Public / Open API Documentation

Endpoint

Quick Start

curl -sS -X POST "https://api.onlinehashcrack.com" \
	-F "[email protected]" \
	-F "file=@/path/to/wifi-capture.cap"

Request Fields

Send a multipart/form-data request. The API does not accept JSON and does not require an API key.

Examples

curl -sS -X POST "https://api.onlinehashcrack.com" \
	-F "[email protected]" \
	-F "file=@/captures/capture-wifi.cap"

import requests

url = "https://api.onlinehashcrack.com"
data = {"email": "[email protected]"}

with open("/captures/capture-wifi.cap", "rb") as cap:
	response = requests.post(
		url,
		data=data,
		files={"file": ("capture-wifi.cap", cap, "application/octet-stream")},
		timeout=120,
	)

payload = response.json()
if response.status_code >= 400:
	print(payload.get("message"))
else:
	print(payload["accepted"]["count"], "accepted")
	print(payload["skipped"]["count"], "skipped")
	print(payload["rejected"]["count"], "rejected")

import { createReadStream } from "node:fs";
import FormData from "form-data";
import fetch from "node-fetch";

const form = new FormData();
form.append("email", "[email protected]");
form.append("file", createReadStream("/captures/capture-wifi.cap"));

const response = await fetch("https://api.onlinehashcrack.com", {
	method: "POST",
	body: form,
});

const data = await response.json();
if (!response.ok) {
	console.error(data.message);
} else {
	console.log(data);
}

# hcxtools / wlancap2wpasec
wlancap2wpasec \
	-u https://api.onlinehashcrack.com \
	-e [email protected] \
	/captures/capture-wifi.cap

Response Format

Successful request processing returns HTTP 200 and a batch summary. The request can still contain rejected items, so always inspect accepted.count, skipped.count, and rejected.count.

{
	"notice": "By using this API to submit files for processing, you confirm that you are the legitimate owner of the data or have obtained explicit authorization to perform this analysis. All usage must comply with our Terms & Conditions: https://onlinehashcrack.com/terms. Unauthorized or unlawful use of this service is prohibited and may result in service suspension or account termination.",
	"next_steps": "Results are available in your OnlineHashCrack dashboard: https://onlinehashcrack.com/tasks",
	"accepted": {
		"count": 1,
		"hashes": [
			"WPA*02*12...ABCD"
		]
	},
	"skipped": {
		"count": 0,
		"reason": "already_sent",
		"hashes": []
	},
	"rejected": {
		"count": 0,
		"hashes": []
	}
}

No Hash Found

A valid PCAP can contain no usable PMKID or EAPOL handshake. In that case, the API returns HTTP 200 with a rejected batch item instead of a false empty success.

{
	"notice": "By using this API to submit files for processing, you confirm that you are the legitimate owner of the data or have obtained explicit authorization to perform this analysis. All usage must comply with our Terms & Conditions: https://onlinehashcrack.com/terms. Unauthorized or unlawful use of this service is prohibited and may result in service suspension or account termination.",
	"next_steps": "Results are available in your OnlineHashCrack dashboard: https://onlinehashcrack.com/tasks",
	"accepted": {
		"count": 0,
		"hashes": []
	},
	"skipped": {
		"count": 0,
		"reason": "already_sent",
		"hashes": []
	},
	"rejected": {
		"count": 1,
		"hashes": [
			""
		],
		"reason": "no_hash_found",
		"message": "No WPA hash found in this capture. Capture must contain a PMKID or EAPOL handshake."
	}
}

Status Codes and Errors

Request-level errors return {"success": false, "message": "..."}. Batch-level extraction errors return HTTP 200 and are reported under rejected.

Integration Notes