Understand WPA2 WPA3 and transition mode

Read the security choice as an admission rule

For WPA2, use AES encryption. Apple’s router guidance recommends WPA3-Personal where possible and WPA2/WPA3 Transitional for older-device compatibility. It accepts WPA2-Personal AES when those modes cannot be used. Avoid WEP, TKIP, original WPA and the older WPA/WPA2 mixed mode. Read both numbers: WPA/WPA2 is a different choice from WPA2/WPA3.

The security setting and the Wi-Fi password work together. Keep a strong, unique network password in every mode. Selecting WPA3 is not a reason to reuse an account password or share the household credential publicly.

WPA3 changes the password exchange

WPA2-Personal uses a pre-shared-key mechanism, commonly labelled PSK. WPA3-Personal replaces that authentication mechanism with Simultaneous Authentication of Equals, or SAE. You still enter a Wi-Fi password, but the exchange establishing the connection works differently.

One important gain is resistance to offline dictionary attacks: capturing an exchange does not provide the same opportunity to try a large password list later without interacting with the network. WPA3-Personal also requires protected management frames, which protect certain Wi-Fi control messages. Neither feature guarantees uninterrupted radio service or makes a weak household password a good choice.

HPE’s technical explanation identifies the transition-mode compromise: the WPA2 path remains available and shares the password with WPA3. Recovering that password through the WPA2 side can still give an attacker network access. It does not let them simply decrypt existing WPA3 sessions. Transition mode is therefore a compatibility arrangement, not equivalent to requiring WPA3 for everyone.

Use that distinction to set your goal. “My recent laptop connects using WPA3” and “every wireless device must use WPA3” are separate claims. The second requires removing the WPA2 option and checking all the devices you depend on.

Make a short inventory before changing anything

Work on a network you manage, at a time when a brief disconnection is acceptable. List essential wireless clients: your management phone, work computer, printer, television and any cameras or smart-home equipment. Include devices that sleep or connect only occasionally; an apparently quiet network can hide the one client that will fail tomorrow.

Record the current security setting for every available band and keep the existing Wi-Fi password accessible. Update the router firmware and affected device software before evaluating compatibility. Apple also advises preserving the existing router configuration before changes. Where a configuration export is unavailable, record the relevant settings manually.

Arrange a way to reach management if the phone’s Wi-Fi drops. For an app-managed system, check that the phone has working cellular data and that you can reopen the app before starting. If the app becomes unreachable after a change, stop and use the manufacturer’s recovery assistance; a factory reset would erase useful configuration and complicate diagnosis.

Keep the network name and password unchanged during this test. Changing three things together makes a failed reconnect much harder to interpret. Write one line per device with space for its previous connection, new connection and actual function.

Choose one band’s policy in eero

1. Open the eero app, then Settings → Network settings → Encryption. Record the displayed choices before editing.
2. For the 2.4 GHz or 5 GHz band you are evaluating, choose Hybrid to allow both protocols, or Enhanced to require WPA3. Enhanced displays a compatibility confirmation; read it before proceeding.
3. Leave other settings alone and allow affected devices to reconnect. Test this change before editing another band.

The dedicated eero encryption reference documents these labels. On models with 6 GHz, that band stays Enhanced and its setting is unavailable for editing. You cannot enable WPA2 there to rescue an older device. If your app lacks this documented page, update the app and check with eero support instead of substituting an old Labs-toggle procedure.

Check the protocol each device actually negotiated

In eero’s Home or Devices tab, select a connected client. Open Device information and inspect Security. This reports that client’s authentication protocol. Separately, Connected to identifies its eero and frequency band. The device-information guide documents both fields.

Identify an ambiguous entry by comparing its manufacturer, hostname or MAC address with the device’s own details. Record the observed band and protocol together. A WPA3 connection on 6 GHz does not prove that a separate 2.4 GHz band requires WPA3.

In a hypothetical home with eight wireless devices, six might reconnect through WPA3 while two remain on WPA2 under Hybrid. That is six WPA3 connections, not eight upgraded devices. Your inventory, rather than the router’s overall label, establishes what happened.

Then test real functions: print a page, play something on the television, and issue an ordinary smart-home command. On a portable device, check again after moving to another usual room and after sleep. Successful web browsing on one phone cannot establish that a sleeping printer or roaming laptop works.

Recover one failure, then choose the lasting policy

If an older client fails under Hybrid or Enhanced, eero recommends trying Standard on the affected 2.4 or 5 GHz band. Restore your recorded setting and retry the same task. Eero acknowledges that even Hybrid can cause legacy-device connection problems.

If restoring the setting restores operation, you have narrowed the problem to compatibility with the changed security policy. Keep the before-and-after record for the device manufacturer. If the problem persists after rollback, investigate that device’s connection separately instead of repeatedly weakening security.

A previously connected client may need to forget and rejoin the network after a security change. Do this only after checking that you have the password and a route back to management. Forgetting removes the saved connection; it cannot add WPA3 support to incompatible hardware.

Keep transition mode when you need both generations and your checks pass. Require WPA3 when the devices using that band support it and essential tasks still work. If a necessary older device forces WPA2, record that exception and revisit it when the device receives an update or is retired. The useful result is a policy you can explain and verify, with a known way back if a client fails.