Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to store my password in /etc/wpa_supplicant/wpa_supplicant.conf as some hash instead of plaintext?

By "password" I refer here to the password used for phase2 authentification. I do not refer to the Preshared Key (PSK) which could be hashed using wpa_passphrase.

For phase2 MSCHAPv2 or MSCHAP authentification I could store the password as MD4 hash using nt_password_hash (see example wpa_supplicant.conf line 659).

Is there any way to store my PAP password as hash?

Or: Is there a way to store the password in some sort of external storage? The example wpa_supplicant.conf suggests the use of such an external storage (using ext:????) but I could not find any documentation about it.

I am aware that storing the password as hash does not increase wifi security. But as the password MUST be the same as the password for other services (account management, subscriptions, payments ...) I don't want it to be stored as plaintext.

share|improve this question
I withdrew my answer; I completely missed the PAP part (must have been lack of caffeine).# NtPasswordHash can only be used when the password is for MSCHAPv2 or # MSCHAP (EAP-MSCHAPv2, EAP-TTLS/MSCHAPv2, EAP-TTLS/MSCHAP, LEAP). # EAP-PSK (128-bit PSK), EAP-PAX (128-bit PSK), and EAP-SAKE (256-bit # PSK) is also configured using this field. For EAP-GPSK, this is a # variable length PSK. – tink May 2 '13 at 21:10
up vote 4 down vote accepted

Unfortunately I have to answer the question myself now. "Unfortunately" because the answer is "No, it is not possible".

I took a look at how PAP is working, and came to the conclusion that it is logically impossible to store the password as a hash value.

With PAP, the username and password are sent directly to the authentification side. Therefore, the password must be known, knowing some hash is not sufficient.

Thx @tink for searching nevertheless.

But I still could not find anything about this external storage thing. Solution for me in this special case is using a unencrypted wifi (which is also provided by my university) and a VPN.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.