How passwords are attacked · 5 min read
Wi-Fi passwords: how WPA2 and WPA3 use them
A Wi-Fi passphrase faces a different attack from a website password: under WPA2 it can be guessed offline, with no login limit.
The password on a home or small-office Wi-Fi network is a shared secret in the most literal sense: everyone who joins uses the same one. It also faces a different threat from a website password. There is no server counting failed logins and locking the account after a hundred tries. Under WPA2-Personal, someone within radio range can collect what they need and then guess at their own pace, offline. This guide explains how that works and what WPA3 changed.
From passphrase to key in WPA2-Personal
WPA2-Personal is the “pre-shared key” (PSK) mode. Every device and the access point hold the same 256-bit key. People do not type 256-bit keys, so the standard lets you enter either 64 hexadecimal digits (the key itself) or a passphrase of 8 to 63 ASCII characters, which is converted into the key.
The conversion uses PBKDF2, the password-based key derivation function from PKCS #5 (RFC 8018), with HMAC-SHA1. NIST SP 800-97 describes the standard’s passphrase-to-key scheme as one that “uses PKCS 5 and HMAC-SHA1.” The details, as implemented in the widely used open-source Wi-Fi software, are:
| Input | Value |
|---|---|
| Password | The passphrase |
| Salt | The network name (SSID) |
| Iterations | 4,096 |
| Output | 256 bits |
Two consequences follow. First, the network name acts as the salt, so the same passphrase gives a different key on a differently named network, and a precomputed table only works for one network name. Second, 4,096 iterations make each guess cost more than a single fast hash, but the count is fixed by the standard, not a tunable cost factor like those discussed in password hashing explained.
Why WPA2-Personal allows offline guessing
When a device joins, it and the access point run the four-way handshake to prove they hold the same key and to set up fresh session keys. The handshake messages travel over the air. They include random values from both sides and a message integrity code computed with a key derived from the PSK.
Anyone in range who records a handshake now has everything needed to test a guess: derive the key from a candidate passphrase and the SSID, recompute the integrity code, and compare. If it matches, the guess is right. None of this touches the network again. RFC 7664 describes this general weakness of protocols that exchange “password-derived data as a proof-of-knowledge of the password”: it “opens the exchange up to an offline dictionary attack.”
So a WPA2-Personal passphrase should be judged by offline guessing rates, not online ones.
Worked example: what the passphrase is up against
Each guess costs 4,096 PBKDF2 iterations. A 256-bit output needs two 160-bit HMAC-SHA1 blocks, each with its own 4,096 iterations, so one guess means 2 × 4,096 = 8,192 HMAC-SHA1 computations. That is slower than one fast hash, but it is not memory-hard, and the real rate depends on hardware. Rather than invent a figure, here are the site’s two illustrative offline rates (assumptions, not measurements) as a bracket:
| Scenario | Rate (assumed) | Situation |
|---|---|---|
| Online, rate-limited | 100 guesses per hour | a login form that slows down or locks out repeated failures |
| Offline, slow hash | 10,000 guesses per second | a stolen database hashed with a deliberately slow, salted scheme (bcrypt class) |
| Offline, fast hash | 100 billion guesses per second | a stolen database hashed with a fast unsalted hash (MD5, SHA-1 or NTLM class) on a high-end GPU rig |
| Passphrase | Bits | Average at 10,000/s | Average at 10^11/s |
|---|---|---|---|
| 8 random digits | 26.58 | about 1.4 hours | 0.0005 seconds |
| 8 random lowercase letters | 37.60 | about 121 days | about 1 second |
| 12 random letters and digits | 71.45 | about 5.1 billion years | about 511 years |
| 5 random EFF words | 64.62 | about 45 million years | about 4.5 years |
| 6 random EFF words | 77.55 | about 350 billion years | about 35,000 years |
The minimum length of 8 does not make a passphrase safe on its own; 8 random digits fall quickly even at the slow end. And everything here assumes a random passphrase. A Wi-Fi password made from a word, a street name or a phone number sits near the front of an attacker’s list, as described in what makes a password common.
Fitting a passphrase into 63 characters
The 63-character ceiling rarely bites, but it is worth checking for passphrases. EFF large-list words are between 3 and 9 letters long. Six words with five separators are at most 6 × 9 + 5 = 59 characters, so any 6-word passphrase fits. Seven words could reach 7 × 9 + 6 = 69 characters, which some draws would exceed. A 6-word passphrase also has to be typed on televisions and printers now and then, which is a fair argument for words over random symbols. See how many words in a passphrase and password length limits.
What WPA3-Personal changes
WPA3-Personal replaces the PSK handshake with SAE, Simultaneous Authentication of Equals, a variant of the Dragonfly key exchange that the IETF published as RFC 7664. Dragonfly is a password-authenticated key exchange: both sides prove they know the password without sending anything an eavesdropper can test guesses against.
RFC 7664 defines the property: “Resistance to dictionary attack means that an adversary must launch an active attack to make a single guess at the password.” A recorded exchange does not let an attacker check candidates offline. Each guess requires a live attempt against a real device, which the device can notice and limit. The RFC is also clear that this does not make the password irrelevant: an attacker can still guess actively, one exchange at a time, so the pool the password was drawn from should be “sufficiently large to make this attack preventable.”
Two practical limits apply:
- Mixed networks. Many access points can run WPA2 and WPA3 side by side so older devices can still join. Devices that join using WPA2 perform the WPA2 handshake, which is open to the offline guessing described above.
- Implementation quality. The protection depends on SAE being implemented correctly in both the access point and the device, and on their software being kept up to date.
Note: A Wi-Fi passphrase is shared by everyone who has joined the network, and any device that has stored it can reveal it. Its strength protects against outsiders guessing, not against someone who was given it.
Summary
- WPA2-Personal turns an 8-63 character passphrase into a key with PBKDF2-HMAC-SHA1, 4,096 iterations, salted with the network name.
- A captured four-way handshake allows unlimited offline guessing, so judge the passphrase by offline rates.
- A long random passphrase, such as five or six EFF words, stays out of reach even at fast offline rates.
- WPA3-Personal’s SAE removes offline guessing from a recorded exchange; guesses must be made live.
- Networks that also accept WPA2 keep WPA2’s exposure for the devices that use it.
Make a passphrase that fits within 63 characters with the passphrase generator.
Sources
General explanation, not advice for a particular situation. Updated 2026-10-31.