Recovering your own saved Wi-Fi keys on Windows

18 October 2018

Windows remembers the key for every Wi-Fi network you have ever joined, but it buries it. The usual reason to want it back is the one everyone hits: you are setting up a new phone or a guest's laptop, the password is saved on your PC but written down nowhere, and the router is in a cupboard somewhere. Everything below reads keys that are already stored on the machine you are sitting at. It is not a way into a network you have not already joined.

One network at a time

If you just need a single network, netsh will print it. Open a terminal and name the profile:

netsh wlan show profile name="MyNetwork" key=clear

The key is on the Key Content line under Security settings.

To see which profile names Windows has saved in the first place:

netsh wlan show profiles

All of them at once

To dump every saved network and its key together, this PowerShell one-liner walks the profile list, asks netsh for each one with the key in clear, and pairs the name with the key:

(netsh wlan show profiles) | Select-String '\:(.+)$' | %{ $name = $_.Matches.Groups[1].Value.Trim(); $_ } |
  %{ (netsh wlan show profile name="$name" key=clear) } |
  Select-String 'Key Content\W+\:(.+)$' | %{ $pass = $_.Matches.Groups[1].Value.Trim(); $_ } |
  %{ [PSCustomObject]@{ PROFILE_NAME = $name; PASSWORD = $pass } }

The output is a tidy table (the names and keys here are made up):

PROFILE_NAME        PASSWORD
------------        --------
HomeNet-5G          correct-horse-battery
Cafe Guest          latte2018
Workshop            SW0rdf1sh!
Spare Room AP       hunter2hunter2

A couple of things worth knowing. Open networks and ones that use enterprise (802.1X) authentication have no pre-shared key, so they come back blank, that is expected. And the account you run this under has to be the one that saved the profile; a key saved under another user's profile will not show.

Two small security points fall straight out of this. First, anyone who gets a few seconds at an unlocked, logged-in Windows session can read every Wi-Fi key it holds, so lock your screen. Second, this is a good nudge to keep a guest SSID with its own password for visitors, rather than handing out the key to your main network.