WPA3 vs WPA2: Is WPA3 Really Crackable?

WPA2-PSK: the 4-way handshake and why it is crackable

WPA2-Personal uses a Pre-Shared Key (PSK). The passphrase you type into your phone is stretched with PBKDF2-HMAC-SHA1, 4096 iterations, and the SSID as salt, to produce a 256-bit Pairwise Master Key (PMK). Every client and the access point derive the same PMK independently. The 4-way handshake that follows negotiates a per-session key and proves mutual knowledge of the PMK.

The critical weakness is that an attacker who captures the handshake frames gets everything needed to verify a password guess offline: the SSID, the two nonces (ANonce, SNonce), the two MAC addresses, and the Message Integrity Check (MIC) over message 2 or 3. For every candidate passphrase, a cracker re-derives the PMK, re-derives the Pairwise Transient Key (PTK), recomputes the MIC, and compares. No interaction with the network is required after the capture.

Available WPA2 candidate throughput varies by hardware, implementation, and the selected attack rules. The important property is that a captured handshake can be checked offline, so a dictionary or predictable pattern materially changes the assessment. For an illustrated walk-through of the capture step see what a WPA handshake is.

WPA3-SAE: Dragonfly and the end of offline attacks

WPA3-Personal replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), a variant of the Dragonfly key exchange. Instead of sending a derivative of the password across the air, SAE performs a commit-and-confirm dance over a cyclic group where both sides prove knowledge of the password without either revealing it, and without either side being able to replay the transcript offline.

Concretely: each side picks a secret scalar and masks it with a value derived from the password. They exchange commits, derive a shared secret element, then confirm. If the password is wrong on either side, the confirm messages fail and no usable key material is produced. Crucially, nothing in that transcript lets an offline attacker verify a guess. Every password attempt requires a fresh live interaction with the access point. Wi-Fi Alliance guidance advises implementations to detect and throttle such active attacks, but how strictly a given product does so varies.

In theory this collapses the attack surface from "steal a handshake and grind offline" to guessing interactively, where each candidate costs a live exchange with the access point instead of a GPU cycle. Whether that is slow enough to matter depends on the passphrase and on how well the access point throttles repeated failed attempts, so WPA3-only raises the cost of online guessing rather than removing it.

Dragonblood: the 2019 cracks in WPA3

In April 2019, Mathy Vanhoef and Eyal Ronen published a paper titled Dragonblood that described a family of side-channel, downgrade and resource-consumption weaknesses in WPA3-SAE:

• SAE side-channels (CVE-2019-9494). The password-to-curve mapping in hostapd branched on secret bits, and the multiplicative-group SAE mode used variable-time modular operations. Both are observable timing and cache-access differences that reveal information about the password element over repeated observations, enabling a partitioning attack.
• Security group downgrade (CERT/CC VU#871675). An attacker impersonating the access point can forge decline messages so that a client keeps stepping down to a weaker security group than it would otherwise have chosen.
• Downgrade and dictionary attack on transition mode (CERT/CC VU#871675). Transition-mode networks advertise both WPA2 and WPA3. An attacker runs a rogue WPA2-only access point with the same SSID, the client associates to it with the password it already has stored, and the resulting 4-way handshake cracks offline.
• Resource consumption on SAE (CERT/CC VU#871675). Because SAE is computationally heavy on the access point, a stream of forged commit messages overloads it, causing high CPU usage and preventing or delaying other devices from connecting.

Patches landed in major software projects, but consumer router support depends on the vendor and firmware release. Treat an unmaintained access point as an implementation risk and check its current security advisory and firmware before relying on WPA3-only claims.

Transition mode: the downgrade problem

Transition mode is an optional coexistence mode that advertises WPA2 and WPA3 on the same SSID with the same PSK, and vendors ship it enabled by default. It is prohibited in the 6 GHz band, and Wi-Fi Alliance guidance describes WPA3-Personal only mode as the recommended end state. The intent is to let older phones and IoT devices keep working while newer clients enjoy SAE. The reality is that transition mode reduces the security of the whole network to that of WPA2-PSK: a client can be moved onto a WPA2 association whose 4-way handshake is then crackable offline. The published downgrade needs neither a deauthentication flood nor a man-in-the-middle position: the attacker broadcasts a rogue WPA2-only access point with the same SSID, and a client that does not refuse it associates using the password it already has stored, after which the attacker forges the unauthenticated message 1 and captures the authenticated message 2 that carries the offline dictionary check.

