I'm gonna explain it exactly: Parents divorced, I have a laptop from mom, and a smartphone from my father (with subscription contract), with internet access, and hotspot capable. My question is: If i make hotspot on the phone (from my father), to share internet, is it legal to crack it's password using the laptop (from my mother), for penetration testing purpose?

I'm not exactly sure, and i don't wanna end up messing with the police. I'm just trying to see how long it takes to crack the phone's wifi password, to make it as secure as possible.

  • 1
    Since you control the Wi-Fi network, you can attempt to crack it for testing or for any other purpose.
    – phoog
    Jul 14, 2016 at 13:58
  • Hacking laws differ from jurisdiction to jurisdiction. Most jurisdiction allow you to hack your own property or property of others when you have their explicit permission. But there are jurisdictions where owning and/or creating hacking software is illegal. There are also jurisdictions which make certain forms of hacking illegal due to laws forbidding reverse engineering.
    – Philipp
    Jul 14, 2016 at 14:02
  • Thank you very much, and may i ask one more question? If i hack a wifi let's say, my school's wifi, but the owner does not allow me, it is illegal, but how does the owner know that his wifi password was cracked? therefore if he doesn't know, i could freely crack anyone's wifi password, and never get punished by law right?
    – Daniel
    Jul 14, 2016 at 17:48
  • @Daniel Technical methods for finding and tracing illicit use of IT systems (the technical term is "intrusion detection") is a topic for security.stackexchange.com.
    – Philipp
    Jul 14, 2016 at 18:14

1 Answer 1


US law (18 U.S.C. § 1030) only addresses US government computers, computers used in a way that affects interstate commerce, and those of financial institutions. Turns out, cell phones and home computers affect interstate commerce. So the forbidden acts are delimited by expressions like "having knowingly accessed a computer without authorization or exceeding authorized access", "intentionally accesses a computer without authorization or exceeds authorized access" or "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value". Notice that the law is stated in terms of authorization to access, and not "cracking passwords". Similarly, 18 U.S. Code § 2701 uses phrases like "accesses without authorization". Each state has its own laws: in Washington, RCW 9A.52.110-130 identifies forbidden acts via phrases like "without authorization, intentionally gains access".

The closest I can find that comes to a law that might imaginably have some bearing on "password cracking" is 18 U.S. Code § 1029 which prohibits uses of "counterfeit access devices". An "access device" is defined in para (e) as "any ...means of account access that can be used, alone or in conjunction with another access device, to obtain money..." (there is the usual attempt at an exhaustive listing behind the ellipses). A password cracker would then be an access device since it along with a user interface to a system allows one to access the system and thus the internet of things. A counterfeit password cracker would be e.g. one manufactured by BlackhatHackersoft which passes itself off as one manufactured by WhitehatHackersoft.

However: 18 USC 1029 specifically says "knowingly and with intent to defraud produces, uses, or traffics in one or more counterfeit access devices", and the intent that you describe is not to defraud. If you want a paid analysis by a professional, you can hire an attorney. My view is that if the police were to come after you, that would be an abuse of law, because the law does not prohibit taking reasonable steps to select a safe password (something like "CorrectHorseBatteryStaple", which I hear is now just behind "password" in use as a password).

  • Thank you for this explanation, it's really helpful. About hiring a professional: well i don't really have money for it, and i don't really trust these guys, because if i don't what he does, he can do anything, AND also i want to practice this for my own benefit of learning how these things work, so if a professional comes in, i would not understand a single thing of what he does. But thanks again anyway!
    – Daniel
    Jul 14, 2016 at 18:00
  • You're right, I missed that. Danged run-on statutes are death on the brain.
    – user6726
    Jul 15, 2016 at 4:29
  • It's not clear to me that a password cracker is an "access device" for the purposes of 18 USC 1029. Is that based solely on your own reading of the text, or is there case law supporting such an interpretation? It looks to me like the intent of 18 USC 1029 is to forbid making or using fake credit cards. I think it would take a very creative prosecutor, and a very open-minded judge, to apply it to someone cracking passwords on a home wifi network, and I would be surprised if it has ever happened. Jul 15, 2016 at 17:29
  • I am not an intent-based jurisprudician. Case law is replete with creative prosecutors and judges. But that's a subject for a separate question.
    – user6726
    Jul 15, 2016 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.