Hashcat WPA Benchmark — RTX 4090 vs RTX 5090

Test methodology

The figures on this page are published mode-22000 measurements from external benchmark runs, not tests performed for this article. RTX 4090 ~2.5 MH/s and RTX 3090 ~1.13 MH/s come from Chick3nman's published hashcat benchmark gists; the RTX 5090 ~3.3 MH/s figure is a community measurement reported on the hashcat forum. To measure your own card, run hashcat -b -m 22000 -w 4 — note that hashcat's built-in benchmark hash uses a 13-byte ESSID, so its reading is not directly comparable to a handshake with a different SSID length.

Reported speeds are hashes per second (H/s) for mode 22000. PBKDF2-HMAC-SHA1 is keyed as PMK = PBKDF2-HMAC-SHA1(passphrase, SSID, 4096, 256): the passphrase is the password and the SSID is the salt, and the salt enters only the first of the 4096 iterations. For any legal SSID (32 bytes maximum) the salt plus block index still fits inside a single SHA-1 block, so SSID length does not measurably change hashcat throughput.

All cards are assumed air-cooled at stock clocks.

Raw benchmark results — mode 22000

RTX 4090 (24 GB GDDR6X, 16,384 CUDA cores, 450W TDP): approximately 2.5 MH/s on mode 22000 in Chick3nman's published benchmark.

RTX 5090 (32 GB GDDR7, 21,760 CUDA cores, 575W TDP): approximately 3.3 MH/s on mode 22000 in a community benchmark report on the hashcat forum.

Performance uplift: on the measured figures the RTX 5090 is roughly 30% faster than the RTX 4090 on mode 22000, and it draws more power to get there, so the two cards are close on efficiency. Benchmark your own card and settings before buying on the strength of a single number.

For comparison: RTX 3090 (Ampere) measures ~1.13 MH/s on mode 22000 in the same published benchmark set. The two-generation leap is real, but far smaller than a headline percentage suggests.

Real-world crack times by password type

Dictionary attack — rockyou.txt (~14.3M entries) with 50 rules. Total candidates: roughly 715 million (14.3M × 50) — that is the whole run, not one pass per rule. Rule sets are not interchangeable at that count: the stock Best64.rule set holds 77 rules and T0XlC.rule holds 4,085, so the candidate total follows whichever set you load. On RTX 4090 (~2.5 MH/s): about 4.8 minutes.

On RTX 5090 (~3.3 MH/s): about 3.6 minutes for the same 715M candidates. The difference between the two cards is a couple of minutes per run, not hours — it matters only at high volume.

Mask attack — 8-character lowercase WiFi password (26^8 = 208 billion). RTX 4090: about 23 hours. RTX 5090: about 17.5 hours. Both feasible in a reasonable timeframe.

Mask attack — 10-character lowercase (26^10 = 141 trillion). RTX 4090: about 1.8 years. RTX 5090: about 1.35 years. Both infeasible for a single job.

The practical boundary for WPA2 cracking: 8-9 character human-chosen passwords are recoverable. 10+ character random passwords are not — consistent across both GPU generations.

Multi-GPU cluster scaling

Mode 22000 does not scale linearly across GPUs. The per-candidate work (PBKDF2-HMAC-SHA1) is compute-bound, but a mode 22000 wordlist or straight attack streams candidates to every device, which makes it sensitive to PCIe bandwidth — hashcat's own guidance is that narrow links such as x1-lane risers cost a multi-GPU rig a measurable share of its throughput.

Size a cluster from benchmarked aggregate throughput on the assembled host (hashcat -b -m 22000), not by multiplying one card's figure: the multiplication is an upper bound the PCIe topology, power, cooling and host overhead will not let you reach.

Power and cost per password

Electricity is not what a dictionary run costs. Both cards work through the ~715M-candidate run in a few minutes, so the energy consumed per run is a fraction of a cent at any common tariff. Electricity becomes a factor only on sustained multi-day jobs, not on a dictionary pass.

Hardware amortization: RTX 4090 (~$1,600) vs RTX 5090 (~$2,000). At 3-year useful life, the 4090 costs $1.46/day and the 5090 costs $1.83/day. Whether the roughly 30% throughput uplift justifies the higher daily cost depends on how many runs you actually complete per day.

For recovery services billing per successful crack: the faster GPU means more jobs completed per day, higher customer throughput, and lower per-job cost. Which card pays off depends on your job volume and your own hardware and electricity prices.

PMKID vs EAPOL — mode 22000 variants

Hashcat mode 22000 handles both PMKID (taken from the AP's first EAPOL-Key message, or from a client's (Re)Association Request) and full EAPOL 4-way handshakes. 802.11w (PMF) is management-frame protection for clients and is not a PMKID source. The cracking speed is identical for both variants because the candidate computation (PBKDF2-HMAC-SHA1) is the same — only the verification target differs.

Both variants are cryptographic verifications over the candidate-derived PMK: PMKID = HMAC-SHA1-128(PMK, "PMK Name" || AP_MAC || STA_MAC), while EAPOL verifies the MIC over the captured frame. The practical difference is what each needs — a PMKID needs only the AP's first EAPOL-Key message, while an EAPOL hash needs a matched message pair. Full EAPOL hashes can be affected by missing frames and by nonce-error-correction edge cases, and a wrong AP MAC (BSSID) makes the hash invalid rather than degrading it.

Legacy hashcat mode 2500 (deprecated) handled the older EAPOL hash format. Hashcat 6.0.0 and later — including 7.x — should use mode 22000 exclusively. A fresh capture converted with hcxpcapngtool is the supported route: hashcat no longer accepts .hccapx, and hcxpcapngtool converts raw capture files rather than hash files.

Practical recommendations

For DIY recovery: an RTX 5090 or 4090 is sufficient for recovering typical human-chosen WiFi passwords (8-9 chars, dictionary-based). Combined cost: ~$2,000-3,000 for GPU + system. Payload: capture the handshake with a WiFi adapter (Alfa AWUS036ACHM) and crack with hashcat — attacking networks you do not own or lack written permission to test is illegal in most jurisdictions, so this guidance applies to your own network or an authorized engagement.

For recovery services: 4-8 RTX 5090 GPUs per cluster is a common configuration, but size it from benchmarked aggregate throughput on the assembled host rather than from a multiple of one card's figure. Services should require ownership confirmation before accepting a job: customers should submit captures only from networks they own, and providers should ask for that confirmation before starting work. Service pricing varies widely between providers and jobs; many services bill only on success.

For networks moving to WPA3: handshake cracking will become less viable for WPA3-only networks. Invest in router-admin recovery and connected-device extraction as complementary capabilities. The RTX 5090/4090 investment remains useful for the installed base of WPA2 and WPA3-Transition networks.

Selecting GPU hardware for WPA cracking

1. 1

   Assess your throughput needs

   Casual user: single RTX 4090/5090 ($1,600-2,000). Service: 4-8 GPU cluster ($6,500-16,000).

2. 2

   Consider power and cooling

   The RTX 5090's 575W TDP means a multi-GPU server needs server-grade PSUs and cooling.

3. 3

   Benchmark your own card

   Run hashcat -b -m 22000 -w 4 on your own hardware. SSID length does not change throughput, so one benchmark covers all targets.

4. 4

   Choose dictionary and rules

   RockYou 14M wordlist + Best64 rules + generated rules (wordlist suffix, prefix, toggle) for maximum coverage.

5. 5

   Plan for multi-GPU scaling

   Use hashcat -d 1,2,3,... for local GPUs. Distribute across machines for larger clusters.

Frequently Asked Questions

Related Reading