WPA3 improvements: SAE (Simultaneous Authentication of Equals — resists offline dictionary attacks), forward secrecy (captured traffic can't be decrypted later), OWE (encrypts open Wi-Fi).
WPA2-PSK: offline brute-force against captured handshake. WPA3-SAE (Dragonfly): each authentication uses unique parameters — offline cracking impossible. WPA3-Enterprise: 192-bit security suite. Upgrade access points and clients to WPA3 when possible.