Wireshark shows you network traffic, but usernames appear only in unencrypted connections

Wireshark is a tool that captures and displays data moving across your network. If you are looking for a username you entered into a website or app, Wireshark can sometimes show it — but only if that connection was not encrypted. Most modern websites and apps use encryption (HTTPS, TLS, or SSL), which means Wireshark captures the traffic but cannot read what is inside it. If the connection is encrypted, you will see the data moving but not the username itself.

The practical reason to search Wireshark for a username is usually to recover one you forgot, or to understand what data an unencrypted app is sending. If you are testing your own network or device, Wireshark is a legitimate tool. If you are capturing traffic from someone else's device or network without permission, that is illegal in most places.

Key Takeaways

  • Wireshark can only show usernames sent over unencrypted connections; encrypted traffic (HTTPS) hides the username even though Wireshark sees the data moving.
  • To find a username, start a Wireshark capture, perform the login action, then stop the capture and search for the username text or filter by protocol.
  • HTTP traffic (not HTTPS) is the only common case where usernames appear in plain text, and most websites have moved away from HTTP.
  • If you cannot find the username in Wireshark, the connection is almost certainly encrypted, and no tool can decrypt it without the encryption key.

Start a Wireshark capture before you log in

Open Wireshark and select the network interface you want to monitor. On Windows, this is usually your Ethernet adapter or Wi-Fi adapter. On Mac or Linux, look for en0 or wlan0. Double-click the interface to start capturing.

Once the capture is running, go to the website or app where you want to log in and enter your username and password. Perform the complete login action. Then return to Wireshark and click the stop button (the red square icon in the toolbar) to end the capture. You now have a file containing all the traffic from that login attempt.

Search for the username using Wireshark's Find function

With the capture stopped, use Edit > Find Packet (or press Ctrl+F on Windows, Cmd+F on Mac). A search box appears at the bottom of the window. Type your username into the search field and click Find Next.

Wireshark will highlight any packet containing that text. If your username appears, it will be visible in the packet details pane below. If the search returns no results, the connection was encrypted and the username is not visible in the capture.

Filter by protocol to narrow the results

If you captured a lot of traffic and the search is slow or returns too many results, you can filter to show only certain types of traffic. In the filter bar at the top, type http to show only unencrypted HTTP traffic. Type tcp.port == 80 to show traffic on port 80, which is the standard unencrypted web port.

These filters help because usernames almost never appear in encrypted traffic. By filtering to HTTP only, you reduce the noise and focus on the unencrypted packets where a username might actually be visible. If you filter to HTTP and still find nothing, the login used HTTPS (encrypted) and the username is not recoverable from the capture.

Understand why most logins will not show a username

HTTPS, TLS, and SSL are encryption standards that protect data in transit. When you log into Gmail, your bank, or any major website, that connection is encrypted. Wireshark sees the encrypted data moving across the network, but it cannot read inside the encrypted tunnel. The username and password are hidden from view.

HTTP (without the S) is the unencrypted version. It was common years ago, but almost all websites have switched to HTTPS. Some older internal tools, local network services, or poorly maintained apps still use HTTP. Those are the only cases where a username will appear in plain text in a Wireshark capture.

Export packet data if you need to save or share the results

If you find the username in a packet, you can export that packet for documentation or further analysis. Right-click the packet in the list and select Export Packet Bytes, or go to File > Export Packet Dissections to save the packet details in a readable format.

You can also export the entire capture as a .pcap file (the standard Wireshark format) by going to File > Save As. This lets you close Wireshark and reopen the same capture later without re-running it.

Check the packet details pane for context

When Wireshark highlights a packet containing your username, look at the packet details pane (the middle section of the window). Expand the layers to see which protocol carried the username. If it shows Hypertext Transfer Protocol, the connection was HTTP and unencrypted. If it shows TLSv1.2 or TLSv1.3, the connection was encrypted and the username you are seeing is likely a false match (a coincidence where your username appears in a different context, like a URL or cookie name).

The packet details also show the source and destination IP addresses, the port number, and the exact bytes transmitted. This context helps you confirm whether you are looking at the actual login packet or something else.

Frequently Asked Questions

Can Wireshark decrypt HTTPS traffic?

Wireshark cannot decrypt HTTPS traffic unless you have the encryption key, which you do not have for external websites. For your own local testing, you can configure Wireshark to use a key file if you have access to the server's private key, but this is rare and requires technical setup.

What if I see my username in Wireshark but it is not the login packet?

Usernames often appear in multiple places: in URLs, in cookies, in email headers, or in other unrelated traffic. To confirm you found the actual login, look at the packet details and check whether the packet contains both the username and password, or whether it is part of an HTTP POST request to a login page.

Is it legal to use Wireshark to capture traffic?

Capturing traffic from your own device or network that you own or have permission to monitor is legal. Capturing traffic from someone else's device or network without permission is illegal in most jurisdictions. Always make sure you have the right to capture the traffic before you start.

Why does Wireshark show some traffic but not the username?

The traffic is encrypted. Wireshark can see that data is moving between your device and the server, but it cannot read what is inside the encrypted tunnel. This is the normal and expected behavior for find connections.

Can I use Wireshark to find usernames on apps, not just websites?

Yes, if the app sends login data over unencrypted HTTP. Most modern apps use encrypted connections, so usernames will not appear. Some older apps or internal tools may still use unencrypted traffic, and in those cases Wireshark can capture the username the same way it does for websites.