Home > Products > Network passwords > Network Password Recovery Wizard > Screenshots > Wireless network keys and passwords
Network Password Recovery Wizard: wireless network keys and passwords
Windows Password Recovery v15.3.0
Windows Credentials Explorer
Reset Windows Password v13.1
Forensic tools to analyze Remote Desktop activity in Windows
Wireless Password Recovery v6.8.1
New templates to seach for default passwords of some broadband WiFi routers
Reset Windows Password v13.0
Full support for Windows 11, duplicate file finder, checksum calculator and some new tools

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Network Password Recovery Wizard:
Wireless network keys and passwords

This feature works only if your system has Wireless Zero Configuration service installed. To determine if the Wireless Zero Configuration service is installed and running, follow the steps below:
Click Start -> All Programs -> Accessories, and then click Command Prompt.
Type sc query wzcsvc , and press ENTER.
If the Windows Zero Configuration service is active, the words STATE:  RUNNING will appear.


Recovered network passwords/keys are divided into three types and are marked with the corresponding characters:
S(ystem) - system configurations stored on a removable drive
L(ocal) - last configuration stored locally by wireless network setup wizard
G(lobal) - wireless connections passwords/keys

Recovered wireless network passwords

Please note that NPRW recovers only passwords stored in Windows, you don't have to be connected to a wireless network. WEP Passwords (or keys, depending on the wireless configuration) are recovered at once. Recovered WEP connections passwords can be in the plain-text (ASCII) or hexadecimal (HEX) format, depending on the wireless connection settings.

WPA-PSK passwords cannot be decrypted instantly. If you are recovering a WPA-PSK password, you should be aware that Windows does not store the actual password. Instead, it calculates its hash using a strong PBKDF2 algorithm (HMAC SHA1 with 4096 iterations), encrypts the hash using DPAPI and then stores it in the encrypted format. NPRW will try all available combinations for picking a simple WPA-PSK password; therefore, the recovery time increases as the number of WPA-PSK keys found by the program grows. In the final dialog, the failed WPA-PSK passwords will be highlighted in red.

In theory, it is not mandatory to have a WPA-PSK password to create a new wireless connection. You can enjoy the recovered WPA-PSK hash (or PSK material, see screenshot below). So in most cases, there's no need to uncover the original WPA-PSK password at all. To use the PSK hash (instead of WPA-PSK password), copy the recovered PSK material to the Windows clipboard. Its length must be 64 characters. Open 'Control Panel' and then run 'Wireless Network Setup Wizard'. Select the 'Setup a new wireless network' option and then 'Manually assign a network key'. Now paste the key you have copied to clipboard into the appropriate edit box (actually there are two fields: one for the key and another one just for confirmation).

Decrypted PSK material

Starting from version 3.0, the program can perform a full attack on WPA-PSK passwords. The recovery speed is very slow - approximately 500 passwords/sec on a modern computer. So there's no point for example to run a brute-force attack on PSK in most cases. Take a look at general recommendations on recovering passwords from hashes.

Running a dictionary attack on WPA-PSK password

At last, you can use the context menu to check/recover a forgotten WPA-PSK password manually.

Checking WPAPSK password



To recover wireless network passwords manually, you will need to specify their location within your system:

  • Removable drive. Wireless network settings can be stored on a USB flash or other removable drive. If you have chosen this option, you will be asked to select a drive with the data on the pull-down list. If the 'Next >>' button remains unavailable after you have selected the disk, it means that the program could not find the data required for this operation. No additional data is necessary for recovering passwords from this configuration.

  • Wireless Flash Configuration - the last configuration, which is 'prudently' stored by Windows' Wireless Network Setup Wizard. That data is normally saved in a file named LastFlashConfig.wfc, which is stored in the folder C:\Documents and Settings\%USER%\Application Data\Microsoft.

  • Windows registry. Passwords to wireless connections are stored in Windows registry. If you have selected this location, the further recovery will be possible only when these three Windows registry files are available: SOFTWARE, SYSTEM, and SECURITY.

Recovering wireless keys and passwords manually

Other than that, once you have selected the registry files, on the third step of the program's wizard you will need to enter the path to your system account's Master Key. NPRW will attempt to locate the correct key automatically.

Windows credentials required to decrypt the data