WPA3 does not turn a bad password into a good one. It makes guessing it a slow, noisy and very boring hobby.
The short answer
WPA3 is the current security certification of the Wi-Fi Alliance and the successor of WPA2 [1][2]. For home networks (WPA3-Personal) it replaces the old pre-shared-key handshake with SAE (Simultaneous Authentication of Equals), which resists password guessing, and it requires Protected Management Frames [1][2][3]. Wi-Fi CERTIFIED devices must support it [1]. Our assessment: turn on the "WPA2 + WPA3" transition mode if your router offers it, and move to WPA3 only when every device can handle it.
How it works
- Two flavours. WPA3-Personal is for password-based home and small-office networks, and WPA3-Enterprise is for networks with individual logins [2]. This entry is about Personal.
- SAE instead of PSK. SAE is a key exchange that authenticates two peers using only a password. Each client gets a fresh Pairwise Master Key. Neither this key nor the password can be obtained by a passive attack, an active attack or an offline dictionary attack, and an attacker can only guess one password per active attempt [3].
- Forward secrecy. Because of how the SAE handshake works, a recorded session cannot be decrypted later, even if the password becomes known afterwards [3]. Our reading: for traffic that was recorded in the past, a leaked password then matters far less.
- Protected Management Frames. WPA3 networks use current security protocols, disallow outdated legacy protocols and require PMF. PMF protects management action frames against forging, and unicast ones against eavesdropping as well [1].
- Transition mode. In WPA3-Personal Only mode the AP offers SAE, does not enable PSK and requires PMF [4]. A transition mode lets WPA2 and WPA3 devices share one network name and password [5]. AVM notes that WPA3 connections are equally secure in both cases, while WPA2 devices must use PMF there, which older ones may lack [5]. Our reading: WPA2 clients in a mixed network keep WPA2-level protection, not WPA3's.
- Enterprise 192-bit. An optional mode for sensitive networks uses 256-bit GCMP, and a network configured for it requires all clients to use it, so there is no transition mode [3][4].
A practical example
You want WPA3 at home. First you update the router firmware, then you set the router to "WPA2 + WPA3" and reconnect the devices that ask for it. AVM's own FRITZ! pages say that older Wi-Fi devices and some Wi-Fi printers may not support PMF and fail to connect, and that a firmware update can help [6]. Only when no old device remains do you switch to WPA3 only. We have not documented which routers or Wi-Fi clients we use (the inventory of 14 to 16 Oct 2026 has no Wi-Fi data), so this is a generic walk-through.
Checklist
- Update the router firmware before you change any Wi-Fi setting [6].
- List all Wi-Fi devices, including printers, plugs and consoles.
- Choose "WPA2 + WPA3" first, then reconnect devices that fail [5][6].
- Check the device operating system and driver support, because both must know WPA3 [6].
- Switch to WPA3 only when every device connects with it [4].
- Keep a long, unique passphrase; WPA3 slows guessing, it does not fix a weak password [3].