How to recover stored wifi password?

Question

My Android device (A Samsung Galaxy S7 SM-G930F, version 6.0.1) has different wi-fi networks saved. I would like to recover some of the password it has stored.
Browsing through the web I searched possible solutions but none of it has worked for me.

Stored password in wpa_supplicant.conf are encrypted, and even if I change the build properties "ro.securestorage.support" to false, old password remain encrypted or get deleted, and I would like to recover those.

I know that wi-fi password usually get backed-up on google drive, but I have no idea how to recover them from the backup online.

I heard about an Xposed module "Wifi password" which supposedly should show the wifi password instead of the normal dots, but I have a TouchWiz device and if I install the Xposed Framework i'm afraid it would wipe my data, included my wifi password.

I understand that encryption is meant to keep safe your password, but as far as I know, every time I try to connect to a wifi network it uses the real password, so they have to be stored somewhere or decrypted on the go.

Can anyone help me?

EDIT: As I said, if I change ro.securestorage.support property on build.prop file, my stored password either get deleted or they remain hashed.

If i delete .system.wpa_supplicant

all saved WiFi hotspots will be lost for the first time.

Also as said in the comments, the password isn't encrypted so there's no "way" to decrypt it, but it's hashed and there should be a way to recover it

— Iztooi | Sources

Answer

The hex value you found in the wpa_supplicant.conf is the PMK (not the PSK directly but some intermediate value computing the PSK or something like this). This value is not encrypted, it is hashed as defined by WPA2 using PBKDF2 SHA-1 with 4096 iterations see Wikipedia.

SHA-1 is a one-way function, which means that it can not be reversed.

Wifi still works, because the PSK is the actual key Wifi requires to work. The passphrase is just for the "dumb humans who can't remember a simple 64 hex chars value" (aka user convenience).

Hence there is no "decrypt" function. The only way to retrieve the password back is to perform a brute force search on that password (trying all possible passwords). Depending on the length of the password and your hardware (CPU, GPU) this can take some days, weeks, months or years.

There is an issue on Github with indicates that the tool "hashcat" is able to break this value using mode 12000 (-m 12000):

— Robert | Sources

Topics