It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to afford the hardware, or the few experts who know how to debug and run their own WPA2 program in the cloud.

Assuming the resources available to the average hacker, are these brute-force attacks now feasible? what would be the estimated hardware cost to make a successful brute-force attack on WPA2-Personal?

400,000 PMK/s as said in the URL doesn't seem fast enough; what assumptions must these attacks be making?

2 Answers 2


The attacks assume a password that appears on the password list they are using (or at least in the space of passwords being considered, e.g. 8-9 alphanumeric chars).

The WPA 4 way handshake is vulnerable to offline password checking, but the key involved is 128 bits long - if the network password has sufficient entropy then it can't be brute forced in a reasonable time frame.

So there is no one size fits all answer to the question - it very much depends on the quality of the password on the target network and how much the attacker knows about that password (length, format, name of pets, ...).

Note that its a different story if the access point supports WPS - many implementations are vulnerable to brute force attacks, but with a consistently small keyspace. A normal consumer PC can crack a vulnerable WPS implementation in <12 hours.


There are services for cracking, or brute forcing hashes and handshakes that use cloud computing without the client needing to be a programmer. The one that immediately comes to mind is.


They advertise "Big. Fast. Cheap. Run your network handshake against 300,000,000 words in 20 minutes for $17" and that The TechRepublic says the following, "Welcome to the future: cloud-based WPA cracking is here!"

They can brute force the following

  • WPA/WPA2
  • NTLM
  • SHA-512
  • MD5

Though in the instance of MS-CHAPV2 (PPTP/WPA2-E) they can enumerate the whole space in 1 day.

An article and a link (https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/) to this service last summer is how I became aware of these services. I would definitely recommend reading it.

  • I know about cloudcracker.com but haven't yet spent the $17 just to try it. I mean, what if you spend the $17 and it doesn't succeed. Do you know of any free services?
    – T. Webster
    May 25, 2013 at 23:10
  • 1
    Free intense computing time, are you serious?
    – refex
    Apr 20, 2016 at 10:13
  • The site died..
    – Chloe
    Oct 5, 2016 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .