Why I Wrote This
How secure is the WiFi password printed on your router? To find out, I ran a live test against my own router and cracked its 8-digit numeric password in under three minutes, using a standard laptop and Hashcat. In this post, I’ll explain how the attack works and what it means for your WiFi security
What Is Hashcat?
Hashcat is a free, open-source password recovery tool widely used by penetration testers, security researchers, and IT professionals to evaluate password strength. Rather than guessing passwords manually, it leverages modern CPUs and GPUs to test millions, or even billions, of password candidates per second against captured cryptographic data.
Importantly, Hashcat doesn’t attack a live network. It works entirely offline using previously captured authentication data. In the case of Wi-Fi, this is typically a WPA/WPA2 handshake (EAPOL) or PMKID capture, allowing password guesses to be tested without any further interaction with the access point or client.
Hashcat supports hundreds of hash formats, from website passwords and encrypted files to VPN and wireless credentials. For this experiment, I used mode 22000, Hashcat’s format for WPA/WPA2 PMKID and EAPOL captures.
The Experiment: My Own Router, My Own Test Network
To be clear, everything here was performed on my own router, set up specifically for this test. This isn’t a guide for attacking someone else’s network. Unauthorized access is both illegal and outside the scope of this article.
The process was straightforward:
- Capture a WPA/WPA2 handshake as a device connected to the test network (I used Airtool on macOS).
- Convert the capture into a format Hashcat can process using the free utility
hcxpcapngtool. - Attack the resulting hash with Hashcat using a mask attack, a brute-force search constrained to a known pattern (in this case, eight digits).
- Wait for Hashcat to find the password or exhaust the search space.
The commands are
hcxpcapngtool -o hash.22000 wpa2.pcapng
!
hashcat -m 22000 -a 3 -O hash.22000 '?d?d?d?d?d?d?d?d'
This tells Hashcat to test every possible 8-digit numeric password against the captured Wi-Fi hash. That’s a search space of 100 million combinations (00000000-99999999). On my Apple M5 Pro, Hashcat processed roughly 250,000 guesses per second.
Result: the password was recovered in just 2 minutes 48 seconds.
Why Password Length and Complexity Matter
The real lesson here isn’t about Hashcat. It’s about password entropy: the number of possible combinations an attacker must try.
Consider how quickly the search space grows:
| Password Type | Possible Combinations |
|---|---|
| 8 digits (0-9) | 100 million |
| 12 digits (0-9) | 1 trillion |
| 12 characters (upper/lowercase, numbers, symbols) | Astronomically large |
What matters is that each additional character increases the work required for a brute-force attack. Expanding the character set from numbers alone to upper and lowercase letters, digits, and symbols increases the search space even further.
An 8-digit numeric password may seem long enough, but its password space is surprisingly small by modern computing standards. In contrast, a longer password that uses a mix of character types becomes vastly more resistant to offline cracking attacks.
This is one reason many default router passwords deserve scrutiny: they’re designed to be easy to print on a sticker and enter manually, but convenience doesn’t always align with security.
How to Protect Your Own Network
A few concrete takeaways if you want your own WiFi to hold up against this kind of attack:
- Replace the default password with a long, random passphrase, at least 16 characters, mixing case, numbers, and symbols. Length matters more than complexity tricks.
- Use a password manager to generate and store it, so you’re not tempted to pick something memorable (and therefore guessable).
- Enable WPA3 if your router supports it. WPA3 replaces WPA2’s handshake with SAE (Simultaneous Authentication of Equals), which resists exactly this kind of offline attack, even against a weaker password.
- For businesses, consider WPA2/WPA3-Enterprise with 802.1X instead of a single shared passphrase. There’s no one password to crack, each user authenticates with their own credentials.
