WPA3 in plain English
WPA stands for “Wi-Fi Protected Access.” The standard defines how devices connect to a Wi-Fi network and how wireless traffic is encrypted. It is maintained by the Wi-Fi Alliance, a wireless industry association. WPA3 was introduced in 2018 and is gradually replacing WPA2.
The most important difference concerns the Wi-Fi password. With WPA2, an attacker can capture a device’s login process over the air and then, at their leisure, try out as many passwords as they like on their own computer. Experts call this a dictionary or brute-force attack. With WPA3, this no longer works.
An analogy: with WPA2, a burglar can take an impression of your lock, go home, and file keys until one fits. With WPA3, he has to come to your door in person for every single attempt – which makes guessing extremely tedious.
How WPA3 works
WPA3 brings several improvements:
- New authentication (SAE): In WPA3-Personal mode, there is still a shared Wi-Fi password, but the login works differently: the SAE method (Simultaneous Authentication of Equals) replaces the previous pre-shared key authentication (WPA2-PSK). A captured login process no longer yields anything that could be used to crack the password offline.
- Forward secrecy: Even someone who learns the password later can’t retroactively decrypt previously recorded wireless traffic.
- Protected control messages: Wi-Fi devices exchange management messages, for example to disconnect. Under WPA3, these “management frames” must be protected. As a result, attackers can no longer kick devices off the network with fake disconnect commands.
- Enterprise mode: WPA3-Enterprise, for corporate networks with individual logins for each user, optionally offers a particularly strong 192-bit security level.
For open networks without a password, such as guest Wi-Fi, there is a complementary method called “Enhanced Open” that still encrypts the wireless traffic.
A practical example
A wholesale company switches its corporate Wi-Fi to WPA3. Because some older handheld scanners in the warehouse don’t support WPA3, mixed operation with WPA2 – known as transition mode – remains active. The password is short and hasn’t been changed in years.
During a wireless penetration test, the testing team sets up a fake access point with the same network name in the parking lot, offering only WPA2 – known as an evil twin. Some devices connect to it using the older method. The short password can then be cracked offline from the captured login attempt – despite WPA3.
The solution: a separate, isolated network for the legacy devices, pure WPA3 for everything else, and a long, new password.
Why does this matter for businesses?
Radio signals don’t stop at the property line. An attacker doesn’t need to enter your building – a spot in the parking lot is often enough. Anyone who knows the Wi-Fi password may find themselves right in the middle of your corporate network.
WPA3 closes the biggest weakness of WPA2 in Personal mode. However, many older devices don’t support the standard, so numerous networks still run in mixed mode – and that is exactly where attacks remain possible. In addition, shortly after its introduction, researchers demonstrated weaknesses in early implementations that vendors had to fix with updates.
Even WPA3 doesn’t protect against everything. Weak passwords and passwords that have been passed on remain a risk. In corporate Wi-Fi networks with individual logins, devices must also validate the server certificate – the digital ID card of the authentication server. Without this check, attackers can harvest credentials with a fake access point. And WPA3 is no help against access points that have been secretly connected to your own network (rogue access points) either.
How to protect your organization
- Go WPA3-only: Run your main network without WPA2 mixed mode wherever possible.
- Isolate legacy devices: Devices that only support WPA2 belong in a separate, strictly restricted network – or should be replaced.
- Long passwords: Choose a long, random Wi-Fi password and change it when people who know the password leave the company.
- Enterprise mode for corporate networks: Rely on individual logins (WPA3-Enterprise) and enforce server certificate validation on all devices.
- Install updates: Keep the firmware of your Wi-Fi access points up to date.
- Separate guests: Guest networks must not have access to internal systems.
- Monitor the airwaves: Regularly check for unknown or fake access points.
How Rootsektor can help
As part of Wireless Penetration Testing, we check whether your wireless networks are as secure in practice as planned: encryption and mixed mode, password strength, enterprise authentication and certificate validation, the separation of guest networks, and fake and unauthorized access points. You receive concrete remediation recommendations, a free retest after remediation, and a test certificate. You can get your fixed-price quote after scoping via our Pentest Quote page.