Wi-Fi Password Recovery for Home Networks

WPA (Wi-Fi Protected Access) and WPA2 are the most widely used security protocols for home and business wireless networks. When you set a password on your router, that password is used as a Pre-Shared Key (PSK) to encrypt all communication between your devices and the access point.

Over time, it's common to forget this password — especially if it was set years ago, changed by an ISP technician, or if the router's label has faded. Many users find themselves locked out of their own network after a factory reset, device migration, or simply because the saved password was lost when a computer was replaced.

Wi-Fi password recovery works by analyzing a handshake capture — a recording of the encrypted authentication exchange that happens when any device connects to the network. By testing millions of candidate passwords against this captured handshake, the correct password can be identified without ever needing physical access to the router.

Our service uses powerful dedicated servers to dramatically accelerate this process. What would take a home computer weeks or months can be accomplished in hours or even minutes on our infrastructure.

The WPA/WPA2 authentication process uses a mechanism called the four-way handshake. This is a series of four EAPOL (Extensible Authentication Protocol over LAN) packets exchanged between a client device and the access point when the client connects (or reconnects) to the network.

During this process, both sides prove knowledge of the password without transmitting it directly. Instead, they exchange nonces (random values) and derive temporary encryption keys. The critical information needed for offline password testing is contained within these handshake messages.

To capture a handshake, you need to be within Wi-Fi range of your own network and use a monitoring tool while a device connects. Many routers also broadcast PMKID (Pairwise Master Key Identifier) values, which can be captured without waiting for a client to connect — making the process even simpler for network owners.

Before you can recover your Wi-Fi password, you need to capture a WPA handshake from your own network. This is a recording of the authentication exchange that happens when any device connects to your router. Below are instructions for the most common tools.

WPA/WPA2-PSK uses PBKDF2-SHA1 with 4096 iterations to derive encryption keys from the password and SSID. This makes each password guess computationally expensive — which is why powerful dedicated servers make such a dramatic difference.

Dictionary Attacks: We maintain a curated library of over 10 billion password entries compiled from publicly available breach databases, common password patterns, and Wi-Fi-specific wordlists. These include ISP-default passwords, common router password formats (e.g., 8-digit numeric codes from popular manufacturers), and linguistically diverse entries covering multiple languages.

Rule-Based Mutations: Beyond raw dictionary entries, we apply thousands of transformation rules — appending numbers, replacing characters with symbols, capitalizing patterns, combining words, and applying leet-speak substitutions. A single base word can generate thousands of unique candidates.

Mask Attacks: For passwords that follow a known structure (e.g., "word + 4 digits"), we can systematically enumerate all possibilities within that pattern. This is particularly effective for ISP-generated default passwords that follow predictable formats.

PMKID Attack: If your capture file contains a PMKID (available on many modern routers), we can test passwords without requiring a complete four-way handshake. This is faster and more reliable since the PMKID can be captured from a single probe request.

WPA (2003): The original Wi-Fi Protected Access protocol was introduced as an interim replacement for the deeply flawed WEP standard. WPA uses TKIP (Temporal Key Integrity Protocol) for encryption. While significantly better than WEP, TKIP has known vulnerabilities. WPA handshakes are fully supported by our recovery service.

WPA2 (2004): The successor to WPA, using AES-CCMP for encryption instead of TKIP. WPA2 has been the standard for home and enterprise networks for nearly two decades. The PSK (Pre-Shared Key) variant used in home networks derives keys using PBKDF2 with 4096 iterations of HMAC-SHA1. This is the most common protocol we encounter and recover passwords for.

WPA3 (2018): The latest generation uses SAE (Simultaneous Authentication of Equals), also known as the Dragonfly protocol. WPA3 was specifically designed to resist offline dictionary attacks — meaning capturing a handshake does not provide enough information for offline password testing. We do not support WPA3 recovery because the protocol fundamentally prevents the type of offline analysis that our service performs.

If you're unsure which protocol your router uses, check the router's admin page. Most routers manufactured before 2020 default to WPA2. Even newer routers often run in WPA2/WPA3 mixed mode, and captures from the WPA2 side remain recoverable.