My wpa_supplicant.conf looks like this:

  ssid="Some name"
  password="(clear text password here)"

With this specific combination of WPA-EAP and MSCHAP-v2, is there a way to not include my password in clear in this configuration file?

The ChangeLog seems to claim that this is feasible (since 2005!):

* added support for storing EAP user password as NtPasswordHash instead
  of plaintext password when using MSCHAP or MSCHAPv2 for
  authentication (hash:<16-octet hex value>); added nt_password_hash
  tool for hashing password to generate NtPasswordHash

Some notes:

1 That anser claims that using a hashed password means that the hash becomes the password. This is technically true, but at least the hash is a wifi-only password, which is significant progress over leaking a shared password granting access to multiple services.


You can generate the NtPasswordHash (aka NTLM password hash) yourself as follows:

echo -n plaintext_password_here | iconv -t utf16le | openssl md4

Prefix it with "hash:" in the wpa_supplicant.conf file, i.e.


On macOS the iconv code is UTF-16LE

echo -n plaintext_password_here | iconv -t UTF-16LE | openssl md4

Note that you don't gain much security. If an attacker finds the file with the hash, then they can trivially join the network (the same way your computer does), so having hashed the password doesn't help at all. If the password is used anywhere else, then the attacker would have to use brute force to find the original password (i.e. try the most likely passwords and calculate their hash until they find a match). Since you can calculate about 1 billion hashes per second on an ordinary PC, that's not a big hurdle, and attackers can easily use precomputed tables since the hash is unsalted. NTML is really horrible as a password hash.

  • Thanks! This looks promising, but it's not working for me; looking at the -d trace of wpa_supplicant, I get different EAP-PEAP: Derived Session-Id, EAP-PEAP: Decrypted Phase 2 EAP, MSCHAPV2: auth_challenge - hexdump(len=16):, and MSCHAPV2: password hash - hexdump(len=...) outputs, and finally two messages saying EAP-TLV: TLV Result - Failure and EAPOL authentication completed - result=FAILURE – Clément Apr 25 '16 at 23:42
  • Just to clarify: I do get a MSCHAPV2: password hash - hexdump line in the failing debug trace, which is encouraging (the non-encrypted one has a MSCHAPV2: password - hexdump_ascii line instead), but connection fails – Clément Apr 25 '16 at 23:50
  • 1
    @Clément Just to make sure the right hash is being generated: the above command executed on your system does calculate the same hash as this online calculator, right? – Guido Apr 26 '16 at 11:45
  • 1
    This doesn't work if the password is longer than 14 characters. – tjohnson Nov 27 '17 at 19:23
  • 1
    @Alden Very cheap. There's no way to go back directly from the hash to the input, but you can try a lot of possible passwords and calculate their hashes until you find the matching one. MD4 is very fast, 1 billion in 2 seconds with a 6-year old GPU. – Gilles May 31 '18 at 6:24

Open terminal and type :


Sample output:


Open the wpa_supplicant.conf file and add the following line:

  • 2
    A WPA PSK (which is a hashed combination of SSID and password) is not the same as a NTLM hash/NtPasswordHash (which is a 16-bit MD4 hash of the password only). – Guido Apr 25 '16 at 16:02
  • 5
    The OP asked about WPA-EAP, not WPA-PSK. – Guido Apr 25 '16 at 16:18
  • 2
    Sorry if the post didn't make it clear: this is exactly the solution in the first non-duplicate that I listed. There is no pre-shared key in the configuration that I'm asking about. – Clément Apr 25 '16 at 22:22
  • 1
    this may not be the specific question being asked for, but it helped me solved my problem. Thank you. – typelogic May 31 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.