Aircrack-ng vs Hashcat vs John the Ripper for WPA Password Recovery
Three popular open-source tools cover the WPA recovery workflow, but each has a different role. Aircrack-ng captures and orchestrates; Hashcat is the GPU-accelerated cracker; John the Ripper is a CPU-focused alternative with strong scripting. Understanding which tool does what prevents wasting setup effort on the wrong combination. The capture and cracking steps described here apply only to a network you own or have documented written permission to test; attacking any other network is illegal.
Top Tool by Stage
Capture and convert: aircrack-ng (or hcxdumptool for modern PMKID). GPU cracking against captured handshakes: Hashcat mode 22000. CPU-focused or scripted attacks: John the Ripper. Most modern workflows are: hcxdumptool capture → hcxpcapngtool convert → Hashcat 22000 crack. The aircrack-ng-internal cracker is mostly legacy.
Open-Source WPA Tools Side-by-Side
| Feature | Aircrack-ng | Hashcat (m22000) | John the Ripper |
|---|---|---|---|
| Captures handshakes | Yes (airodump-ng) | No — needs capture from elsewhere | No |
| GPU acceleration | Limited (CPU-mostly) | Excellent — CUDA, OpenCL | OpenCL (Jumbo) — materially slower for WPA |
| Speed for cracking | Slow vs Hashcat | Fastest | Slower than Hashcat |
| Cross-platform | Linux/Mac, Windows limited | All platforms | All platforms |
| Scripting / customisation | Standard CLI | Strong rules engine | Excellent rule-based |
| PMKID support (modern) | Limited | Yes — 22000 (PBKDF2 passphrase search for PMKID + EAPOL). 22001 verifies a pre-computed 64-hex PMK, not a passphrase. | Yes — convert first: hcxpcapngtool/hcxhashtool --john, or wpapcap2john on pcap/pcapng (it cannot read .hc22000), then --format=wpapsk |
| Wordlist + rules engine | Basic | Comprehensive | Best-in-class rules |
Authorized use only
Capture, deauthentication and cracking may only be performed against an access point and its clients that you own or have explicit written authorization to test. Running these steps against any other network is illegal, and transmitting deauthentication frames to devices that are not yours is active interference, not passive observation.
Use Aircrack-ng For
Capture and reconnaissance phases.
- airodump-ng for capturing handshakes on a network you own or are authorized to test
- aireplay-ng for deauth (forcing reassociation) — only against clients you own or have written authorization to test
- Channel hopping and AP discovery
- Initial workflow before passing data to a cracker
- Modern alternative: hcxdumptool for PMKID capture, which works only where the AP supports PMKID caching — run it only on a network you own or have written authorization to test
Use Hashcat For
The actual password search against captured material.
- GPU-accelerated cracking (mode 22000)
- Multi-GPU clusters for serious work
- Rule-based attacks against complex password patterns
- Modern PMKID + EAPOL unified format
- Industry-standard for WPA recovery in 2026
Use John the Ripper For
When CPU-focused or rule-heavy attacks fit better.
- Combined runs across many hash types
- Highly customised rule chains
- When GPU isn't available
- Rule generation for Hashcat (john rules port)
- Penetration testing scripts
Modern Workflow in 2026
The standard open-source WPA recovery workflow in 2026: hcxdumptool captures PMKID directly from APs (no client interaction needed). hcxpcapngtool converts the .pcapng to .hc22000 format. Hashcat -m 22000 runs the password search using your wordlist and rules.
PMKID capture is not a universal shortcut. It works only where the access point actually returns a PMKID — hcxdumptool's own documentation notes it captures PMKIDs when the access point supports PMKID caching — and hashcat's original announcement said it did not know for which vendors or for how many routers the technique would work. It also does not apply to WPA3-SAE or EAP-TLS networks, which never yield a PBKDF2 PMKID. Where an AP does not return one, fall back to the older 4-way handshake capture — in every case only against a network you own or have documented written permission to test.
When Aircrack-ng's Cracker Itself Is Used
aircrack-ng has a built-in cracker (aircrack-ng -w wordlist file.cap), but it's CPU-only and slow vs Hashcat. Useful for quick dictionary tests on small wordlists, but Hashcat is the right tool for any non-trivial search.
If you have only a CPU, aircrack-ng's cracker still works. It's just much slower than Hashcat with even a mid-range GPU.
Cloud Service Alternative
wifipassword.org provides a managed mode 22000 recovery assessment without local setup. Processing time depends on the queue, capture quality, and password strength; the capture is transmitted only after explicit submission.
For one-off recovery of your own home network, cloud is usually the simplest path. For ongoing penetration-testing work, DIY with Hashcat on owned hardware is more economical.
Hardware Realities
Hashcat is the throughput leader for mode 22000, and a discrete GPU is far ahead of any CPU cracker — but the exact rate depends on the GPU model, the hashcat version and the workload profile. Benchmark your own hardware with hashcat -b -m 22000 rather than relying on published tables, and treat the figure as approximate.
John the Ripper jumbo's OpenCL WPA format (wpapsk-opencl) is materially slower than hashcat for mode 22000 — benchmarks on the same card put it well behind, largely because John runs wordlist rules on the CPU rather than inside the kernel. John's value here is its rule engine, custom formats and combined runs, not GPU throughput.
Aircrack-ng's built-in cracker is CPU-only, and it reports its own rate in keys per second (PMK/s). On the same machine, hashcat with a GPU is far faster — but the multiplier depends entirely on the CPU and GPU pair involved, so any single ratio is specific to that hardware.
Frequently Asked Questions
Is hashcat the only choice for serious WPA recovery?
Can I use aircrack-ng without GPU?
What's the cloud service equivalent?
Is it legal to crack my own home network?
Should I learn aircrack-ng if I just want to recover my home WiFi?
Skip the Setup — Use Managed Recovery
Submit HC22000, PCAP, PCAPNG, or CAP for managed recovery assessment. Legacy HCCAPX must be migrated first. Pay only after a result is verified.
Run Free Analysis