# wiire-a/pixiewps

An offline Wi-Fi Protected Setup brute-force utility

Repository: https://github.com/wiire-a/pixiewps
Canonical: https://ross.abutalabs.com/products/pixiewps
Language: C
License: NOASSERTION
License Family: other
Topics: hacking-tool, wifi-security
Last push: 2026-04-17T18:29:11+00:00

## Health v2 (maintenance only)
Score: 57/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 77, release rhythm 8, longevity 100
- inputs: {"age_days": 4171, "days_push": 138, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1740, forks 324 (observed 2026-08-28T04:05:30.121075+00:00)

## What it is
Pixiewps is a C command-line utility that brute-forces Wi-Fi Protected Setup (WPS) PINs offline, exploiting low- or non-entropy software implementations via the 'pixie-dust attack'. On vulnerable routers it can recover the PIN in seconds or minutes rather than the hours required by online tools, and since version 1.4 it can also recover the WPA-PSK from a complete passive capture for some devices.

## Use cases
- recover a WPS PIN offline from a vulnerable router
- run a pixie dust attack against a WPS-enabled access point
- audit whether my router's WPS implementation has low entropy
- perform WPS security testing during an authorized Wi-Fi penetration test
- extract the WPA-PSK passphrase from a complete passive WPS capture (M1 through M7)
- crack WPS PINs in seconds instead of hours-long online brute-force

## When to choose
- auditing WPS-enabled routers for the pixie-dust vulnerability in authorized penetration tests
- you need offline PIN recovery in seconds or minutes instead of the hours required by online brute-force tools
- recovering WPA-PSK from a full passive capture on supported devices using --mode 3

## When to avoid
- you need to capture the WPS exchange itself - Pixiewps only computes the PIN offline and relies on tools like Reaver or Bully (with modified options) to gather the PKE, PKR, hashes, and nonces
- targets not vulnerable to pixie-dust require traditional online attacks, which this tool does not perform
- you need a graphical tool or native Windows binary - it is a C program built with make targeting Linux with POSIX threads
- any use against networks you do not own or lack explicit permission to test

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cryptography
- domain: security, penetration-testing, networking
- platform: cli
- tags: wps, pixie-dust-attack, wifi-security, bruteforce, offline-attack, wpa-psk, wireless-pentesting, kali-linux, wifi-hacking, hacking-tool, command-line, linux

## Member repositories
- wiire-a/pixiewps (main) score 57

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:30.121075+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:30:10.844129+00:00, confidence not recorded.
  - readme: https://github.com/wiire-a/pixiewps (fetched 2026-08-28T04:05:30.121075+00:00, sha 5def43627a4a)
- Data as of 2026-08-30T08:39:29.467469+00:00.