You cannot crack a WiFi password in any practical sense, and attempting it is illegal
Cracking a WiFi password means using software to guess or reverse-engineer the password protecting a network that is not yours. This is a federal crime under the Computer Fraud and Abuse Act, regardless of whether you succeed. The penalty is up to ten years in prison and fines up to $250,000. Even on your own property, if the network belongs to someone else — a landlord, a business, a previous owner — you have no legal right to break in.
The technical barrier is also much higher than popular articles suggest. Modern WiFi uses WPA3 encryption on new devices and WPA2 on older ones. Both are designed so that even if someone captures the data flowing between your device and the router, they cannot read it without the password. Older WEP encryption could be cracked in minutes; WPA2 and WPA3 cannot be cracked by brute force in any timeframe that matters. A computer trying every possible password would take centuries.
If you have forgotten your own WiFi password, there is a straightforward legal path. If you need internet access on a network that is not yours, there are also real options that do not involve breaking the law.
Key Takeaways
- Attempting to crack any WiFi password you do not own is a federal crime with penalties up to ten years in prison, even if you fail.
- Modern WiFi encryption (WPA2 and WPA3) cannot be broken by guessing the password, because the math makes it take longer than human civilization has existed.
- If you forgot your own password, you can reset the router to factory settings and set a new one, or contact your internet provider for help.
- If you need internet access, public WiFi at libraries and coffee shops, mobile hotspots, or asking your neighbor are all legal alternatives.
How modern WiFi encryption actually works
When you connect to a WiFi network, your device and the router perform a handshake — they exchange information to prove they both know the password, without ever sending the password itself over the air. This is why someone listening to your WiFi signal cannot straightforward read the password out of the data stream.
The handshake uses a mathematical function that is designed to be one-way. You can verify that someone knows the password without ever revealing what it is. This is the same principle that protects your bank login and your email. Even if an attacker captures the entire handshake, they would have to guess the password and run it through the same function millions of times to see if it matches. With a strong password — 12 characters or longer, mixing letters, numbers, and symbols — the number of possible combinations is so large that a computer would need longer than the age of the universe to try them all.
This is not a limitation of current computers. It is a mathematical certainty. Faster computers do not help, because the problem scales. A password that would take one computer 1 billion years to crack would take 1 billion computers 1 year to crack — but you would need those 1 billion computers, and you would need to coordinate them, and you would need to know which network you were attacking. By then, the router's owner would have changed the password.
Why "WiFi cracking tools" you see online do not work the way they claim
Software with names like Aircrack-ng, Hashcat, and others are real tools used by security researchers and network administrators to test their own networks. They do not crack passwords by guessing. Instead, they work by capturing the handshake between a device and the router, then comparing it against a dictionary of common passwords.
This only works if the password is weak — something like "password123" or "qwerty" or the router's default password that was never changed. If the password is anything the owner chose themselves and it is longer than eight characters, the dictionary attack fails. The tool has no way to know whether it has tried the right password or not; it can only check whether a guess matches the captured handshake. Without a dictionary of millions of passwords to try, it is stuck.
Articles claiming you can "crack any WiFi password in minutes" are either describing attacks on networks with default passwords (which the owner should have changed when ready), or they are misleading. The tool cannot create new passwords to try; it can only check passwords someone else has already guessed.
What to do if you forgot your own WiFi password
If the network is yours and you have forgotten the password, you can reset the router. On the back or bottom of the router, there is a small reset button, usually recessed so you cannot press it by accident. Hold it down for 10 to 15 seconds while the router is powered on. The router will restart and return to its factory settings, which means the WiFi will be open (no password) and the admin password will be the default one printed on the router's label.
Once the router restarts, connect to the WiFi network, then open a web browser and go to the router's admin page — usually 192.168.1.1 or 192.168.0.1, or check the label on the router. Log in with the default username and password from the label. From there, you can set a new WiFi password and a new admin password.
If you do not want to reset the router, contact your internet provider. They have access to your account and can often reset the password remotely or send you a new one by email. This is faster if you have other devices already connected to the network, because resetting the router will disconnect them all and you will have to reconnect them one by one.
Legal ways to get internet access if you do not have a network
Public WiFi is available at most public libraries, coffee shops, fast food restaurants, and community centers. Libraries often have the fewest restrictions and the fastest speeds. You do not need to buy anything; you just need to be in the building. Some libraries require a library card, which is free to get if you live in the area.
If you need internet at home, a mobile hotspot from your phone or a dedicated hotspot device lets you share your mobile data with other devices. This costs money — usually $10 to $50 per month depending on how much data you use — but it is legal and you own it. Many phone plans include hotspot data at no extra cost.
If you live in an apartment or house near others, you can ask a neighbor if they are willing to share their WiFi and split the cost. This is common and legal as long as both people agree. Your neighbor can set up a separate guest network with a different password so you do not have access to their personal devices.
Why attempting to use someone else's network is a crime
Unauthorized access to a computer network — which includes a WiFi router — is a federal crime under the Computer Fraud and Abuse Act. The law does not require that you cause damage, steal data, or even successfully connect. The attempt itself is the crime. Penalties start at a fine and can go up to ten years in prison for a first offense, and higher for repeat offenses.
This applies even if the network is poorly secured, even if the owner is not using it, and even if you only want to check email. The network belongs to someone else, and you do not have permission. That is all the law needs.
State laws add additional penalties. Some states treat unauthorized network access as a form of theft, because you are using the owner's internet service without paying for it. Others have separate computer crime statutes with their own penalties. The federal law is the minimum; state law can be stricter.
What security researchers and IT professionals actually do
If you work in IT or cybersecurity and need to test a network's security, you do this with written permission from the network's owner. The permission is usually a contract called a penetration testing agreement or security audit agreement. It specifies exactly which networks you can test, what methods you can use, and what you will do with the results. Without that contract, even a professional is breaking the law.
Security researchers who find vulnerabilities in WiFi encryption publish their findings in academic papers and work with equipment manufacturers to fix the problems. They do not use the vulnerabilities to break into networks. The difference between research and crime is permission and transparency.
Frequently Asked Questions
What if I am just trying to test my own network's security?
You can test your own network using the same tools professionals use, because you own it. read Aircrack-ng or Hashcat, set up a test network with a weak password, and run the tool against it to see how quickly it cracks. This teaches you why strong passwords matter. Never test against a network you do not own, even to "help" the owner.
Is it illegal to just connect to an open WiFi network?
Connecting to an open network (one with no password) is not illegal if the owner has left it open intentionally. Many businesses and libraries do this on purpose. However, if the network is open by accident — the owner forgot to set a password — connecting without permission is still unauthorized access. You have no way to know which situation you are in, so the safest approach is to ask first.
What about networks with WEP encryption?
WEP is an old encryption standard that was broken in the early 2000s and can be cracked in minutes. However, WEP networks are now extremely rare. If you encounter one, it is almost certainly abandoned or forgotten. The legal answer is still the same: do not connect without permission, regardless of how weak the encryption is.
Can I crack a password if I have physical access to the router?
Physical access makes some attacks easier — you can reset the router to factory settings, or in some cases extract the password from the device's memory. However, this is still unauthorized access if the router is not yours. The law does not make an exception for physical access. If you own the router, you can do whatever you want with it.
What if someone is using my WiFi without permission?
Change your WiFi password when ready. If you have an older router, reset it to factory settings and set a new, strong password. Check your router's admin page for a list of connected devices — most routers show this under "Connected Devices" or "DHCP Clients." If you see devices you do not recognize, they will disconnect when you change the password. You can also enable MAC filtering to allow only devices you specify, though this is more work to maintain.