Windows Guide

How to Capture a WPA Handshake on Your Own Windows Network

TL;DR — Capturing a WPA handshake on Windows requires a WiFi adapter that supports monitor mode; packet injection is only needed to force a reconnect, and neither passive capture nor clientless PMKID collection needs it. This guide walks through the complete process: adapter selection, driver installation, monitor mode setup, and handshake capture using both a Windows GUI tool and Linux in a VM or live USB. Every step applies only to a network you own or have documented written permission to test.

Authorized use only. Every technique on this page applies only to a network you own or have documented written permission to test. Capturing from, attacking, or injecting into any other network is illegal.

What you need: compatible WiFi adapter

Most built-in laptop WiFi adapters (Intel, Realtek, Qualcomm) do NOT support monitor mode or packet injection on Windows. You need a USB WiFi adapter with a chipset that supports these features. The most compatible chipsets are: Ralink RT3070/RT5370, Realtek RTL8187L, Atheros AR9271, and MediaTek MT7612U.

Popular adapter models: Alfa AWUS036ACM (MT7612U), Alfa AWUS036NHA (AR9271), TP-Link TL-WN722N v1 (AR9271), Panda PAU09 (RT5572). Avoid v2/v3 of TL-WN722N — they use Realtek chipsets with limited monitor mode support. The similarly named Alfa AWUS036ACH is a different adapter: a Realtek RTL8812AU part that needs a third-party driver, not the in-kernel MediaTek MT7612U.

Required: USB WiFi adapter with monitor mode support
Recommended chipsets: MT7612U, AR9271, RT3070, RTL8187L
Avoid: Intel, Broadcom, most built-in laptop WiFi chips

Method 1: Windows GUI with CommView for WiFi

CommView for WiFi by TamoSoft is a commercial Windows WiFi analyzer that supports monitor mode with adapters on TamoSoft's own compatibility list. It provides a graphical interface for channel scanning, packet capture, and export. CommView for WiFi costs $499 for a perpetual license (a lower-cost one-year time-limited edition is also listed); the 30-day trial covers a one-time capture.

Install CommView and, for adapters on the compatibility list, TamoSoft's own drivers — for 802.11ac adapters used for monitoring only, the vendor driver must not be installed. Start a capture on the channel of the network you own or have written authorization to test. When a client connects to that network, you will see the 4-way handshake packets. If no client connects and you are working on your own network, the Tools > Node Reassociation command sends deauthentication requests to force the key exchange. Export the capture as .cap for later conversion to .hc22000 format.

Method 2: Linux in a VM or live USB with aircrack-ng (free)

WSL2 is not a shortcut here. Aircrack-ng's own FAQ asks whether the suite works with WSL or WSL2 and answers No: the stock WSL2 kernel ships without a wireless stack at all — no cfg80211, no mac80211, no adapter driver — so it cannot produce a monitor-mode interface. Making it work means compiling a custom WSL2 kernel with the wireless stack and the adapter driver built in and the firmware embedded, which those four steps do not cover. Use native Linux instead: a Kali live USB, or a VM with USB passthrough to the adapter.

From Linux: sudo airmon-ng start wlan0, sudo airodump-ng wlan0mon -c <channel> --bssid <BSSID> -w capture, then wait for a client to connect. If you must force a reconnect, do it only with a client you control on a network you own or have documented written permission to test: aireplay-ng -0 5 -a <BSSID> -c <client> wlan0mon. The .cap file is your captured handshake.

Converting the capture to .hc22000

Once you have the .cap file with a valid handshake, convert it to Hashcat mode 22000 format using hcxpcapngtool: hcxpcapngtool -o output.hc22000 capture.cap. The -E flag writes a separate wordlist of the ESSIDs hcxpcapngtool observed in the capture (hcxpcapngtool -E essids.txt), for use as cracker input; the network's ESSID is already embedded in the hash line itself, as the salt. The .hc22000 file can be attacked locally with hashcat or submitted to a WiFi password recovery service — for a capture from a network you own or have written authorization to test.

Frequently Asked Questions

Can I capture a handshake without a special adapter?

Almost always no. Standard built-in WiFi adapters don't support monitor mode. You need a USB adapter with a compatible chipset (MT7612U, AR9271, RT3070, RTL8187L). Alfa Network adapters are the most reliable choice.

How long does a handshake capture take?

In practice, typically seconds to minutes if a client is already connected and you force a deauthentication. Without an active client, you must wait for a new connection — in practice this depends on how often clients associate, and can take minutes to hours.

Is packet capture legal?

Capturing packets on networks you own or have explicit authorization for is legal. Capturing packets on third-party networks without permission violates unauthorised-access and interception law — the Wiretap Act (18 U.S.C. § 2511) and the CFAA (18 U.S.C. § 1030) in the US, the Computer Misuse Act 1990 in the UK — and equivalent law elsewhere. Law varies by jurisdiction. Always capture on your own network or with written authorization.

What if no client connects to the network?

A 4-way handshake needs at least one active client during capture, so with zero clients a full handshake cannot be captured. The clientless path is the PMKID: hcxdumptool can obtain a PMKID from the AP with no client present, and the same hcxpcapngtool -o out.hc22000 conversion puts it in a mode 22000 hash file. On your own router, the alternative is the router admin interface or a wired connection.

Related references

m22000Modern unified format Crack WPA with hashcat — Mode 22000 Convert .hccapx to .hc22000

Have a handshake to recover?

Upload HC22000, PCAP, PCAPNG, or CAP for a free assessment — for a network you own or have written authorization to test. Legacy HCCAPX must be migrated first. Pay only after a result is verified.

Run a free WPA analysis