Maybe you're running an outdated version of hcxtools or john. Please comment output of hcxhastool -v and john.
By the way, it looks like you're running a clone of hcxtools. Where did you get hcxtools from?
I asked because the latest official version from here https://github.com/ZerBea/hcxtools doesn't have any of the above described problems and there is absolutely no support for Microsoft products.
Running Linux and latest version of the tools everything is fine. The converted hash (mentioned in your post) is accepted by john
wpapcap2john produce a lot of unnecessary overhead.
But both hash lines (the short one as mentioned above and the expanded one created by wpapcap2john) are accepted by john. Where did you get john from?
I asked because the latest official version from herehttps://github.com/openwall/john doesn't have any of the above described problems
For more information about the new formats, please take a look at this:
https://github.com/openwall/john/issues/4183
https://github.com/hashcat/hashcat/issue...-566546059
To answer your question: "Am I doing something wrong?"
An update to latest version of john and hcxtools should fix your problems.
Latest git head of the official versions:
https://github.com/openwall/john
https://github.com/hashcat/hashcat
https://github.com/ZerBea
Avoid downloading them from dubious sources!
By the way, it looks like you're running a clone of hcxtools. Where did you get hcxtools from?
I asked because the latest official version from here https://github.com/ZerBea/hcxtools doesn't have any of the above described problems and there is absolutely no support for Microsoft products.
Running Linux and latest version of the tools everything is fine. The converted hash (mentioned in your post) is accepted by john
Code:
$ hcxhashtool -v
hcxhashtool 7.0.1-9-g19eda66 (C) 2025 ZeroBeat
$ john
John the Ripper 1.9.0-jumbo-1+bleeding-67fcf9fe5a 2025-09-04 23:50:10 +0200 MPI + OMP [linux-gnu 64-bit x86_64 AVX AC]
Copyright (c) 1996-2025 by Solar Designer and others
Homepage: https://www.openwall.com/john/
Usage: john [OPTIONS] [PASSWORD-FILES]
Use --help to list all available options.
$ john --no-log -w:hashmob.small --format=wpapsk-opencl test.john
Device 1@tux1: NVIDIA GeForce RTX 4080
Using default input encoding: UTF-8
Loaded 1 password hash (wpapsk-opencl, WPA/WPA2/PMF/PMKID PSK [PBKDF2-SHA1 HMAC-SHA256/AES-CMAC OpenCL])
Note: Passwords longer than 21 [worst case UTF-8] to 63 [ASCII] rejected
Note: Minimum length forced to 8 by format
LWS=256 GWS=2490368 (9728 blocks)
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 1461109 candidates buffered, minimum 2490368 needed for performance.
0g 0:00:00:01 DONE (2025-09-20 08:26) 0g/s 1293Kp/s 1293Kc/s 1293KC/s Dev#1:52°C 123456789..!1qazwsx
Session completedwpapcap2john produce a lot of unnecessary overhead.
But both hash lines (the short one as mentioned above and the expanded one created by wpapcap2john) are accepted by john. Where did you get john from?
I asked because the latest official version from herehttps://github.com/openwall/john doesn't have any of the above described problems
For more information about the new formats, please take a look at this:
https://github.com/openwall/john/issues/4183
https://github.com/hashcat/hashcat/issue...-566546059
To answer your question: "Am I doing something wrong?"
An update to latest version of john and hcxtools should fix your problems.
Latest git head of the official versions:
https://github.com/openwall/john
https://github.com/hashcat/hashcat
https://github.com/ZerBea
Avoid downloading them from dubious sources!