That path applies only to a network you own or have documented written permission to test. Running a rogue access point against, or capturing frames from, a network you do not own is unlawful interception and interference, not merely unauthorized access.

Many routers hide the WPA3-only option behind "WPA3 Personal (Advanced)" or similar labels. Some OEM firmwares do not expose it at all. If yours does not, any WPA3 claim on the box is effectively a marketing-only upgrade.

Practical security assessment

The table below summarizes the attack property of each mode. These are protocol-level categories, not a universal success percentage: the password, firmware, capture quality, and authorization scope still determine the real assessment.

The gap between the first three rows and the last one is the real WPA3 benefit. For it to apply to your network, the router must be in WPA3-only mode, the firmware must include the Dragonblood patches, and all your devices must support SAE.

Hardware and software support in 2026

WPA3-SAE support is common on newer phones and laptops, while many IoT devices still support only WPA2. That can force transition mode or a separate 2.4 GHz IoT SSID. A practical layout is a WPA3-only main network plus a segmented WPA2 IoT network when older devices require it.

Access point support is more uneven. WPA3-only operation is implementation-dependent, so confirm it against the vendor's release notes and against the RSN IE the access point actually advertises rather than the marketing on the box. Consumer retail routers from the 2020-2022 generation often claim WPA3 support but only expose transition mode in the UI. If in doubt, check the RSN IE advertised in beacons with sudo iw dev wlan0 scan on Linux or Wireshark on any platform: a WPA3-only access point advertises the SAE AKM suites 00-0F-AC:8 and/or 00-0F-AC:24 and omits the WPA2 AKM suites 00-0F-AC:2 (PSK) and 00-0F-AC:6 (PSK-SHA256).

Operational guidance

The order below is the single most useful security upgrade for a home network, with decreasing return on effort:

1. 1

   Use a passphrase longer than 14 characters and not found in any wordlist. This alone defeats almost all real-world WPA2 attacks even on an AP running no WPA3 at all.

2. 2

   Switch to WPA3-only mode if every client you care about supports it. For IoT holdouts, put them on a separate SSID.

3. 3

   Keep router firmware current and check the vendor advisory for WPA3/SAE fixes before relying on WPA3-only mode.

4. 4

   Disable WPS and WPS-PIN. On routers that still accept a WPS PIN, and on chipsets vulnerable to Pixie Dust, recovering the PIN can be quicker than attacking WPA2 or WPA3; disable WPS/WPS-PIN regardless.

5. 5

   Change the default SSID. The SSID is the PBKDF2 salt on WPA2; a unique SSID defeats precomputed rainbow tables like the old WPA-PSK 1M table.

Why hashcat lists WPA modes 22000 and 22001 but not a WPA3 mode

Hashcat modes 22000 (WPA-PBKDF2-PMKID+EAPOL) and 22001 (WPA-PMK-PMKID+EAPOL) cover the WPA2 case because the handshake yields a verifiable offline check. Mode 22000 takes the capture, a WPA*01* PMKID line or a WPA*02* EAPOL line, and derives PBKDF2-HMAC-SHA1 from each candidate passphrase on the GPU. Mode 22001 takes precomputed PMKs as its candidate space instead, which is why a unique SSID defeats precomputed PMK tables. WPA3-SAE has no analogous mode because by design the transcript cannot verify a guess offline.

You will sometimes see references to "WPA3 cracking with hashcat." In almost every case the target is a transition-mode network where the attacker downgraded to WPA2 first, captured a 4-way handshake, and used mode 22000 as usual. Pure WPA3-only cracking with hashcat is not a feature that exists: SAE leaves nothing in the transcript that a GPU can check a candidate against. What does exist is interactive guessing, tooling that drives the SAE exchange itself one candidate at a time, which is an online attack bounded by how the access point responds to repeated failed attempts.

If you have a capture file and you are not sure what is inside, the handshake analyzer tells you which EAPOL messages and PMKIDs are present and whether the capture is attackable. For format conversion between old .hccapx and modern 22000 see the hccapx to 22000 guide.

Frequently asked questions