PAGES
← all tools
◆ Wireless & RF

pixiewps

v1.4.2 open-source

An offline Wi-Fi Protected Setup brute-force utility - wiire-a/pixiewps

source ↗ rss ↗ What is a cyber toolchain?

Summary

pixiewps is an open-source, GPL-licensed command-line tool written in C that bruteforces WPS PINs offline using the pixie-dust attack, exploiting weak or absent randomness in some access points' WPS implementations to recover a PIN in seconds or minutes rather than the hours needed by online brute-force. It is aimed at people auditing wireless networks for weak WPS configurations, and its README contrasts it with online-bruteforce tools like Reaver and Bully, which it is meant to be paired with rather than replace, since pixiewps works on data captured during a WPS exchange rather than attacking the AP directly. Since version 1.4 it can also recover the WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-PSK from a full passive M1–M7 capture on some devices. First committed in 2015 with nine contributors, it has seen only one commit in the past year, so treat it as stable but essentially dormant rather than actively developed.

An offline Wi-Fi Protected Setup brute-force utility - wiire-a/pixiewps

How pixiewps helps

Is the WPS PIN on this access point recoverable without hours of online brute-forcing?

takes the public keys, hashes, authentication key and nonce captured during a WPS exchange and bruteforces the PIN offline in seconds or minutes if the AP's randomness is weak enough

Which access points in my audit are actually vulnerable to the pixie-dust weakness?

works only when the captured exchange shows low or absent entropy in the enrollee's seed, so a target that doesn't crack quickly tells you it isn't exploitable this way

Can I get the WPA-PSK straight from a passive capture without ever sending a packet at the AP?

reconstructs the WPA-PSK from a full M1–M7 exchange on some devices, working entirely from captured data rather than interacting with the network

Do I still need Reaver or Bully running against the target?

only processes data those tools capture during the WPS handshake, so it settles the PIN offline afterward but never talks to the AP itself

What settings is the AP sending in that encrypted M7 message?

decodes the encrypted settings blob from M7, but only under the same mode that handles full passive capture

Is this AP's weak PIN a one-off or a pattern across my capture archive?

processes each capture's hashes and nonces independently, so replaying a set of saved captures shows which specific ones crack and which don't

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 2 backed by code, an API document or a real run

Built from pixiewps's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What pixiewps offers you

  • Command-line interface
All capabilities 5 capabilities
PixieWPS operation mode 3 shipped Executes PixieWPS attacks in the fully implemented mode 3. 6 releases · 3 other sources · first seen May 2015

release

  • Adds --mode 1 and --mode 3 performance optimizations v1.4.2 · Jan 2018 · source · release history
  • Enables compilation with OpenSSL using make OPENSSL=1 v1.4 · Dec 2017 · source · release history
  • Adds --m5-enc flag to enable optional E-S2 recovery from the E-S1 field of the M5 message in --mode 3 1.4.0 · Dec 2017 · source · release history
  • Adds --m7-enc and --m5-enc options for optional WPA-PSK and E-S2 recovery from M7/E-S1 v1.4 · Dec 2017 · source · release history
  • Adds --m7-enc flag to enable optional WPA-PSK recovery from the M7 message in --mode 3 1.4.0 · Dec 2017 · source · release history
  • Adds --mode 3 as a new fully implemented operation mode. 1.1.0 · May 2015 · source · release history

example

  • Compile pixiewps with OpenSSL for better performance instead of the default library make OPENSSL=1 1.4.0 · Dec 2017 · source
  • Extract the WPA-PSK from the M7 message when using --mode 3 and OpenSSL pixiewps --mode 3 -m7 <M7_HEX> --m7-enc 1.4.0 · Dec 2017 · source
  • Run pixiewps in the newly implemented mode 3 against a target. pixiewps --mode 3 <target> 1.1.0 · May 2015 · source
Parallel job execution verified Runs cracking or analysis tasks across multiple threads in parallel, defaulting to automatic thread count detection. 5 releases · 2 other sources · first seen Oct 2017

release

  • --mode 1 and --mode 3 gain huge performance optimizations. 1.4.2 · Jan 2018 · source · release history
  • Allows compilation with OpenSSL by passing OPENSSL=1 to make for better performance 1.4.0 · Dec 2017 · source · release history
  • Adds --mode 3 with multi-threading and huge performance optimizations for faster cracking 1.4.0 · Dec 2017 · source · release history
  • Adds --mode 3 multi-threading support for huge performance optimizations v1.4 · Dec 2017 · source · release history
  • Adds -o, --output option to write output to file 1.3.0 · Oct 2017 · source · release history

command line

example

  • Run pixiewps using the new optimized mode with multi-threading to speed up PSK recovery pixiewps --mode 3 -e <E_S1> -r <RENONCE_A> -k <KEA><KSQ> 1.4.0 · Dec 2017 · source
WPS M5/M7 message cryptanalysis verified Recovers the secret nonce from WPS M5 messages and extracts encrypted settings from WPS M7 messages. 4 other sources · first seen Dec 2017

docs

  • Bruteforces WPS PINs offline using the pixie-dust attack by exploiting low entropy in some WPS software implementations.

