Should the router only store a hash of my encryption key or is it stored as plaintext?

I believe (but not certain) that the WPA key is itself an encryption key, buy shouldn't that be encrypted like any other login credentials?

I realize I have larger concerns if someone can interface with my router to get to wherever the key is stored... But still, wouldn't storing a hash instead of the password/key itself be desirable?

It is possible I am not understanding something fundamental to the WPA2 spec. Specifically, I am a web developer, so I am looking at this from an angle as someone who would never store sensitive info to a database in plaintext... But again its entirely possible I am looking at this the wrong way.

  • A "hash" algorithm like MD5 is designed for fast reversal, and therefore shouldn't be considered much better than clear text. I think you mean "encrypted", which means something that is computationally hard like scrypt. Also, "plain text" means something like a TXT file as opposed to a Word doc; you're thinking of "clear text", which means unencrypted text. Commented Sep 29, 2016 at 4:40

2 Answers 2


The preshared key (PSK) is not actually the encryption key. It is a "common" starting point used by the two devices to negotiate encryption without making the exchange vulnerable to a man in the middle attack.

An attacker would need both the PSK and the initial exchange between AP and client to be able to decrypt the transmission. Wireless PSK's will never be as secure as the 802.1X counterparts, and if security is a concern then you should transition from PSK to WPA2-Enterprise as soon as possible.

Your concern seems to be with how the PSK is stored, but if an attacker has access to the router/AP itself, then all data passing through the device is vulnerable no matter how the PSK is stored. What I mean by this is that the encryption "ends" at the radio interface and is no longer encrypted while being processed and/or while exiting another interface.

  • Thank you, YLearn. Great info, appreciate the clarification
    – user931780
    Commented Dec 5, 2013 at 13:26

Adding to Ylearn comments, the security of your network is also depends upon on the security level of router's fgpa chipsets (tamper resistance, tamper detection) and also the level of security policies implemented in your router.

Unfortunaltely it is very easy to crack WEP password in most of the wireless routers. There is a Wi-Fi protected protected setup PIN (WPS) that is used by many routers during their startup and it is hardcoded into these device. By exploiting this, we can expose the router's WEP2 password (Not tamper detectable). We can prevent this type of attack by enhancing the security policy in your router. One such way is setting up MAC address filtering on your router, which allows only the whitelisted devices to be able to access/connect to the router.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .