Crack WPA2 WiFi Passwords with Aircrack-ng (2026)

How WPA2 Cracking Actually Works

WPA2 cracking is the process of capturing a network's 4-way handshake and then testing password guesses against it offline until one matches. Despite what movies suggest, it isn't a magical real-time process — it's offline brute-force, and it works like this:

1. Capture a handshake. When a device connects to a WPA2 network, it performs a "4-way handshake" with the access point. This handshake contains cryptographic material derived from the WiFi password — but not the password itself.
2. Take the handshake offline. Once you have the captured handshake (a small file, usually under 1 MB), you can disconnect from the area entirely.
3. Guess and verify. You feed the handshake to a cracking tool along with a wordlist. The tool hashes each candidate password the same way the device would, then compares it to the captured handshake. If it matches, you've found the password.

This is why WPA2 cracking can never break a truly strong password — it relies entirely on the password being something a wordlist might contain. A 20-character random password like K9$mP2vN!xQ7&hL3wR8 would take longer than the age of the universe to crack. Most home networks, though, use passwords like password123, familyname2024, or the default printed on a router sticker — and those crack in minutes.

Prerequisites

Before you can do anything, you need:

• Kali Linux — physical install or VM with USB passthrough (VirtualBox install guide)
• A USB WiFi adapter that supports monitor mode + packet injection — your laptop's built-in WiFi almost certainly does not. The Alfa AWUS036NHA (AR9271 chipset) is the safest beginner choice. See my complete WiFi adapter guide for current 2026 recommendations including the AWUS036ACH (RTL8812AU) for dual-band and the AWUS036AXML (MT7921AUN) for WiFi 6E.
• A target network you own or have authorization to test — see legal warning above
• A good wordlist — rockyou.txt as a starting point, then larger and targeted lists. See my wordlists guide.
• Optional but recommended: a discrete GPU. Cracking with hashcat on an RTX 4060 or better is roughly 100-185x faster than CPU cracking with aircrack-ng.

Install the tools

Kali ships with aircrack-ng pre-installed. You'll also want hcxtools (modern handshake conversion) and hashcat:

Step 1: Identify Your Wireless Interface

Find the name of your USB WiFi adapter (usually wlan0 or wlan1):

If you don't see your USB adapter in iwconfig output, it may not be recognized. Run lsusb to confirm it's connected and dmesg | tail to check for driver errors.

Step 2: Enable Monitor Mode

Monitor mode lets the adapter capture all wireless traffic in the air, not just packets addressed to you.

Step 3: Scan for Nearby Networks

Use airodump-ng to see all WiFi networks within range:

Key columns to note:

• BSSID: The access point's MAC address (you'll need this exact value)
• PWR: Signal strength. Closer to 0 = stronger. Below -75 is often too weak to capture reliably.
• CH: The channel the AP broadcasts on (you'll lock to this channel)
• ENC: Encryption type. WPA2 is the target for this tutorial. WPA3 SAE is not vulnerable to this attack.

Press Ctrl+C to stop scanning. Copy the BSSID and note the channel of your target network — you'll need both in the next step.

Step 4: Capture the Handshake

Now focus airodump-ng on just your target network and write captures to disk:

Leave this running. The output now shows just your target network plus connected clients (devices already connected to it). Watch the top-right corner — when a 4-way handshake is captured, you'll see WPA handshake: AA:BB:CC:DD:EE:FF.

How handshakes happen

A handshake occurs whenever a device first connects (or reconnects) to the network. If you wait, devices will naturally connect throughout the day. But you can also force one with a deauthentication attack.

Step 5: Force a Handshake (Deauth Attack)

Open a second terminal (leave airodump-ng running in the first). Send deauth packets to a connected client, forcing it to reconnect — which produces a handshake:

The -0 5 means "send 5 deauth packets." Watch your first terminal (airodump-ng) — within a few seconds you should see WPA handshake appear at the top.

Once you see "WPA handshake," press Ctrl+C in the airodump-ng terminal. You now have a capture file (e.g., capture-01.cap) in your current directory.

Alternative: The PMKID Attack (No Client Needed)

The classic 4-way handshake method requires a client to be connected and forcing it to re-authenticate. In 2018, researchers discovered the PMKID attack, which can extract crackable material directly from the AP without any client.

This is huge for situations where: (a) no clients are connected, (b) clients are too far away to deauth reliably, or (c) the network uses 802.11w to block deauth attacks.

Note: PMKID extraction isn't fully passive — hcxdumptool sends a single authentication request to the AP. Many modern APs are patched to not include the PMKID in their response, but plenty still leak it. The attack succeeds against routers from most major consumer brands.

Step 6: Convert to Hashcat Format (.hc22000)

The classic .cap format and the older .hccapx format are both deprecated as of hashcat 6.2.4+. Modern hashcat uses the unified .hc22000 format, which handles both 4-way handshakes and PMKIDs in one file format with one mode (-m 22000).

