Pwnagotchi: The AI-Powered Pet That Eats WiFi Handshakes for Breakfast

In 2019, a developer named evilsocket (Simone Margaritelli) published the design for a device that would become one of the more unusual objects in hardware hacking culture: a Raspberry Pi Zero W running a reinforcement learning agent that wanders around, sends 802.11 deauthentication frames at nearby clients, captures the WPA2 4-way handshakes that result, and displays a pixelated face on a small e-ink screen that changes mood depending on how well the hunting is going.

The device is called Pwnagotchi, a portmanteau of "pwn" and "Tamagotchi." It is named for a reason: it has moods. It gets happy when it captures handshakes. It gets bored when there are no clients to deauthenticate. It displays different facial expressions - calm, excited, sad, intense - and accumulates experience points. You can carry it in your pocket and it learns, over time, which environments produce the most handshakes.

It is simultaneously a serious WiFi security audit tool and a genuine art project. Both of these things are true.

//WPA2 and the Handshake

WPA2-Personal (which is what most home and small business networks use) protects network access using a Pre-Shared Key - the WiFi password. When a device connects to a WPA2 network, it performs a 4-way handshake with the access point to establish a session key. This handshake does not transmit the password in any form that can be directly extracted. What it does transmit is a verifiable proof that both sides know the password, in the form of a hash-based message authentication code (HMAC).

The security of WPA2-Personal rests entirely on the assumption that the PSK (password) is complex enough that it cannot be guessed from the HMAC. If the password is a dictionary word, a common phrase, or any pattern that can be represented in a wordlist, the captured handshake can be cracked offline using hashcat or aircrack-ng without any further network access.

What "Cracking" Actually Means

Cracking a captured WPA2 handshake is a dictionary attack or brute-force attack against the HMAC-SHA1 derivation function. For each candidate password in a wordlist, hashcat computes the PBKDF2-SHA1 output that WPA2 uses to derive the Pairwise Master Key, then uses that to compute the PTK and verify it against the MIC in the captured handshake. A match means the password is found.

On modern GPU hardware (an RTX 4090), hashcat can test approximately 400,000 WPA2 candidate passwords per second. The 2009 RockYou password breach wordlist contains 14.3 million passwords and is exhausted in about 36 seconds. Larger curated wordlists and rule-based mutations extend this, but the core point is that a password that appears in any wordlist will be found quickly.

//The Deauth Attack

The 802.11 deauthentication frame is a management frame that tells a client it has been disconnected from an access point. In 802.11 without Management Frame Protection (MFP), these frames are not authenticated - any device that knows the MAC addresses of the AP and the client can send one. The client cannot verify that the deauth came from the legitimate AP.

Pwnagotchi uses bettercap to send deauth frames at connected clients. When the client receives the deauth, it disconnects and immediately attempts to reconnect. During reconnection, it performs the 4-way handshake with the AP. Pwnagotchi captures this handshake.

The entire cycle - identify network with connected clients, send deauth, capture handshake - typically completes in under 5 seconds for a nearby network with active clients.

Passive Mode

Not every WPA2 handshake requires a deauth attack. Pwnagotchi also operates in passive mode, monitoring channel traffic for handshakes that occur naturally when clients connect or roam. In dense environments - office buildings, apartment complexes, public spaces - passive mode can capture multiple handshakes per hour without sending any frames. This mode is entirely passive and generates no traffic that could be detected by wireless intrusion detection systems.

//Management Frame Protection

802.11w (Management Frame Protection) was ratified in 2009 and became mandatory for WPA3 networks. It cryptographically authenticates management frames, including deauthentication frames. An attacker sending a spoofed deauth to a client on a network using MFP will find that the client ignores the frame - it cannot verify the frame's authenticity and rejects it.

In practice, MFP adoption is low. Many consumer routers that technically support WPA2 with MFP do not have it enabled by default. Networks running WPA3 (which mandates MFP) are still a minority of deployed infrastructure, especially in home environments. Pwnagotchi's deauth attacks work on the vast majority of real-world WPA2 networks.

//The AI Component

The reinforcement learning agent in Pwnagotchi uses an A2C (Advantage Actor-Critic) algorithm to optimize its channel hopping and deauth strategy. The reward function is simple: handshakes captured per unit time. The agent learns which channels have more active clients, which times of day are more productive, and which environments yield more handshakes. It saves its training state and improves over multiple sessions.

In evilsocket's original writeup, he described running Pwnagotchi in his neighborhood and watching it learn to spend more time on channels used by the densest cluster of nearby networks. This is not a dramatic capability but it demonstrates something interesting: a $15 piece of hardware can run meaningful machine learning inference and adapt its behavior accordingly.

The AI component is, practically speaking, not what makes Pwnagotchi interesting from a security perspective. The deauth + handshake capture loop is effective without any machine learning. What the AI adds is the Tamagotchi metaphor - the device as an entity with goals and learning, which makes it more compelling as an artifact and more effective as an educational demonstration of what passive WiFi capture looks like in practice.

//The Hardware

The standard Pwnagotchi build uses a Raspberry Pi Zero W (or Zero 2 W), a 2.13-inch Waveshare e-Paper display, a small LiPo battery, and a compact case. Total build cost is around $50-80 depending on the display and battery chosen. The software is an Ansible-provisioned Raspbian image that the Pwnagotchi project provides as a pre-built download.

The e-Paper display is a deliberate aesthetic choice. It is low-power (draws current only when updating), readable in bright sunlight, and gives the device a distinctive appearance. The face updates every few seconds to reflect current activity. A happy face with crossed arms means it just captured a handshake. A bored face means no clients detected. An intense face with a targeting symbol means deauth in progress.

Plugins extend the basic functionality: GPS logging (correlates captures to physical location), Bluetooth companion app, automatic handshake synchronization to a home server, and mesh networking between multiple Pwnagotchi units that can share network information.

//What Captured Handshakes Tell You

From a security assessment perspective, Pwnagotchi is most useful as a passive audit tool. Walking through a building or campus with Pwnagotchi reveals every WPA2 network operating without MFP, every network with connected clients, and every handshake that can be cracked offline. This is exactly the information a physical penetration tester needs before targeting wireless infrastructure.

Cracked handshakes provide password intelligence that often reveals organizational patterns: common prefixes, naming schemes, password reuse. A cracked WiFi password may match the VPN password, the guest account, or the guest WiFi - each of which represents a different level of additional access.

The defense is straightforward: WPA3 with Management Frame Protection, strong passwords that do not appear in any wordlist (20+ characters, generated randomly), and regular rotation. For enterprise environments, WPA2-Enterprise (802.1X) with certificate-based authentication eliminates the shared-secret problem entirely - there is no PSK to crack.