---
title: "Recovering your own saved Wi-Fi keys on Windows"
date: "2018-10-18"
path: "/191-recovering-your-own-saved-wi-fi-keys-on-windows.html"
section: "/ramblings"
description: "Using netsh and a short PowerShell one-liner to read back the Wi-Fi passwords already saved on your own Windows machine."
---

Windows remembers the key for every Wi-Fi network you have ever joined, but it buries it. The usual reason to want it back is the one everyone hits: you are setting up a new phone or a guest's laptop, the password is saved on your PC but written down nowhere, and the router is in a cupboard somewhere. Everything below reads keys that are already stored on the machine you are sitting at. It is not a way into a network you have not already joined.

## One network at a time

If you just need a single network, `netsh` will print it. Open a terminal and name the profile:

```powershell
netsh wlan show profile name="MyNetwork" key=clear
```

The key is on the **Key Content** line under Security settings.

To see which profile names Windows has saved in the first place:

```powershell
netsh wlan show profiles
```

## All of them at once

To dump every saved network and its key together, this PowerShell one-liner walks the profile list, asks `netsh` for each one with the key in clear, and pairs the name with the key:

```powershell
(netsh wlan show profiles) | Select-String '\:(.+)$' | %{ $name = $_.Matches.Groups[1].Value.Trim(); $_ } |
  %{ (netsh wlan show profile name="$name" key=clear) } |
  Select-String 'Key Content\W+\:(.+)$' | %{ $pass = $_.Matches.Groups[1].Value.Trim(); $_ } |
  %{ [PSCustomObject]@{ PROFILE_NAME = $name; PASSWORD = $pass } }
```

The output is a tidy table (the names and keys here are made up):

```text
PROFILE_NAME        PASSWORD
------------        --------
HomeNet-5G          correct-horse-battery
Cafe Guest          latte2018
Workshop            SW0rdf1sh!
Spare Room AP       hunter2hunter2
```

A couple of things worth knowing. Open networks and ones that use enterprise (802.1X) authentication have no pre-shared key, so they come back blank, that is expected. And the account you run this under has to be the one that saved the profile; a key saved under another user's profile will not show.

Two small security points fall straight out of this. First, anyone who gets a few seconds at an unlocked, logged-in Windows session can read every Wi-Fi key it holds, so lock your screen. Second, this is a good nudge to keep a guest SSID with its own password for visitors, rather than handing out the key to your main network.