Mac won't connect to a WPA3 or Wi-Fi 7 router

A new router, or a firmware update, can switch the network to WPA3, require protected management frames or turn on Wi-Fi 7 features. A Mac with a saved WPA2 profile, or an older Mac, can then fail to join.

Fix this with your agentCopies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: Mac won't connect to a WPA3 or Wi-Fi 7 router. Read https://kilobat.app/guides/mac-wpa3-wifi7-router-wont-connect.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: macOS 14 Sonoma and later for the System Settings steps.Checked: 7 November 2026

Symptoms

The Mac asks for the password again and again, although the password is correct.
The Mac shows that it could not join the network.
Joining from Terminal with networksetup gives error -3912.
The Mac joins, then drops after a short time.
The problem started after a router change, a firmware update or a switch to WPA3.

Likely causes

An authentication failure. In Apple's CoreWLAN framework, error -3912 is kCWChallengeFailureErr. The header says that authentication was rejected because of a challenge failure. Apple documents no more detail.
A saved WPA2 profile. FRITZ! says that a device can stay on WPA2 until you set up the connection again. It also says that WPS and QR codes usually connect with WPA2.
WPA3 only, or PMF required. Ubiquiti says that the Required PMF option enforces PMF for all clients. A WPA3-only network needs it. Devices without PMF or WPA3 then cannot join.
WPA2/WPA3 transition mode. Google says that some WPA2 devices are incompatible with transition mode. Sky says that devices without WPA3 support can fail to connect or keep disconnecting.
Wi-Fi 7 features. Ubiquiti says that turning on Multi-Link Operation (MLO) also turns on WPA3. Apple lists MLO only for Macs with the N1 chip.
An old router security mode. Apple recommends WPA3 Personal or WPA2/WPA3 Transitional. Apple says to avoid WPA, WEP and TKIP.

How to check

Make sure that the password is correct. Join the network from an iPhone to test it.
Open Terminal. Show the security of the networks that the Mac sees.
```
system_profiler SPAirPortDataType
```
Output The Security line shows, for example, WPA2 Personal or WPA3 Personal.
Find your Mac model. Choose Apple menu > About This Mac.
Compare it with Apple's Wi-Fi specifications. Only Macs with the N1 chip list Wi-Fi 7 and MLO.
Sign in to the router. Note the security mode, the PMF setting and whether MLO is on.

How to fix it

Forget the network on the Mac. In System Settings > Wi-Fi, click Details, then click Forget This Network.
Join the network again from the Wi-Fi menu. Type the password. Do not use WPS or a QR code.
On the router, set the security to WPA2/WPA3 Transitional if any device cannot use WPA3.
Set PMF to Optional instead of Required, if the router has this setting.
If you turned on MLO, turn it off for a test. Then join again.
Install the latest router firmware and the latest macOS update.
If the Mac still cannot join, use one network name with WPA3 for new devices. Put old devices on a separate WPA2 network, if the router allows it.
If the problem is 6 GHz only, see Mac can't see or join a 6 GHz Wi-Fi network.

The exact menus for your router, from FRITZ!Box and Xfinity to eero and Livebox: router guides.

With Kilobat

Show the current network, band, channel, signal and link rate after the Mac joins.
```
kilobat wifi
```
Show the saved networks in order of preference. A stale entry can stay here after a router change.
```
kilobat wifi known
```
Join a saved network or a new one from Terminal. Kilobat reads the password from standard input.
```
kilobat wifi join "Home" --password-stdin
```
If the Mac joins but drops, show the drops and roams.
```
kilobat outages
```

Questions

Where is the WPA3 setting on an eero?

In the eero app, go to Settings > Advanced networking. The Wireless section has the WPA3 toggle. eero says that 6 GHz always uses WPA3, even with the toggle off.

Where is the WPA3 setting on Google Nest Wifi?

In the Google Home app, go to Wi-Fi > Settings > Advanced networking > Use Wi-Fi Protected Access 3. Google says to turn it off if older WPA2 devices have problems.

Which UniFi settings matter?

Open Settings > WiFi and select the network. Security Protocol offers WPA2/WPA3. PMF offers Optional, Required or Disabled, and Optional is the default.

What about a FRITZ!Box?

Go to Wi-Fi > Security. An option there improves compatibility with older devices. FRITZ! says that it turns on WPA2, turns off PMF for 2.4 GHz and stops MLO.

What about a Sky Max or Gigafast+ Hub?

In the My Sky app, tap Broadband > WiFi Settings > Advanced settings > WiFi security level. WPA3-T is the default. WPA2 is the option for devices that cannot use WPA3.

What about a NETGEAR Nighthawk WiFi 7 router?

The security setting is on the BASIC > Wireless page. WPA2-Personal + WPA3-Personal is the default for 2.4 and 5 GHz. The 6 GHz network always uses WPA3-Personal.

What about a Verizon Router?

Verizon says that turning on Wi-Fi 6E switches the primary network to WPA3. Devices that use WPA2 can then disconnect. Verizon suggests its IoT network, which uses WPA2, for them.

Which Macs support WPA3?

Apple's security guide lists WPA3 and PMF support by Mac model. Install the latest macOS your Mac can run. FRITZ! says that macOS older than 10.15 does not support WPA3.

Does Wi-Fi 7 need a Wi-Fi 7 Mac?

A Mac without Wi-Fi 7 can join a Wi-Fi 7 router with an older standard. Apple lists Wi-Fi 7 for MacBook Pro with M5 Pro or M5 Max and MacBook Air with M5.

Sources

Checked on 7 November 2026.