Any company laptop that has connected to the corporate Wi-Fi network retains the network password in plain text. When an employee departs, the device is returned, yet the password remains accessible through simple operating-system commands.
Windows
The built-in netsh utility lists all saved wireless profiles with the command netsh wlan show profiles. The password for a specific network is retrieved by running netsh wlan show profile name="CorpNet" key=clear. The resulting Key Content line displays the passphrase in clear text. No administrative privileges are required; the command works under the same user account that originally joined the network.
Linux
NetworkManager stores connection details in files located at /etc/NetworkManager/system-connections/. The command sudo grep -r 'psk=' /etc/NetworkManager/system-connections/ extracts the pre-shared key in plain text. Ordinary users can list connection names without elevated rights using nmcli -t -f NAME,TYPE,AUTOCONNECT connection show.
macOS
Passwords reside in the system Keychain. The command security find-generic-password -ga "CorpNet" will display the password, but the operating system first prompts the user for explicit confirmation, providing a stronger access-control model than Windows or Linux defaults.
This behavior is not a vulnerability; devices must retain credentials to reconnect automatically. The real issue lies in organizational policy. A shared Wi-Fi password is known to every employee, contractor, and guest who has ever connected. Changing it requires reconfiguring every corporate device, so rotation is often postponed for years. Personal devices that joined the network may also carry the password into cloud backups.
Recommended alternatives include WPA2/WPA3-Enterprise authentication, which ties network access to individual user accounts and automatically revokes access upon account deactivation. A separate, time-limited guest network with strong isolation from internal resources allows frequent password changes without affecting staff devices. When a shared password remains unavoidable, it should be stored in a password manager, rotated after every employee departure or contractor engagement, and never posted visibly in meeting rooms.
