These are encryption standards. They define how the data travelling through the air between your devices and the router gets scrambled, so someone with a laptop and an antenna can’t read it. Each generation fixed the flaws of the one before, and the old generations are still hanging around in routers because “compatibility mode” defaults die hard.

Standard	Year	Status today
WEP	1999	Broken. Cracked in minutes with free tools.
WPA	2003	Broken. Also crackable; exists only on very old gear.
WPA2	2004	Acceptable. Fine for most homes if the password is strong.
WPA3	2018	Current. Strongest option; blocks the offline cracking attacks.

Why WEP and WPA are dead

WEP’s flaws were known by 2001, and today a free tool can recover a WEP password from a few minutes of captured traffic. It survives in old routers and some embedded devices purely as a “compatibility” option. If your router is set to it, everything else in your security setup is theatre.

WPA was the patch job in between, and it falls to similar attacks. Neither mode has any place on a network you care about in 2026.

What WPA2 does well, and where it creaks

WPA2 (more precisely, WPA2-PSK with AES) has carried home WiFi for two decades and does the job. It’s what most networks run. Its weakness is a design detail called the four-way handshake: when a device connects, the router and the device perform a public handshake that an attacker can record. Once recorded, they can take it home and try passwords against it offline, at millions of guesses per second, without ever needing to be near your house again. A strong password survives that; a weak one doesn’t.

There was a bug in the handshake protocol itself, the 2017 KRACK attack, which affected nearly every WPA2 device on earth at the time. Patches landed quickly, which is one more reason router firmware updates matter (see our router hardening guide).

What WPA3 actually adds

WPA3 replaces the recordable handshake with something called SAE. The practical result: capturing traffic no longer gives an attacker a crackable copy of your password. They’re forced to attack it online, in real time, against your router, slowly and noisily. Long passwords become genuinely strong instead of theoretically strong.

WPA3 also adds forward secrecy for open (password-free) networks, and better protection for smart-home devices with weak default passwords. It’s the first WiFi security mode that meaningfully improves things for people who don’t want to think about passwords.

So which do you pick?

• WPA3 only: best security, but devices from before roughly 2019 may refuse to connect.
• WPA2/WPA3 mixed: the sensible default for most homes. WPA3-capable devices use it; older ones still connect with WPA2. Set this unless you have a reason not to.
• WPA2 only: fine if mixed mode gives you connection trouble with an older device. Keep the WiFi password long and random.
• WEP or WPA: no. If an old gadget genuinely can’t do WPA2, that gadget should go on the guest network or retire.

The password still matters more than the mode

WPA3 protects a weak password better than WPA2 does, but no mode protects the password “Alwyn2015”. A strong password, twelve characters or more, random-looking, different from every other password you own, is half of the equation. The mode is the other half. Do both.

Setting up new WiFi or upgrading old equipment? As part of our Wi-Fi setup and network services we configure encryption, coverage and guest networks properly the first time, for homes and businesses across the Helderberg.

Related guides

• Secure your home WiFi: 7 weak spots to fix
• Router settings worth changing beyond the WiFi password
• Guest network setup for homes and guesthouses