wpa_passphrase

Compute and display the WPA-PSK key for a given SSID reading the passphrase from stdin

$ wpa_passphrase [SSID]

$ wpa_passphrase [SSID] [passphrase]

wpa_passphrase SSID [passphrase]

SSID
    Wi-Fi network name (first positional argument)

passphrase
    Plaintext passphrase (second argument or stdin if omitted)

-h, --help
    Display help message

--version
    Print version information

The wpa_passphrase command is a utility from the wpa_supplicant package used to compute a WPA pre-shared key (PSK) hash for Wi-Fi network configuration. It takes an SSID (network name) and a passphrase as input, applying the PBKDF2-HMAC-SHA1 derivation function to produce a 256-bit key in hexadecimal format.

This is particularly useful for wpa_supplicant.conf files, where storing the raw passphrase is insecure. Instead, the hashed PSK is used, enhancing security by avoiding plaintext passphrases in config files. The output is formatted as a ready-to-use network={} block, including both commented raw passphrase and hashed PSK for convenience.

Common use cases include pre-generating keys for headless setups or scripts automating Wi-Fi connections. It supports passphrases of 8-63 ASCII characters or exactly 64 hexadecimal digits (treated as raw key). The command is lightweight, requiring no network interface, and runs entirely locally.

Passphrase must be 8-63 chars (ASCII) or 64 hex digits; shorter/longer inputs may fail. Output PSK is specific to the SSID—do not reuse across networks. Not for enterprise WPA (802.1X).

wpa_passphrase "MyNetwork" "secretpass123"

Output:
network={
  ssid="MyNetwork"
  #psk="secretpass123"
  psk=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z
}

Or with stdin: echo -e 'secretpass' | wpa_passphrase MyNetwork

Always produces a network={ssid="..."; psk="hexkey";} block. Commented #psk shows original passphrase for verification.

Developed by Jouni Malinen as part of wpa_supplicant (first released ~2003-2004). Evolved with Wi-Fi standards from WPA to WPA2/3-PSK support; current versions in most Linux distros via hostapd/wpa_supplicant packages.

wpa_supplicant(8), wpa_cli(8), iwconfig(8), iw(8)