WPA2 vs WPA3: How the Key Is Agreed
How WPA3-Personal's SAE uses Diffie-Hellman to agree a fresh key for every connection, compared with WPA2's password-derived key, and what that means when a password leaks.
How to use this tool controls and what to look for
Start with Diffie-Hellman using small numbers, then compare where the WPA2 and WPA3 keys come from, and what happens when things go wrong.
Controls to change
- Client's private number: change the private numbers on each side, or press New random numbers.
- Password (make one up): enter a password and a Network name (SSID).
- View: switch between Step by step and Summary.
- Connect again: connect a second time and compare the keys.
- Situation: choose what happens: the password leaks later, someone tries to guess it, or two people know the same password.
What to look for
- Both sides reach the same secret, but the secret itself never crosses the air.
- WPA2's key is the same every time you connect. WPA3's key is new on every connection.
- If the password leaks later, recorded WPA2 traffic can be read, but WPA3 traffic stays private (forward secrecy).
- With WPA3, every password guess needs a live exchange with the AP, so offline guessing no longer works.
About this tool
WPA3-Personal replaced WPA2's password-derived key with a Diffie-Hellman exchange called SAE (Simultaneous Authentication of Equals). This tool shows Diffie-Hellman step by step with small numbers, including exactly what someone listening can see, then compares where WPA2 and WPA3 get their keys and what that changes when a password leaks or someone tries to guess it.
What you'll learn
- How Diffie-Hellman lets two sides agree a secret over an open channel
- Why the WPA2-Personal key is the same for every connection, and the WPA3 key is new each time
- What forward secrecy means, and why WPA3 stops offline password guessing
- Where else Wi-Fi uses Diffie-Hellman: Enhanced Open (OWE), Enterprise and Easy Connect
Common questions
What is SAE in WPA3?
Simultaneous Authentication of Equals: a password-authenticated Diffie-Hellman exchange that gives each connection its own fresh master key.
Is WPA3 more secure than WPA2?
For Personal networks, yes: with WPA3, recorded traffic stays private if the password later leaks, and passwords can't be guessed offline. Long passphrases still matter for WPA2 devices.
What is WPA3 transition mode?
One network offering both WPA2 and WPA3, so older devices can still join. Only the devices that use WPA3 get its protections.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.