If hcxpcapngtool outputs nothing or reports "no hashes found," the handshake wasn't fully captured. Common causes:

• Only a partial handshake (missed messages 1, 2, 3, or 4 of the 4-way exchange)
• Client was too far from your adapter, causing dropped frames
• You captured the wrong network's traffic

Solution: re-capture with stronger signal, or open the .cap file in Wireshark with the display filter eapol to inspect what was actually captured.

Step 7: Crack with Hashcat (Recommended)

This is where the real cracking happens. Hashcat uses your GPU and is dramatically faster than aircrack-ng's CPU-based cracking.

Basic dictionary attack

Dictionary + rules (much more effective)

Rules tell hashcat to mutate each wordlist entry automatically — appending years, capitalizing letters, substituting characters. A 14M wordlist with best64.rule generates 900M+ candidates without storing them on disk.

Mask attack for known patterns

If you know the password structure (e.g., 8 digits, or starts with a known prefix), mask attacks are much faster than brute force.

Performance tuning

When hashcat finds a match, it shows the result like:

Alternative: Crack with Aircrack-ng (CPU)

If you don't have a GPU or just want the simpler workflow, aircrack-ng can crack directly from the .cap file. It's slower — roughly 14,000 keys/second on a fast CPU versus 2,600,000+ on a modern GPU with hashcat — but it works and the syntax is straightforward.

For anything beyond a basic rockyou.txt run, switch to hashcat. The speed difference is enormous and grows as wordlists get bigger.

Performance Comparison: Aircrack-ng vs Hashcat

Numbers are approximate and vary with hashcat version, drivers, and exact silicon. The takeaway: if you have any modern GPU, use hashcat. The conversion step is trivial and the speed difference is the difference between cracking in minutes versus hours.

Wordlist Strategy

The cracking tool is only as good as your wordlist. A few strategic notes:

1. Start with rockyou.txt. It cracks a surprising number of weak home WiFi passwords. Pre-installed at /usr/share/wordlists/rockyou.txt.gz (decompress first).
2. Add hashcat rules. best64.rule turns a 14M wordlist into 900M+ candidates. The OneRuleToRuleThemAll.rule is even more aggressive.
3. Filter by WPA2 length requirements. WPA2 passwords are 8-63 characters. Filter your wordlist: awk 'length >= 8 && length <= 63' wordlist.txt > wpa-wordlist.txt
4. Build targeted lists. Use CeWL to scrape company/family/local words. Use CUPP to generate variations from personal info.
5. For company audits: Combine company name, location, founding year, common phrases. People reuse these in passwords constantly.

See my complete wordlists and password dictionaries guide for download links and advanced generation techniques.

How to Defend Against This Attack

Understanding the attack also tells you how to defend. If you're protecting a WiFi network:

• Use a strong, random password. At least 15 characters, mix of letter cases, numbers, and symbols. No dictionary words, no personal info. diceware-style passphrases (5+ random words) are also strong.
• Upgrade to WPA3 if possible. WPA3 uses SAE (Simultaneous Authentication of Equals) which is resistant to offline dictionary attacks. The attacks in this article don't work against a properly configured WPA3-only network.
• Enable Protected Management Frames (802.11w). This blocks deauth attacks. Most modern routers support it.
• Disable WPS. WPS PIN attacks bypass the password entirely. There's no good reason to leave WPS enabled.
• Change default credentials. Router stickers with default WiFi passwords end up in wordlists.

Common Issues & Troubleshooting

"Monitor mode not supported"

Your adapter's chipset doesn't support monitor mode. This is the #1 issue beginners hit. Built-in laptop WiFi cards almost never work. You need a USB adapter with a compatible chipset — see my adapter guide for current 2026 options.

"Injection test failed"

Run sudo aireplay-ng --test wlan0mon. If it fails, either the adapter doesn't support packet injection (different from monitor mode) or you're too far from any AP to inject reliably. Get closer or switch adapters.

"No handshake captured even after deauth"

A few possible causes: (1) no clients are actually connected to the target network, (2) the AP uses 802.11w PMF which blocks deauth, (3) your signal is too weak to either deauth the client or capture the handshake response, (4) the AP is on a different channel than you thought.

Try the PMKID attack instead — it doesn't require a client and works even when deauth is blocked.

"hcxpcapngtool says: no hashes written"

The capture file doesn't contain a complete handshake. Re-capture with stronger signal and a longer capture window. Open the file in Wireshark and filter by eapol to see what was actually captured.

"Hashcat: no devices found"

If running Kali in a VM, hashcat can't access the host's GPU. You need to run hashcat on the host OS or on a physical Kali install. Cracking in a VM with software fallback is impractically slow.