Network Password Recovery Wizard:
Wireless network keys and passwords

Quick navigation - Network connections passwords - Network credentials - Domain cached passwords > Wireless keys and passwords - Remote desktop passwords - CardSpace/InfoCard recovery - Asterisk password revealer - Server emulators (POP3, FTP, etc.) back to the product's main page

This feature works only if your system has Wireless Zero Configuration service installed. To determine if the Wireless Zero Configuration service is installed and running, follow the steps below:
Click Start -> All Programs -> Accessories, and then click Command Prompt.
Type sc query wzcsvc , and press ENTER.
If the Windows Zero Configuration service is active, the words STATE:  RUNNING will appear.

Recovered network passwords/keys are divided into three types and are marked with the corresponding characters:
S(ystem) - system configurations stored on a removable drive
L(ocal) - last configuration stored locally by wireless network setup wizard
G(lobal) - wireless connections passwords/keys

Please note that NPRW recovers only passwords stored in Windows, you don't have to be connected to a wireless network. WEP Passwords (or keys, depending on the wireless configuration) are recovered at once. Recovered WEP connections passwords can be in the plain-text (ASCII) or hexadecimal (HEX) format, depending on the wireless connection settings.

WPA-PSK passwords cannot be decrypted instantly. If you are recovering a WPA-PSK password, you should be aware that Windows does not store the actual password. Instead, it calculates its hash using a strong PBKDF2 algorithm (HMAC SHA1 with 4096 iterations), encrypts the hash using DPAPI and then stores it in the encrypted format. NPRW will try all available combinations for picking a simple WPA-PSK password; therefore, the recovery time increases as the number of WPA-PSK keys found by the program grows. In the final dialog, the failed WPA-PSK passwords will be highlighted in red.

In theory, it is not a mandatory to have a WPA-PSK password to create a new wireless connection. You can enjoy the recovered WPA-PSK hash (or PSK material, see screenshot below). So in most cases there's no need to uncover the original WPA-PSK password at all. To use the PSK hash (instead of WPA-PSK password), copy the recovered PSK material  to the Windows clipboard. Its length must be 64 characters. Open 'Control Panel' and then run 'Wireless Network Setup Wizard'. Select the 'Setup a new wireless network' option and then 'Manually assign a network key'. Now paste the key you have copied to clipboard into the appropriate edit box (actually there are two fields: one for the key and another one just for confirmation).

Starting from version 3.0, the program can perform a full attack on WPA-PSK passwords. The recovery speed is very slow - approximately 500 passwords/sec on a modern computer. So there's no point for example to run a brute-force attack on PSK in most cases. Take a look at general recommendations on recovering passwords from hashes.

At last you can use the context menu to check/recover a forgotten WPA-PSK password manually.

To recover wireless network passwords manually, you will need to specify their location within your system:

• Removable drive. Wireless network settings can be stored on a USB flash or other removable drive. If you have chosen this option, you will be asked to select a drive with the data on the pull-down list. If the 'Next >>' button remains unavailable after you have selected the disk, it means that the program could not find the data required for this operation. No additional data is necessary for recovering passwords from this configuration.

• Wireless Flash Configuration - the last configuration, which is 'prudently' stored by Windows' Wireless Network Setup Wizard. That data is normally saved in a file named LastFlashConfig.wfc, which is stored in the folder C:\Documents and Settings\%USER%\Application Data\Microsoft.

• Windows registry. Passwords to wireless connections are stored in Windows registry. If you have selected this location, the further recovery will be possible only when these three Windows registry files are available: SOFTWARE, SYSTEM, and SECURITY.

Other than that, once you have selected the registry files, on the third step of the program's wizard you will need to enter path to your system account's Master Key. NPRW will attempt to locate the correct key automatically.

back to top