How to backup Android WiFi keys (without root)

For a variety of reasons, device and software manufacturers implement various levels of restrictions to prevent users from accessing saved WiFi keys.

On Android (depending on your device model/software) you may be able to access the key for an individual access point, or share this information via a QR code. This data may even be included when using Google to backup/restore your Android device.

Unfortunately, none of these methods make it straightforward to backup all of your WiFi keys in plaintext without involving an intermediary third-party (such as Google). In this guide, I will detail how to do this yourself with adb and python3.

Assumptions

I will be assuming you have setup ADB and Python, and have some familiarity with these tools.

The command-line instructions in this guide assume you are using Linux - but they could be easily adapted to work on Windows.

1. Using ADB to back up your device.

Now that you have adb installed and configured, we will use it to backup our device.

adb devices
adb backup -all -shared -system -keyvalue -f file.adb

Depending on the device Android version (my Samsung device was running Android 12) will likely get a popup on your device asking for a password to encrypt the backup. Make sure you remember this password.

2. Decrypt the backup

Now that we have backed up our device, we need to decrypt the backup to access its contents.

We will be using this project to decrypt the backup file.

In an empty directory perform the following:

git clone https://github.com/lclevy/ab_decrypt.git .
python3 -m venv .venv
source .venv/bin/activate
pip install pycryptodome
python ab_decrypt.py -b file.adb -p a -v 1 -o backup.tar

3. Extracting the WiFi keys to file

The WiFi network information is stored at the following path inside your decrypted backup: <backup.tar>_/apps/com.android.providers.settings/k/com.android.providers.settings.data

See this article by Yogesh Khatri for more information on the system settings stored in this file.

Extract this file (com.android.providers.settings.data) before processing it with a simple python script:

import json
import re

f = open('com.android.providers.settings.data',mode='r')
settings_data = f.read()
f.close()

x = re.compile(
    '^<string name="SSID">&quot;(.*)&quot;(?:.*)\n'+
    '<string name="PreSharedKey">&quot;(.*)&quot;(?:.*)$',
    re.MULTILINE
)
matches = [m.groups() for m in x.finditer(settings_data)]

wifi = []
for m in matches:
    wifi.append({'SSID': m[0], 'Key':m[1]})
print(wifi)

wifi = sorted(wifi, key=lambda d: d['SSID'].lower())
f = open("output.json", "w")
f.write(json.dumps(wifi, indent=4))
f.close()

You should be left with an output.json file with the following structure. This contains both the WiFI SSID and Key.

[
    {
        "SSID": "WifiNetwork1",
        "Key": "XXXXXXXXXX"
    },
    {
        "SSID": "WifiNetwork2",
        "Key": "XXXXXXXXXX"
    },
    {
        "SSID": "WifiNetwork3",
        "Key": "XXXXXXXXXX"
    },
    ...

A word of caution

While this guide has detailed a method to back up Android WiFi passwords without root access, it's important to acknowledge the responsibility that comes with managing such sensitive information. Exercise caution, adhere to ethical considerations, and respect the privacy of network owners.

Tags