REST API · PDF Reports · NIS2 Compliant

Turn a PCAP into a
WiFi Security Audit Report

Upload a captured WPA/WPA2 handshake. Get a professional, compliance-ready PDF audit report in seconds. Built for pentesters, MSPs and security-conscious IT teams.

Get Free API Key → See how it works
# Upload PCAP, get audit report

curl -X POST https://api.wifiaudit.io/v1/jobs \
  -H "X-API-Key: wai_your_key" \
  -F "pcap=@capture.pcap" \
  -F "ssid=CorporateWiFi"

# Response in ~15 seconds:
{ "result": "found", "password": "***",
  "report_url": "/jobs/abc/report" }

Trusted by security professionals for compliance documentation

NIS2 Ready
ISO 27001
SOC 2 Aligned
PDF Reports
~15s per audit
REST API
How it works

Three steps to a compliance report

From raw packet capture to a signed, compliance-grade PDF — fully automated.

1

Capture the handshake

Use any standard tool (airodump-ng, Wireshark, tcpdump) to capture a WPA/WPA2 handshake from your network. Upload the .pcap, .pcapng or .cap file.

2

API runs the audit

Our API extracts the handshake, validates it, and runs a dictionary attack against 14+ million known passwords using hashcat. Results in ~15 seconds.

3

Download the PDF report

Get a professional, branded PDF audit report with findings, risk rating, remediation recommendations and NIS2 / ISO 27001 compliance documentation.

Features

Everything you need for WiFi security auditing

A complete WiFi audit API — from PCAP parsing to compliance-grade documentation.

🔑

WPA/WPA2 Dictionary Attack

Tests passwords against rockyou (14M+) and curated wordlists. Supports WPA2-PSK PMKID and 4-way handshake modes.

📄

Compliance PDF Reports

Professionally formatted reports with findings, risk rating, remediation steps, authorization declaration and NIS2 article mapping.

⚡

Fast Results

Average audit completes in ~15 seconds using GPU-accelerated hashcat. Real-time status polling via REST API.

🔌

REST API First

Simple HTTP API — upload PCAP, poll status, download PDF. Integrate into your existing pentest workflow, CI/CD or MSP platform.

🛡️

NIS2 / ISO 27001 Ready

Reports map findings to NIS2 Article 21 obligations and ISO 27001 control A.8.20. Ready for auditors and regulators.

🏷️

White-label Reports

Add your company name and client details to every report. Perfect for MSPs and consultants delivering professional documentation.

📁

Multi-format Support

Accepts .pcap, .pcapng and .cap files from airodump-ng, Wireshark, tcpdump and any other standard capture tool.

🔒

Secure & Private

Uploaded files are automatically deleted within 24 hours. Your PCAP data never persists beyond the audit window.

📊

Audit Trail

Full job history with timestamps, wordlists used, passwords tested and duration. Export for compliance documentation.

Compliance

Built for regulatory frameworks

WiFi Audit reports are structured to satisfy the documentation requirements of major security frameworks.

NIS2

Maps to Article 21(2)(a) and 21(2)(e) — network security policies and risk analysis requirements.

ISO 27001

Supports control A.8.20 (Network security) and A.5.37 (Documented operating procedures).

SOC 2

Provides evidence for CC6.7 (Logical access) and CC7.1 (System monitoring) trust criteria.

PCI DSS

Supports Requirement 11.3 — external and internal penetration testing for wireless networks.

Who it's for

Built for security professionals

🔍

Pentesters

Automate WiFi audit reports for client engagements. Stop writing reports manually — upload the PCAP, download the PDF.

🏢

MSPs & IT Consultants

Offer WiFi security audits as a service. White-label PDF reports with client branding, delivered programmatically via API.

🏛️

Compliance Teams

Document wireless security controls for NIS2, ISO 27001 and SOC2 audits. Signed PDF reports ready for regulators.

💻

IT Security Engineers

Integrate WiFi auditing into your existing security stack via REST API. Automate recurring audits across multiple sites.

API Reference

Simple REST API

Integrate WiFi auditing into any workflow in minutes. Four endpoints, API key auth.

Request — Submit PCAP
POST /v1/jobs
X-API-Key: wai_your_api_key
Content-Type: multipart/form-data

pcap=capture.pcap
ssid=CorporateWiFi
client_name=Acme Corp
Response — Job Status
202 Accepted

{
  "job_id": "a1b2c3d4...",
  "status": "running",
  "ssid": "CorporateWiFi",
  "result": null,
  "created_at": "2026-02-22T..."
}
Completed — Vulnerable
200 OK

{
  "status": "done",
  "result": "found",
  "found_password": "password123",
  "crack_duration_seconds": 14.35,
  "report_url": "/v1/jobs/a1b2.../report"
}
Endpoints
GET /v1/health
# API status + wordlist info

POST /v1/jobs
# Submit PCAP, returns job_id

GET /v1/jobs/{id}
# Poll status: pending/running/done

GET /v1/jobs/{id}/report
# Download PDF report
Pricing

Simple, transparent pricing

Start free, scale as you grow. No setup fees, no per-seat licenses.

Free
$0 / month
For individuals and evaluation
  • 3 audits per month
  • PDF reports included
  • WPA/WPA2 support
  • REST API access
  • Community support
Start Free
Pro
$49 / month
For pentesters and small MSPs
  • 100 audits per month
  • Branded PDF reports
  • Client name on reports
  • Priority processing
  • Email support
  • Job history + export
Get Started
Enterprise
Custom
For MSPs, MSSPs and enterprises
  • Unlimited audits
  • White-label reports
  • Custom wordlists
  • On-premise deployment
  • SLA + dedicated support
  • SSO / SAML
Contact Sales
FAQ

Frequently asked questions

What is a WiFi security audit?
A WiFi security audit tests whether your WPA/WPA2 network password can be found in known password databases (dictionary attack). It is a required security control under NIS2, ISO 27001 and SOC2 frameworks. A passing audit (password not found) demonstrates that your wireless network meets minimum password strength requirements.
Is this legal to use?
Yes, when used on networks you own or have explicit written permission to test. Our audit reports include an authorization declaration section for compliance documentation. Testing networks without authorization is illegal in most jurisdictions. We reserve the right to suspend accounts used for unauthorized testing.
How do I capture a WPA handshake?
Use airodump-ng (Linux/Kali) to put your wireless adapter into monitor mode and capture traffic from the target access point. When a client connects or reconnects (you can trigger this with aireplay-ng deauth), the handshake is captured to a .cap file. This file is what you upload to our API.
What happens to my PCAP file after upload?
Uploaded PCAP files and generated reports are automatically deleted 24 hours after the audit completes. We do not share your data with third parties or use it for any purpose beyond performing the requested audit.
Does it support WPA3?
WPA3 uses SAE (Simultaneous Authentication of Equals) which is significantly more resistant to offline dictionary attacks. Our current service focuses on WPA/WPA2-PSK. WPA3 support is on our roadmap.
What if the password is not found?
If the password is not in our wordlists, the report documents this as a passing result — the network is not vulnerable to dictionary attacks using known passwords. The report includes the number of passwords tested and duration, which can be presented as compliance evidence.

Start your first WiFi audit today

Free plan · 3 audits/month · No credit card required

Request Early Access →