command line

  • --m5-enc — Recover secret nonce from M5 (only mode 3) v1.4 · Dec 2017 · command-line history
  • --m7-enc — Recover encrypted settings from M7 (only mode 3) v1.4 · Dec 2017 · command-line history

example

  • Basic pixie-dust attack with required arguments pixiewps --pke ... --pkr ... --e-hash1 ... --e-hash2 ... --authkey ... --e-nonce ...
Small Diffie-Hellman key computation shipped Computes the authentication session key using small Diffie-Hellman parameters. 2 releases · 1 other source · first seen May 2015

release

  • Adds --authkey flag to compute the authentication session key. 1.1.0 · May 2015 · source · release history
  • Adds --dh-small argument to enable computation with small Diffie-Hellman keys. 1.1.0 · May 2015 · source · release history

example

  • Compute the authentication session key using small Diffie-Hellman parameters. pixiewps --authkey --dh-small <target> 1.1.0 · May 2015 · source
Arbitrary PIN length brute-force shipped Brute-forces WPS PINs with configurable length rather than fixed defaults. 1 release · 1 other source · first seen Oct 2017

release

  • Adds -l, --length option to brute-force arbitrary PIN length 1.3.0 · Oct 2017 · source · release history

example

  • Run a fast WPS brute-force with the optimized mode 1 engine pixiewps --mode 1 -e <eitr> -p <pctr> v1.4.2 · Jan 2018 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for pixiewps, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail pixiewps puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

5 entries

  1. January 20181
  3. December 20172
  6. October 20171
  8. May 20151

    5 entries

    1. v1.4.2 Jan 25, 2018 · release notes

      PixieWPS v1.4.2 adds huge performance optimizations for modes 1 and 3

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.2 https://github.com/wiire-a/pixiewps.git
# already have the repo? check out this version:
$ git checkout v1.4.2
      └──▷ USE IT
      Run a fast WPS brute-force with the optimized mode 1 engine
      shell 
      pixiewps --mode 1 -e <eitr> -p <pctr>
    2. v1.4 Dec 4, 2017 · release notes

      pixiewps v1.4 adds multi-threading, new --m7-enc/--m5-enc flags for PSK recovery, and OpenSSL build support.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4 https://github.com/wiire/pixiewps.git
# already have the repo? check out this version:
$ git checkout v1.4
      • Adds --mode 3 multi-threading support for huge performance optimizations
      • Adds --m7-enc and --m5-enc options for optional WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-PSK and E-S2 recovery from M7/E-S1
      • Enables compilation with OpenSSL using make OPENSSL=1

      3 details in Everything

    3. 1.4.0 Dec 4, 2017 · release notes

      pixiewps 1.4.0 adds multi-threading, WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-PSK/E-S2 recovery from M7/M5, and OpenSSL build support

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.4.0 https://github.com/wiire-a/pixiewps.git
# already have the repo? check out this version:
$ git checkout 1.4.0
      └──▷ USE IT
      Run pixiewps using the new optimized mode with multi-threading to speed up PSK recovery
      shell 
      pixiewps --mode 3 -e <E_S1> -r <RENONCE_A> -k <KEA><KSQ>
      Extract the WPA-PSK from the M7 message when using --mode 3 and OpenSSL
      shell 
      pixiewps --mode 3 -m7 <M7_HEX> --m7-enc
      Compile pixiewps with OpenSSL for better performance instead of the default library
      shell 
      make OPENSSL=1
      • Adds --mode 3 with multi-threading and huge performance optimizations for faster cracking
      • Adds --m7-enc flag to enable optional WPA-PSK recovery from the M7 message in --mode 3
      • Adds --m5-enc flag to enable optional E-S2 recovery from the E-S1 field of the M5 message in --mode 3
      • Allows compilation with OpenSSL by passing OPENSSL=1 to make for better performance

      4 details in Everything

    4. 1.3.0 Oct 7, 2017 · release notes

      Adds support for empty PIN cracking and arbitrary brute-force lengths via -l flag

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.3.0 https://github.com/wiire-a/pixiewps.git
# already have the repo? check out this version:
$ git checkout 1.3.0
      • Adds -l, --length option to brute-force arbitrary PIN length
      • Adds -o, --output option to write output to file

      2 details in Everything

    5. 1.1.0 May 1, 2015 · release notes

      pixiewps 1.1.0 adds mode 3, small DH key authkey computation

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.1.0 https://github.com/wiire-a/pixiewps.git
# already have the repo? check out this version:
$ git checkout 1.1.0
      └──▷ USE IT
      Run pixiewps in the newly implemented mode 3 against a target.
      shell 
      pixiewps --mode 3 <target>
      Compute the authentication session key using small Diffie-Hellman parameters.
      shell 
      pixiewps --authkey --dh-small <target>
      • Adds --mode 3 as a new fully implemented operation mode.
      • Adds --authkey flag to compute the authentication session key.
      • Adds --dh-small argument to enable computation with small Diffie-Hellman keys.

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in wiire/pixiewps, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 +1 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog not measured open issues today
    1. Issues opened / month not measured
    2. Open backlog not measured
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,746
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback