nothing to grind.

WPA2 has a second, quieter weakness that follows from the first. Because the session keys derive directly from the PSK, cracking the PSK once decrypts everything ever sent on that network — including traffic you recorded weeks or months earlier. An attacker can passively archive encrypted captures today, learn the password later, and retroactively read all of it.

WPA3 closes this with per-session forward secrecy. Each session negotiates fresh key material that is not recoverable from the long-term password. Recording traffic today and learning the password tomorrow does not let you decrypt those past sessions. Compromising the PSK compromises only what happens after the compromise — not the archive.

WPA3 also hardens two layers that WPA2 left exposed.

First, management frames. The classic WPA2 deauthentication attack works because 802.11 management frames — including deauth and disassociation — are unauthenticated by default, so anyone can spoof them and forcibly knock a client off the network (often to capture the handshake on reconnect). WPA3 makes PMF (Protected Management Frames, 802.11w) mandatory. With PMF enforced, those spoofed deauth and disassociation frames are rejected, and the bread-and-butter WPA2 deauth attack stops working against a true WPA3 client.

Second, open networks. A WPA2 open network — the password-free coffee-shop kind — is fully cleartext; anyone in range passively reads every packet. WPA3 introduces OWE (Opportunistic Wireless Encryption, branded Enhanced Open), which encrypts the link on open, password-free networks. There is still no password and no authentication of the AP, but passive eavesdropping on an open network is finally prevented — each client gets its own encrypted session instead of broadcasting in the clear.

The same four properties, lined up across the three generations. Read it as a checklist: each row is an attack class, and the column tells you whether that attack is on the table.

Three of those rows flip only at WPA3, and the fourth — management-frame protection — existed as an option in WPA2 but was rarely turned on. The jump from WPA2 to WPA3 is therefore less about new ciphers and more about removing the structural affordances that made WPA2 attacks cheap and repeatable.

Here is the seam, and the reason the next lab exists. WPA3 fixes a great deal — but only for clients and access points that actually use it. To avoid stranding the enormous installed base of legacy devices, most WPA3 deployments run in transition mode: a single network advertises both WPA3 and WPA2 at once, so old hardware connects over WPA2 while new hardware connects over WPA3.

That backward-compatibility door is the weakness. If the network still speaks WPA2, then a client that could have used WPA3 can be coerced down to WPA2 — and the moment it does, you are right back to the capturable, offline-crackable handshake that WPA3 was supposed to retire. The strong protections are present but optional, and an attacker's whole job becomes convincing the client to take the weaker option.

Early SAE implementations made this worse. The 2019 Dragonblood research disclosed timing and cache-based side-channel leaks in several Dragonfly implementations, along with explicit downgrade weaknesses in transition mode — demonstrating that "WPA3-capable" did not yet mean "WPA3-safe" in practice.

So what is the real-world fix?

• WPA3-only mode — disable transition mode entirely. If the network never advertises WPA2, there is no weaker option to be forced into.
• A strong, random PSK — even if a client is downgraded and a handshake is captured, a high-entropy passphrase is not realistically crackable offline.
• 802.1X / EAP-TLS — certificate-based authentication removes the shared-password problem altogether for enterprise environments.

Transition mode is the default almost everywhere, which is exactly why it is worth attacking and worth understanding. Next, we put this into practice: forcing a WPA3-capable client down onto WPA2 and capturing the handshake it should never have given up.