WPA2 vs WPA3: What to Pick in Your QR Code
Your WiFi QR generator asks you to choose a security type, and your router offers WPA2, WPA3 and something called "WPA2/WPA3". Pick wrong and the code may scan perfectly but refuse to connect. Here is how to choose without guessing.
In this guide
The short history
- WEP (1999): broken for many years. It can be cracked quickly with freely available tools. Don't use it.
- WPA (2003): a stopgap fix for WEP, now also outdated.
- WPA2 (2004): the long-time standard using AES encryption. Still widely used and reasonably secure with a strong password.
- WPA3 (2018): the current standard. Since 2020, devices must support it to earn Wi-Fi CERTIFIED status for new products.
What WPA3 improves
For home ("Personal") networks, the headline change is the handshake. WPA2-Personal uses a pre-shared key (PSK) handshake; WPA3-Personal uses SAE (Simultaneous Authentication of Equals).
- Offline guessing protection. With WPA2, an attacker who captures the handshake can try millions of passwords offline. SAE is designed to resist this, so each guess requires interacting with the network.
- Forward secrecy. If your password leaks later, previously captured WPA3 traffic can't simply be decrypted with it.
- Protected management frames (PMF) are mandatory, which helps prevent certain disconnection attacks.
- Wi-Fi Enhanced Open (OWE) is a related feature for public networks without passwords; it encrypts each connection even when there's no password. It's separate from WPA3-Personal and not all devices support it.
None of this makes a weak password safe. "12345678" is weak on WPA3 too, since anyone who scans your QR code or guesses it can join. Length still matters.
What device support looks like
WPA3-Personal is supported by most devices made in the last several years:
- Android: Android 10 and later, if the phone's WiFi hardware supports it.
- iPhone and iPad: iOS/iPadOS 13 and later on iPhone 7 and newer.
- Windows: Windows 10 (version 1903 and later) and Windows 11, with a compatible WiFi adapter and driver.
- macOS: recent versions on Macs with supported WiFi chips.
Older laptops, smart plugs, printers, game consoles, streaming sticks and budget IoT devices often still support only WPA2. That's why a WPA3-only network can leave your printer or smart bulb offline.
Router modes explained
Your router typically offers:
- WPA2-Personal (AES): maximum compatibility, weakest of the three options. Avoid "TKIP" or "WPA/WPA2 TKIP" settings, which are older and slower.
- WPA2/WPA3-Personal (transition or mixed mode): WPA3 devices use WPA3; older devices use WPA2. The most practical choice for most homes.
- WPA3-Personal (SAE only): best security, but every device must support WPA3.
Transition mode does have one trade-off: an attacker might try to push a WPA3 device to use WPA2 instead. Newer devices and the WPA3 "transition disable" feature reduce this risk, and with a strong password the practical danger for a home is small.
What to choose in your QR code
Here's the part that confuses people. WiFi QR codes don't usually list WPA2 or WPA3 separately. The standard field is T:WPA:
WIFI:T:WPA;S:HomeNet;P:Lantern-Cobalt-91;;That single value covers WPA, WPA2 and WPA3 Personal. When a phone scans it, it looks at what the router offers and uses the strongest protocol both support. So:
- Router on WPA2: pick WPA in the generator.
- Router on WPA2/WPA3 mixed: pick WPA.
- Router on WPA3-only: pick WPA. Phones with WPA3 support will join; older ones will fail whatever the QR code says.
- Router on WEP: pick WEP, but really, change the router setting.
- Open network: pick None / nopass.
Some generators offer "WPA3" or write T:SAE. The Wi-Fi Alliance's WPA3 specification describes extra optional fields for WPA3, but not every scanner supports them. If you choose a WPA3-specific option and the code fails on some phones, regenerate it with plain WPA. More on fields in WiFi QR Code Format Explained.
