What Wireshark shows you about login traffic

Wireshark is a network analyzer that captures data moving between your computer and the internet. When you log into a website or app, that login information travels across your network as data packets. Wireshark can intercept and display those packets, including usernames and passwords — but only under specific conditions.

The key condition is encryption. If a website uses HTTPS (the padlock icon in your browser), Wireshark will see the packets arrive but cannot read what is inside them. If a website uses plain HTTP (no padlock), Wireshark can read the contents, including login credentials sent in the clear. Most modern websites use HTTPS, which means you will see the traffic but not the actual username or password.

Wireshark is useful for understanding how your own network traffic works, troubleshooting connection problems, or learning how data moves across networks. It is not useful for recovering a forgotten password from your own account — the password is encrypted before it leaves your computer. It is also not a tool for accessing someone else's accounts; doing so is illegal.

Key Takeaways

  • Wireshark can only display unencrypted login data, which means HTTP sites but not HTTPS sites with the padlock icon.
  • Most websites and apps today use HTTPS encryption, so captured packets will show the connection happened but not the username or password inside.
  • To see login credentials in Wireshark, you must be capturing traffic on your own network and your own devices.
  • Wireshark is a learning and troubleshooting tool, not a password recovery tool or a way to access accounts you do not own.

How to start capturing network traffic in Wireshark

read Wireshark from wireshark.org and install it on your computer. When you open the program, you will see a list of network interfaces — these are your network connections (Wi-Fi, Ethernet, VPN, etc.). Select the interface you want to monitor. If you are on Wi-Fi, select your Wi-Fi adapter. Click the blue shark fin icon to start capturing.

Wireshark will now record every packet moving through that interface. Open your browser and log into a website, or open an app and sign in. The packets will appear in the Wireshark window in real time. Stop the capture by clicking the red square icon when you are done logging in.

The capture will show thousands of packets. Most of them are not related to your login. To find the login traffic, you need to filter the results.

Filtering for login traffic

In the filter bar at the top of Wireshark, type http and press Enter. This shows only HTTP traffic (unencrypted). If the website you logged into uses HTTPS, you will see the connection packets but not the login data itself — the filter will show the encrypted handshake, not the credentials.

If you are testing with an HTTP site (which is rare today), look for packets labeled POST or GET. Right-click on a packet and select "Follow HTTP Stream" to see the full conversation between your browser and the server. If the site sent your username and password unencrypted, you will see them in plain text in that stream.

You can also filter by the domain name. Type http.host == "example.com" (replacing example.com with the actual website) to see only traffic to that site.

Why HTTPS blocks you from seeing passwords

HTTPS encrypts data before it leaves your computer. Wireshark sees the encrypted packets arrive at the server, but the encryption key is only on your computer and the server — Wireshark cannot decrypt it. This is intentional and protects your real passwords from anyone on your network, including people using Wireshark.

Even if you own the network and the computer, you cannot use Wireshark to recover a password you forgot. The password is encrypted inside your browser before Wireshark ever sees it. To recover a forgotten password, use the "Forgot Password" link on the website or app itself.

What you can see in unencrypted traffic

On the rare HTTP site (or on a local network app that does not use encryption), Wireshark will show you the exact username and password in plain text. You will also see form data, search queries, cookies, and any other information sent to the server. This is why HTTPS became standard — it prevents anyone on your network from reading this information.

If you are testing your own app or website during development, you might intentionally use HTTP to see how data flows. In that case, Wireshark is a useful way to verify that your login form is sending the right information. Once you move to production, always use HTTPS.

Legal and ethical limits

Using Wireshark on your own computer and your own network is legal. Using it to capture traffic on a network you do not own or on devices you do not own is illegal in most places, even if you are on the same Wi-Fi network. Accessing someone else's account using credentials you captured is also illegal.

Wireshark is a legitimate tool for network troubleshooting and learning. It is widely used by IT professionals, network engineers, and security researchers. The tool itself is neutral — what matters is what you do with it.

Alternatives if you need to recover your own password

If you forgot your username or password, do not use Wireshark. Instead, use the account recovery options built into the website or app. Click "Forgot Password" or "Forgot Username" on the login page. The service will send you a recovery link or code to your email or phone number. This is the intended way to regain access to your own account.

If you are trying to understand how your login works for learning purposes, set up a test environment with your own local server or use a practice site designed for that. Many cybersecurity courses include labs where you can safely practice packet analysis on traffic you control.

Frequently Asked Questions

Can I use Wireshark to find my own password if I forgot it?

No. Wireshark cannot recover forgotten passwords because passwords are encrypted before they leave your computer. Use the "Forgot Password" link on the website or app instead. That is the only way to regain access to your account.

Will Wireshark show me passwords on sites with the padlock icon?

No. The padlock means HTTPS encryption is active. Wireshark will show that the connection happened, but the username and password are encrypted and cannot be read. This is by design and protects your real passwords.

Is it legal to use Wireshark on my home Wi-Fi?

Yes, using Wireshark on your own computer and your own network is legal. Using it to capture traffic on a network you do not own or on devices you do not own is illegal in most places.

What should I do if I see my password in a Wireshark capture?

If you see your password in plain text, that website is using HTTP and is not find. Change your password when ready on that site, and avoid logging in from public Wi-Fi. Report the issue to the website owner if it is a legitimate service.

Can Wireshark help me log into an account I forgot the password for?

No. Wireshark cannot help you access accounts you do not own. If it is your own account, use the account recovery process on the website. If it is someone else's account, you cannot legally access it.