WPA PSK generator

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from WPA PSK generator

The WPA PSK generator derives a raw 256-bit pre-shared key from a network name, or SSID, and a WPA passphrase. Enter those two values and press Compute to display the hexadecimal result. The derivation includes the exact SSID, so a change in capitalization or spacing changes the key even if the passphrase stays the same. This utility is useful for understanding compatible WPA/WPA2 Personal configuration and for comparing known derivation examples. It does not scan wireless networks, discover a forgotten password, connect to an access point, or encrypt and decrypt messages. Whether the result can be used depends on the configuration format and authentication mode of the receiving system.

Guide updated October 13, 2026

How to use this tool

1. Enter a demonstration SSID and passphrase, preserving case and spaces exactly as intended.
2. Press Compute to derive the WPA PSK Raw Key shown by the page.
3. Check that the result contains 64 hexadecimal characters, representing 32 bytes or 256 bits.
4. Copy the raw key only into a configuration field that explicitly accepts this representation. Verify the network name and authentication mode in that configuration.

SEE IT IN PRACTICE

A worked example

SSID: IEEE; passphrase: password

f42c6fc52df0ebef9ebb4b90b38a5f902e83fe1b135a70e23aed762e9710a12e

This fixed demonstration shows the hexadecimal key derived from the exact case-sensitive inputs. Changing IEEE to ieee produces a different result. The example passphrase is public and unsuitable for a real network.

The PBKDF2 inputs behind the hexadecimal key

The implementation uses PBKDF2 with HMAC-SHA-1, 4,096 iterations, the passphrase as its password input, and the SSID as its salt. It requests 32 output bytes and displays them as hexadecimal. The algorithm and iteration count are fixed by this tool; there are no controls for changing them. Hexadecimal uses two characters per byte, which explains the 64-character output. Compare exact values when debugging interoperability, including spaces that may be difficult to see at the ends of an SSID.

A derived key is only one part of a connection

Successful derivation confirms that the supplied inputs can produce a key under this algorithm. It does not confirm that an access point uses those inputs, that a client can reach the network, or that a configuration file has the right syntax. Some receiving programs distinguish quoted passphrases from unquoted raw hexadecimal keys; follow that program's requirements. If an intended client still cannot connect, inspect the SSID, authentication mode, and receiving configuration before generating unrelated replacement values. Recomputing unchanged inputs should produce the same key.

When this tool is useful

• Compare a WPA passphrase derivation against a known test vector.
• Prepare raw-key input for a compatible wireless configuration.
• Demonstrate how changing an SSID changes the derived authentication key.

Tips for a better result

• Treat the raw PSK as authentication material. Its hexadecimal appearance does not make it safe to publish.
• Confirm that the target expects a raw 64-character hexadecimal PSK rather than a normal passphrase.
• Do not infer that an accepted input satisfies all access-point rules; the tool's derivation and the destination's validation are separate.

Frequently asked questions