On Android, Wifi QR Connect lets you create a WiFi QR code by choosing the SSID, security type and password, then scan it back to check. It also offers hotspot QR sharing, a download/upload speed test and current WiFi connection info, which can show the link details of the network you're on. Scan history stays on your device.
How to check which one you're using
- Android: open the network details in WiFi settings; look for "Security", showing WPA2-Personal, WPA3-Personal or similar.
- iPhone: iOS doesn't show it plainly in every version. A "Weak Security" warning under the network name means WPA/WPA2 TKIP or WEP, in which case upgrade the router setting.
- Windows: Settings > Network & internet > Wi-Fi > your network properties shows "Security type". Or run
netsh wlan show interfacesin Command Prompt. - Router: the wireless security page shows the mode directly.
Recommended setups
- Typical home with mixed old and new devices: WPA2/WPA3 mixed, strong password, QR code with T:WPA.
- New devices only, privacy-conscious: WPA3-only. Test every device, including smart TVs.
- Guest network: WPA2/WPA3 mixed, so visitors with older phones can join. See How to Set Up a Guest WiFi Network.
- Café or event: WPA2/WPA3 mixed with client isolation, printed QR codes, password rotation. See WiFi QR Code for Restaurants and Cafes.
- Phone hotspot: many Android phones offer WPA3 or WPA2/WPA3 hotspot options. Choose mixed if laptops struggle.
Troubleshooting after switching to WPA3
- Device can't connect: it probably lacks WPA3 support. Switch to mixed mode or update the device's WiFi driver or firmware.
- Phone keeps old settings: forget the network and scan the QR code again.
- Windows laptop drops connection: update the WiFi adapter driver from the laptop maker's site.
- Smart home device offline: many only support WPA2 on 2.4 GHz. Use mixed mode, or put them on a separate WPA2 IoT network.
For other connection errors after scanning, see WiFi QR Code Not Working? 9 Fixes That Work.
A step-by-step switch to mixed mode
If your router is still on WPA2 and you want the benefits of WPA3 without breaking anything, this order works well:
- Log in to the router app or admin page and note the current settings.
- Update the router firmware first; WPA3 options sometimes only appear after an update.
- Change the wireless security from WPA2-Personal to WPA2/WPA3-Personal for each band (2.4 GHz, 5 GHz and 6 GHz if present). Keep the same network name and password.
- Save and wait for the router to restart its WiFi.
- Check that your phones, laptops, TV, printer and smart devices reconnect. Most will do so automatically because the password didn't change.
- Test your existing QR code on a phone that has forgotten the network. Because the code uses T:WPA, it should keep working without reprinting.
Note that 6 GHz WiFi (WiFi 6E and WiFi 7) requires WPA3 or Enhanced Open, so routers with 6 GHz bands use WPA3 there automatically.
Password still matters most
Whatever mode you pick, a long password is the foundation. Aim for 12 to 20 characters. Because guests scan a QR code, you can choose something long without inconveniencing anyone. Keep the code private; Is It Safe to Share WiFi With a QR Code? explains why.
FAQ
Should I choose WPA2 or WPA3 in my QR code generator?
Choose WPA. It covers WPA2 and WPA3 personal networks, and phones negotiate the correct protocol with your router automatically.
Is WPA3 much safer than WPA2?
WPA3 resists offline password guessing and adds forward secrecy, which makes it meaningfully stronger. WPA2 with a long, random password is still reasonable for most homes.
Why can't my old laptop connect after I enabled WPA3?
It likely doesn't support WPA3. Switch your router to WPA2/WPA3 mixed mode or update the laptop's WiFi driver.
What is WPA2/WPA3 transition mode?
It lets WPA3-capable devices use WPA3 while older devices use WPA2 on the same network. It's the most compatible secure choice for most homes.
Does the QR code itself use WPA3 encryption?
No. The QR code just stores the network name, type and password as plain text. WPA2 or WPA3 protects the WiFi connection after the device joins.