WPS PIN Brute-Force with Reaver

The WPS PIN brute-force attack exploits a design flaw in the WPS protocol where the AP validates the two halves of the 8-digit PIN independently. This reduces the effective search space from 100 million combinations to around 11,000. Reaver automates the PIN enumeration process and recovers the WPA2 passphrase directly from the AP once the correct PIN is found. No handshake capture or cracking is involved.

Confirm the target AP has WPS enabled and unlocked using wash before starting. See the WPS detection page.

Basic PIN Brute-Force

-vv shows the full WPS exchange per attempt. Each PIN attempt takes between 3 and 10 seconds depending on the AP. A full brute-force of the first half (10,000 values) takes 4-11 hours. Once the first half is found, the second half (1,000 values) takes minutes.

Resume an Interrupted Session

Reaver saves progress automatically. To resume from where it stopped, run the same command again — it picks up from the last tested PIN automatically. To explicitly specify a starting PIN:

Handle Rate Limiting and Timeouts

Many APs introduce delays or temporary locks after failed WPS attempts. Add a delay between attempts to avoid triggering the lock:

-d 5 adds a 5-second delay between each attempt. -r 3:15 tells reaver to rest for 15 seconds after every 3 attempts. Tune these values based on how quickly the AP starts refusing attempts. If the AP locks, stop and wait for the lock to expire before continuing.

Specify the Channel Explicitly

If reaver is having trouble associating, specify the channel directly to avoid channel hopping issues:

Successful Recovery

When reaver finds the correct PIN it prints both the PIN and the recovered WPA passphrase:

The WPA PSK is the network passphrase in plaintext. Use it to connect to the network directly with nmcli or wpa_supplicant.