Modern unified format

WPA-PBKDF2-PMKID+EAPOL — Hashcat Mode 22000

TL;DR — Mode 22000 is the modern unified format for WPA/WPA2 password hashes. It replaces the older modes 2500 (EAPOL) and 16800 (PMKID) by accepting both forms in a single .hc22000 hash file. The cipher and KDF are unchanged from earlier WPA: AES-CCMP with PBKDF2-HMAC-SHA1 (4096 iterations). Recovery feasibility depends entirely on password strength.

Authorized use only. Every technique on this page applies only to a network you own or have documented written permission to test. Capturing from, attacking, or injecting into any other network is illegal.

What mode 22000 unifies

Before 2020, WPA recovery used two different Hashcat modes: 2500 for the classic 4-way EAPOL handshake captured during client association, and 16800 for the PMKID extracted directly from the access point. Both encoded the same underlying WPA secret but in different hash formats.

Mode 22000 (introduced in Hashcat 6.0) accepts both forms in a single .hc22000 file. Each line carries a marker indicating PMKID or EAPOL plus the encoded data. This simplification reduced common workflow errors and made recovery tooling more uniform.

The cryptographic core is unchanged: WPA/WPA2-Personal uses PBKDF2-HMAC-SHA1 with 4096 iterations to derive the Pairwise Master Key (PMK) from the passphrase + SSID. The PMK is then used in the 4-way handshake or PMKID computation.

Hashcat mode: 22000 (replaces 2500 and 16800)
File format: .hc22000
KDF: PBKDF2-HMAC-SHA1, 4096 iterations
Salt: SSID (network name)
Cipher: AES-CCMP (in actual data transit)
Default for WPA/WPA2-Personal in IEEE 802.11i

Why 4096 iterations matter

WPA's 4096-iteration PBKDF2 was a deliberate cost choice in IEEE 802.11i (2004). At the time, it was meaningfully slow on consumer CPUs. By 2026, modern GPUs verify 1-3 million WPA candidates per second per high-end card.

This means dictionary attacks against common passwords complete in minutes, but it does not make the full keyspace reachable. A fully random 8-character alphanumeric passphrase is a keyspace search of 62^8 — about 2.2 x 10^14 candidates, which is weeks to months on a multi-GPU rig at roughly 2.5 MH/s per high-end card, not hours. At 9 characters (62^9, about 1.4 x 10^16) it is out of reach at any realistic budget.

What is genuinely recovered is patterned material — ISP default PSK schemes, dictionary words, dates, keyboard walks — generated with pattern tools (hcxpsktool / hcxeiutool) and masks, not by searching the full 62-character space.

12+ characters of genuine randomness is beyond a realistic budget; shorter passphrases are recoverable only if they follow a pattern. This is the standard 'password strength matters' line.

PMKID vs EAPOL

A PMKID is a 16-byte identifier that appears in the RSN IE of a client's (Re)Association Request and in the PMKID KDE of EAPOL-Key message 1. It needs no other client on the network, which makes it far quicker to collect than a full handshake — but it is not passive: the tool must associate with the AP (or solicit message 1) itself.

The EAPOL side is the 4-way handshake exchanged between client and AP. You only need two of the four messages — an authorized pair (M2+M3, M3+M4, or M1+M4). An M1+M2 pair is recorded but is not crackable, and hashcat's .hc22000 format records which pair you captured. Collecting it means either witnessing a client connection or, on a network you own or have documented written permission to test, sending deauthentication frames to force re-association.

Mode 22000 accepts both in the same hash file. From a recovery perspective, both verify the same underlying WPA passphrase — there's no preference once you have either form.

Recovery realism

WPA/WPA2 recovery follows the modern 'password strength matters' pattern. An 8-character random alphanumeric default is not within reach of a keyspace search on a realistic multi-GPU budget; what gets recovered is patterned material — dictionary words, dates, keyboard walks, and vendor default schemes — attacked with dictionaries, pattern tools and masks. Personal passwords with predictable patterns (birthdays, kid names, common phrases) are recoverable that way.

We honestly assess based on password expectations.

For your own home network where you simply forgot the password, the recovery path depends on what you set: a simple personal password is recoverable; a long random password from your router setup wizard probably isn't.

WPA3-Personal differences

WPA3-Personal uses Simultaneous Authentication of Equals (SAE) instead of PSK. SAE resists offline dictionary attack from a passive capture — a passively captured SAE exchange doesn't leak material an attacker can verify against candidate passwords — and mode 22000 does not apply to a WPA3-only SAE handshake. Two caveats: a WPA2/WPA3 transition-mode network can be downgraded to a capturable WPA2 handshake, and SAE itself has active-attacker attacks (Dragonblood) that a passive capture cannot mount.

Many consumer networks in 2026 still use WPA2-Personal because of client device compatibility. WPA3-only networks remain uncommon. If your network is WPA3-only, recovery is fundamentally harder — typically only via the router admin interface.

Frequently Asked Questions

Is recovering my own home WiFi password legal?

If you own the network, or hold written authorization from the owner, recovering its password from a capture you made is lawful in the jurisdictions this site serves. Rules differ elsewhere and some countries treat cracking tools or traffic interception separately from the access offence itself — check your local law. Accessing a network you do not own is illegal regardless of the technique used.

Why was mode 22000 introduced if 2500/16800 worked?

Workflow simplification. Having a single hash format reduces tool errors and makes recovery pipelines uniform whether the input is PMKID or EAPOL. Hashcat 6.0+ recommends 22000 for new captures.

Can I run mode 22000 myself with hashcat?

Yes — against a network you own or have documented written permission to test. Capture with hcxdumptool (if no client is present, use its PMKID mode rather than waiting for a handshake), convert to .hc22000 with hcxpcapngtool -o hash.hc22000 capture.cap, then run hashcat -m 22000 hash.hc22000 wordlist.txt. Time and electricity are the constraints — multi-GPU systems are vastly more effective than single GPUs.

What's the difference between mode 22000 and 22001?

Mode 22001 (WPA-PMK-PMKID+EAPOL) takes an already-computed PMK — a 64-hex value — as its candidate and skips PBKDF2, so it is for re-testing a known PMK, not a passphrase list. Mode 22000 (WPA-PBKDF2-PMKID+EAPOL) is the passphrase mode and accepts both PMKID (WPA*01*) and EAPOL (WPA*02*) lines. If you have a wordlist, use 22000.

Will my router log my recovery attempt?

Consumer routers generally do not keep a log of association or EAPOL activity, but enterprise APs and wireless IDS/IPS commonly do, and management frames are observable over the air. Choose PMKID collection because it is clientless and faster, not because it hides anything.

Are recovery rates published anywhere?

We don't publish service-specific rates. Published measurements of real WiFi passphrases — for example 'False Sense of Security on Protected Wi-Fi Networks' (arXiv:2501.13363), a study of 3,352 access-point hashes in which 16% were predictable under the 8-character minimum format — show that short, patterned and dictionary-derived passwords dominate real deployments, and those are the ones typically recoverable.

Related references

m2500Deprecated — use 22000 m22001PMK pre-computed Modern protocol

Have a handshake to recover?

Upload HC22000, PCAP, PCAPNG, or CAP for a free assessment — for a network you own or have written authorization to test. Legacy HCCAPX must be migrated first. Pay only after a result is verified.

Run a free WPA analysis