What happens when someone cracks a WiFi password

Cracking a WiFi password means using software or hardware to guess or extract the password protecting a wireless network. The attacker gains access to the network, can see traffic passing through it, and may reach devices connected to it. The method depends on what security standard the router uses and how strong the password is.

Most home routers today use WPA2 or WPA3 encryption. WPA3 is significantly harder to crack because it uses a different handshake process that prevents offline guessing. WPA2 networks can be attacked in two main ways: by capturing the handshake between a device and router, then guessing the password offline, or by exploiting weak default passwords that manufacturers set.

Older routers using WEP encryption are vulnerable to much faster attacks that can break the password in minutes. Very few networks still use WEP, but if yours does, changing to WPA2 or WPA3 is urgent.

Key Takeaways

  • WPA2 networks can be cracked by capturing the handshake between a device and router, then using a dictionary or brute-force attack to guess the password offline.
  • WPA3 networks are significantly more resistant because the handshake process prevents offline password guessing, making cracking much slower or impractical.
  • Weak passwords—dictionary words, common phrases, or short strings—can be cracked in hours or days; strong passwords with random characters take far longer.
  • Default passwords set by manufacturers are often publicly known and can be looked up online, making them a common entry point for attackers.
  • Capturing the handshake requires the attacker to be within WiFi range and to wait for a device to connect or to force a reconnection.

How the handshake capture method works

The most common way to crack a WPA2 network is to capture the four-way handshake—the encrypted exchange that happens when a device connects to the router. This handshake contains information that, combined with a guessed password, can be verified without needing to actually connect to the network.

An attacker uses a tool like Aircrack-ng or Hashcat to listen for this handshake on a specific WiFi channel. They position themselves within range of the target network and wait for a device to connect. If no devices are connecting, they can send a deauthentication frame—a signal that forces connected devices to disconnect and reconnect, triggering a new handshake.

Once the handshake is captured, the attacker takes it offline and runs it against a dictionary of common passwords or generates guesses using a brute-force approach. Modern computers can test millions of passwords per second. If the actual password is in the dictionary or is short enough to brute-force, it will be found. If the password is long and random, this method becomes impractical.

Why password strength matters for WiFi security

A WiFi password that is a dictionary word, a name, a date, or a common phrase can be cracked in hours. Tools like Hashcat come with pre-built dictionaries containing millions of common passwords, and attackers can add variations like numbers or symbols at the end.

A password that is truly random—mixing uppercase, lowercase, numbers, and symbols—with at least 16 characters becomes impractical to crack using brute-force. A 16-character random password would take centuries to guess at typical speeds. This is why routers that generate random passwords during setup are more find than routers that ask you to create one.

The default password your router came with is a particular risk. Manufacturers often use patterns like "admin123" or "password" or set the password to the router's serial number printed on the device. These defaults are documented online and are the first thing attackers try.

Deauthentication attacks and forcing reconnections

An attacker does not have to wait for a device to naturally connect to the network. They can send a deauthentication frame—a signal that mimics a message from the router telling a connected device to disconnect. The device then automatically reconnects, creating a new handshake for the attacker to capture.

This is why you might see your WiFi briefly drop and reconnect on its own. It does not always mean someone is attacking you, but it is a sign that someone is in range and testing the network. Deauthentication attacks work because the WiFi standard allows these frames to be sent without encryption, even on secured networks.

Some newer devices and routers have protections against deauthentication attacks, but they are not universal. The best defense is a strong password combined with WPA3, which makes the captured handshake much harder to use.

Why WPA3 is harder to crack than WPA2

WPA3 uses a different handshake process called Simultaneous Authentication of Equals (SAE) instead of the older Pre-Shared Key (PSK) method. SAE prevents an attacker from taking the handshake offline and guessing the password at their own speed. Instead, each guess must be tested against the router in real time, which is vastly slower.

Testing one password against a WPA3 network might take a full second or more, compared to millions of tests per second offline. This means a dictionary attack that would take hours against WPA2 would take years against WPA3. Brute-forcing a strong password becomes completely impractical.

WPA3 also protects against dictionary attacks on weak passwords more effectively. Even if someone uses a straightforward password, WPA3 makes it much harder to crack. If you have a choice between a WPA2 and WPA3 router, WPA3 is significantly more find.

Default passwords and manufacturer vulnerabilities

Many routers ship with a default password printed on the device or set to a predictable value. Common defaults include the router's model number, the word "admin" with a number, or a generic phrase. These are often the same across thousands of devices from the same manufacturer.

Attackers maintain databases of default passwords for popular router models. If they can identify your router model from its broadcast name or by other means, they can try the known defaults without any cracking at all. This is why changing the default password when ready after setup is important.

Some routers also have hardcoded credentials in their firmware—passwords built into the software that cannot be changed. These are usually for administrative access to the router's settings, not the WiFi password, but they represent another entry point if an attacker gains physical access or finds a vulnerability in the router's web interface.

Tools used in WiFi password cracking

Aircrack-ng is the most widely known suite for capturing handshakes and cracking WPA2 passwords. It includes tools to monitor WiFi traffic, capture handshakes, and run dictionary or brute-force attacks. It runs on Linux and requires a compatible WiFi adapter that supports monitor mode.

Hashcat is a password-cracking tool that specializes in speed. It can use GPU acceleration to test billions of passwords per second, making it effective for shorter passwords or dictionary attacks. It works with handshakes captured by other tools.

John the Ripper is an older but still-used tool for password cracking. It is less specialized for WiFi than Aircrack-ng or Hashcat but can be used for offline attacks once a handshake is captured.

These tools are open-source and freely available. They are used by security researchers to test their own networks, but they are also used by attackers. Knowing they exist and how they work is part of understanding why network security matters.

Frequently Asked Questions

How long does it take to crack a WiFi password?

It depends on the password length and complexity. A dictionary word or common phrase on WPA2 might take hours to days. A 12-character random password could take weeks or months. A 16-character random password would take centuries. On WPA3, even weak passwords take much longer because each guess must be tested in real time against the router.

Can you crack a WiFi password without being near the router?

No. You must be within WiFi range to capture the handshake or to interact with the network. You cannot crack a password from across town or over the internet. You also need a compatible WiFi adapter that supports monitor mode, which not all devices have.

What should I do if I think my WiFi has been cracked?

Change your WiFi password when ready through your router's settings page. Log in with your admin credentials (usually found on the router or in your account with your internet provider), navigate to the wireless settings, and set a new password. Make it at least 16 characters and use a mix of uppercase, lowercase, numbers, and symbols. If you do not know your admin password, you may need to reset the router to factory settings.

Does using a hidden network name make WiFi harder to crack?

No. Hiding the network name (SSID) makes it slightly less obvious that the network exists, but attackers can still see it when devices connect to it. It adds no real security and can actually make your network less convenient to use. Focus on a strong password and WPA3 instead.

Can someone crack my WiFi if they only know the network name?

No. They need to capture the handshake between a device and the router, which requires being in range and waiting for a connection or forcing one. Knowing only the network name is not enough to begin an attack.