WPA EAPOL — Hashcat Mode 2500 (Deprecated)
TL;DR — Mode 2500 was hashcat's original WPA/WPA2 EAPOL mode; it used the .hccap container and, from hashcat 3.40 onwards, the binary .hccapx format. Mode 22000 (with the .hc22000 format) arrived in hashcat 6.0.0, June 2020, and superseded mode 2500 in practice; 2500 was formally marked deprecated — and disabled by default — in hashcat 6.2.4, August 2021. Same underlying cryptography (PBKDF2-HMAC-SHA1, 4096 iterations); different hash encoding. New captures should use 22000, and .hccapx files can be loaded directly with -m 22000.
Authorized use only. Every technique on this page applies only to a network you own or have documented written permission to test. Capturing from, attacking, or injecting into any other network is illegal.
Why mode 2500 was deprecated
Mode 22000 replaced the binary .hccapx container with a text-based format (.hc22000). The reasons hashcat's author gave for the change are that one file can combine PMKID and EAPOL message pairs, that PBKDF2 can be reused across every hash in the file, and that the format is no longer binary. Multi-handshake captures were not the problem: mode 02500 reads a whole file of records, and hcxtools writes its entire hash list into a single .hccapx. The limitation hcxtools does document for hccapx is its 255-byte cap on EAPOL length.
Mode 2500 remains in hashcat but is disabled by default — running it produces the deprecation notice as an error and exits unless you add --deprecated-check-disable. New tooling defaults to mode 22000, and .hccapx files can be loaded directly with -m 22000, so mode 2500 is not required for legacy captures at all.
Cryptographic equivalence
Despite the format change, the underlying cryptography is unchanged: PBKDF2-HMAC-SHA1 with 4096 iterations and the SSID as salt; a candidate is then checked by deriving the PTK and comparing the EAPOL-Key MIC (HMAC-SHA1 or AES-128-CMAC, depending on the key version). For a single hash the two modes run the same PBKDF2-HMAC-SHA1 (4096-iteration) kernel, so throughput is essentially the same in practice; mode 22000's real gain is reusing PBKDF2 across every hash in one file and a single unified format.
If you have a legacy .hccapx file and want to use modern tooling, hcxhashtool can convert it to .hc22000 format — though its hccapx reader silently skips any record it cannot validate, so check that the output contains the hashes you expect. Current hashcat can also load .hccapx files directly with -m 22000.
When you might still encounter mode 2500
Older captured handshakes stored as .hccapx files; old documentation and tutorials; legacy automation scripts. Convert to mode 22000 for new work.
Frequently Asked Questions
Should I use mode 2500 or 22000?
Is recovery time different?
Can hashcat still process .hccapx files?
Related references
Have a handshake to recover?
Upload HC22000, PCAP, PCAPNG, or CAP for a free assessment — for a network you own or have written authorization to test. Legacy HCCAPX must be migrated first. Pay only after a result is verified.
Run a free WPA analysis