---
name: "reaver"
section: "1"
platform: "linux"
package: "reaver"
version: "1.6.6-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/reaver"
---

# reaver(1)

WPS Cracker

## NAME

**Reaver** - WPS Cracker

## SYNOPSIS

**reaver -i \<interface\> -b \<target bssid\> -vv**

## DESCRIPTION

Reaver implements a brute force attack against WiFi Protected Setup which can crack the WPS pin of an access point in a matter of hours and subsequently recover the WPA/WPA2 passphrase.

Specifically, Reaver targets the registrar functionality of WPS, which is flawed in that it only takes 11,000 attempts to guess the correct WPS pin in order to become a WPS registrar. Once registred as a registrar with the access point, the access point will give you the WPA passphrase.

## OPTIONS

- **-m, --mac=\<mac\>**

  MAC of the host system (should be resolved automatically)

- **-e, --essid=\<ssid\>**

  ESSID of the target AP. Unless cloaked, this will be resolved automatically.

- **-c, --channel=\<channel\>**

  Set the 802.11 channel for the interface (implies -f)

- **-o, --out-file=\<file\>**

  Send output to a log file \[default: stdout\]

- **-f, --fixed**

  Disable channel hopping

- **-5, --5ghz**

  Use 5GHz 802.11 channels

- **-v, --verbose**

  Display non-critical warnings (-vv for more)

- **-q, --quiet**

  Only display critical messages

- **-i, --interface=\<wlan\>**

  Name of the monitor-mode interface to use

- **-b, --bssid=\<mac\>**

  BSSID of the target AP

**-p, --pin=\<wps pin\>**

Use the specified WPS pin

- **-h, --help**

  Show help

## AUTHOR

This manual page was written by Craig Heffner \<cheffner@tacnetsol.com\>, Tactical Network Solutions. Permission  is  granted  to  copy,  distribute and/or  modify  this  document  under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.