hcxtools

hcxtools is a conversion and analysis suite for the files hcxdumptool (or a plain .pcap/.cap capture) produces. The one that matters most is hcxpcapngtool: it turns a capture into hashcat’s -m 22000 format, folding PMKID and EAPOL handshakes into one output file so hashcat gets full advantage of both without duplicate work. wifite calls it directly to prep captured handshakes for cracking. The package also ships several smaller utilities — hcxhashtool to filter/sort a hash file, hcxpsktool to convert a cracked hash back into a usable PSK list, hcxeiutool to reshape a wordlist (splitting it into digit/hex/character-only variants for rule-based cracking), hcxpmktool to compute a PMK/PMKID from a known PSK and ESSID, and whoismac for a quick vendor OUI lookup.

It lives at Security → Wireless Attacks → hcxtools (a subcategory — all 8 binaries get their own entry).

The help it prints

Show the full output30 lines
hcxpcapngtool 7.1.2 (C) 2026 ZeroBeat
convert pcapng, pcap and cap files to hash formats that hashcat and JtR use
usage:
hcxpcapngtool <options>
hcxpcapngtool <options> input.pcapng
hcxpcapngtool <options> *.pcapng
hcxpcapngtool <options> *.pcap
hcxpcapngtool <options> *.cap
hcxpcapngtool <options> *.*

short options:
-o <file> : output WPA-PBKDF2-PMKID+EAPOL hash file (hashcat -m 22000)
            get full advantage of reuse of PBKDF2 on PMKID and EAPOL
-E <file> : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker
            retrieved from every frame that contain an ESSID
-R <file> : output wordlist (autohex enabled on non ASCII characters) to use as input wordlist for cracker
            retrieved from PROBEREQUEST frames only
-I <file> : output unsorted identity list to use as input wordlist for cracker
-U <file> : output unsorted username list to use as input wordlist for cracker
-D <file> : output device information list
            format MAC MANUFACTURER MODELNAME SERIALNUMBER DEVICENAME UUID ESSID
-h        : show this help
-v        : show version

long options (abridged — see `hcxpcapngtool --help` for the full list):
--all                              : convert all possible hashes instead of only the best one
--eapoltimeout=<digit>             : set EAPOL TIMEOUT (milliseconds), default: 5000 ms
--nonce-error-corrections=<digit>  : set nonce error correction (default: 0)
--csv=<file>                       : output ACCESS POINT information in CSV format
--nmea-out=<file>                  : output GPS data in NMEA 0183 format

Examples

# Convert a raw capture into the hash format hashcat's -m 22000 mode reads
hcxpcapngtool -o capture.hc22000 capture.pcapng

# Crack it with hashcat
hashcat -m 22000 capture.hc22000 /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

# Pull an SSID-derived wordlist out of the capture too
hcxpcapngtool -o capture.hc22000 -E essids.txt capture.pcapng