BYTETOOLS

WPA PSK Generator

Derive the 256-bit WPA/WPA2 pre-shared key from an SSID and passphrase using PBKDF2-HMAC-SHA1 with 4096 iterations, exactly as IEEE 802.11i specifies.

The 256-bit pre-shared key is derived from your SSID and passphrase exactly as IEEE 802.11i specifies. Everything happens in this tab — neither value is sent anywhere.

What is the WPA PSK Generator?

The WPA pre-shared key is PBKDF2-HMAC-SHA1 of your passphrase, using the SSID as the salt, with 4096 iterations and 32 bytes of output — producing the 64-hex-character key a router or wpa_supplicant expects.

  • PBKDF2-HMAC-SHA1 with 4096 iterations and 256-bit output, exactly as IEEE 802.11i specifies
  • Enforces the 8 to 63 character passphrase and 32-byte SSID limits
  • Rejects non-ASCII passphrases that routers encode inconsistently
  • Ready-to-paste wpa_supplicant.conf network block with the SSID correctly escaped
  • Warns when a passphrase is short enough to be crackable offline
  • Derived locally with Web Crypto — the SSID and passphrase never leave your browser

How to use the WPA PSK Generator

  1. 1

    Enter the network name exactly as it is broadcast — it is case-sensitive and used as the salt.

  2. 2

    Enter the Wi-Fi passphrase, between 8 and 63 printable ASCII characters.

  3. 3

    Tick Show passphrase if you want to check what you typed.

  4. 4

    Click Derive PSK.

  5. 5

    Copy the 64-character hex key, or the whole wpa_supplicant.conf block.

About the WPA PSK Generator

WPA and WPA2 Personal do not use your passphrase directly. They stretch it into a 256-bit pre-shared key using PBKDF2-HMAC-SHA1, with the network name as the salt and 4096 iterations. This tool performs that derivation with the Web Crypto API and shows you the 64-hex-character result.

You need the raw PSK when a router asks for a hex key rather than a passphrase, or when you want to keep the plaintext passphrase out of a wpa_supplicant.conf file — the tool prints a ready-to-paste network block using the hex form, matching what wpa_passphrase produces.

Because the SSID is the salt, the same passphrase gives a completely different key on a differently named network — and identically named networks share a key space, which is why precomputed tables exist for common names like linksys and NETGEAR. Both values stay in your browser and are never transmitted.

Frequently asked questions

What is a WPA pre-shared key?

It is the 256-bit key your device actually uses on a WPA or WPA2 network. Your passphrase is stretched into it with PBKDF2, so the passphrase and the PSK are equivalent — anyone with either can join the network.

Why does the same passphrase give a different key on each network?

Because the SSID is used as the PBKDF2 salt. That is deliberate: it stops one precomputed table from working against every network. It also means renaming your network changes the PSK even if the passphrase stays the same.

Is entering the hex PSK more secure than the passphrase?

Not cryptographically — they are equivalent, and either lets someone onto the network. It is useful operationally, because it keeps the human-memorable passphrase out of config files and backups where it might be reused elsewhere.

How long should my Wi-Fi passphrase be?

At least 12 characters, and ideally four or more random words. Only 4096 iterations of SHA-1 protect it, so a captured handshake can be attacked offline at enormous speed. Length is what matters far more than mixing in symbols.

Does this work for WPA3?

No. WPA3 replaced the pre-shared key handshake with SAE, which derives keys differently and is not vulnerable to offline guessing from a captured handshake. This derivation applies to WPA and WPA2 Personal only.

Related tools