> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# hcxtools

> PCAP and hash conversion tools for WPA captures: convert handshakes to hashcat-compatible formats.

## Overview

hcxtools is a set of utilities for converting WPA capture files into formats compatible with modern hashcat. The suite replaces the deprecated mode 2500 workflow with the current mode 22000 format.

***

## Install

```bash theme={"dark"}
sudo apt install hcxtools
```

***

## Tools

| Tool            | Purpose                                                                                                  |
| --------------- | -------------------------------------------------------------------------------------------------------- |
| `hcxpcapngtool` | Convert pcap/pcapng to hashcat 22000 format                                                              |
| `hcxhash2cap`   | Convert hccapx (mode 2500) to pcap                                                                       |
| `hcxdumptool`   | Active capture with PMKID and EAPOL (separate package — `apt install hcxdumptool`, not part of hcxtools) |

***

## hcxpcapngtool

Converts a capture file directly to hashcat mode 22000:

```
hcxpcapngtool [options] <input.cap> -o <output.22000>
```

```bash theme={"dark"}
hcxpcapngtool capture.cap -o hash.22000
```

Crack the output:

```bash theme={"dark"}
hashcat -a 0 -m 22000 hash.22000 ~/rockyou.txt --force
```

***

## hcxhash2cap

Converts legacy hccapx (mode 2500) to pcap for re-processing:

```
hcxhash2cap --hccapx=<file.hccapx> -c <output.pcap>
```

```bash theme={"dark"}
hcxhash2cap --hccapx=hostapd.hccapx -c aux.pcap
hcxpcapngtool aux.pcap -o hash.22000
```

***

## hcxdumptool

Active capture tool that requests PMKIDs from APs and captures EAPOL handshakes:

```
hcxdumptool [options] -o <output.pcapng> -i <interface>
```

| Flag                                    | Description                                                                                                                             |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `-i <iface>`                            | Monitor mode interface                                                                                                                  |
| `-o <file>`                             | Output pcapng file                                                                                                                      |
| `--enable_status=3`                     | Show live status                                                                                                                        |
| `--filterlist_ap=<file> --filtermode=2` | Only target listed BSSIDs (`--filtermode` is mandatory; `=2` = target list, `=1` = ignore list). Removed in 6.3.0+, which uses `--bpf=` |

```bash theme={"dark"}
sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=3
hcxpcapngtool capture.pcapng -o hash.22000
hashcat -a 0 -m 22000 hash.22000 ~/rockyou.txt
```