WPA-PMK-PMKID+EAPOL — Hashcat Mode 22001 (Known-PMK Verification)
TL;DR — Mode 22001 (WPA-PMK-PMKID+EAPOL) is the known-PMK mode: the candidate is an already-computed PMK — exactly 64 hex characters — so PBKDF2 is skipped and a PMK list can be re-tested against both PMKID (WPA*01*) and EAPOL (WPA*02*) records. Use it only against a network you own or have written authorization to test; for owner recovery, mode 22000 is the right choice.
Authorized use only. Every technique on this page applies only to a network you own or have documented written permission to test. Capturing from, attacking, or injecting into any other network is illegal.
What mode 22001 does differently
Standard WPA recovery (mode 22000) takes a candidate password, runs PBKDF2-HMAC-SHA1 (4096 iterations) with the SSID as salt to derive the PMK, then uses the PMK to verify against PMKID or EAPOL.
Mode 22001 skips the PBKDF2 step — the candidate is the PMK itself and must be exactly 64 hex characters (a 32-byte PMK). The hash file is still an ordinary .hc22000 file, and both record types are accepted, so a known PMK can be tested against PMKID (WPA*01*) and EAPOL (WPA*02*) lines alike. For example: hashcat -m 22001 hash.hc22000 pmk_list.txt.
For typical owner recovery where you have one network and one captured handshake, mode 22000 is the correct choice. Mode 22001 only applies when you already hold a PMK.
Legal boundary
Capturing a PMKID or a handshake from a network you do not own, or do not hold documented written authorization to test, is unauthorised interception and computer misuse in essentially every jurisdiction with a computer-misuse law on the books. Running a precomputed-PMK attack against such a capture is an unauthorised access attempt — the fact that PBKDF2 was skipped does not change that. Every command and workflow on this page assumes the target access point is yours or you have documented written permission to audit it.
When mode 22001 makes sense
Precomputed-PMK lookup — SSID-specific PMK precomputation, the wlangenpmk and hcxpmktool workflow: compute the PMKs for a candidate list under one SSID in advance, then re-test those PMKs against captures of that same SSID in a fast second pass. The PMK is salted with the SSID, so a PMK list is specific to one network name and cannot be reused across different SSIDs.
Not relevant for single-network owner recovery. Mode 22000 is simpler and equally effective for that case.
Frequently Asked Questions
Is mode 22001 useful for owner recovery?
What's the throughput difference?
Related references
Have a handshake to recover?
Upload HC22000, PCAP, PCAPNG, or CAP for a free assessment — for a network you own or have written authorization to test. Legacy HCCAPX must be migrated first. Pay only after a result is verified.
Run a free WPA analysis