Wi-Fi Networks on Android: WifiConfigStore.xml

What it is

Android's Wi-Fi service persists the networks a user has saved in an XML store named WifiConfigStore.xml. Every network entered in Settings, joined through a QR code, restored from a Google backup or added by an app through the Wi-Fi APIs has a <Network> element with its SSID, security type, credentials and status. It is a location artifact as much as a network one: a saved SSID such as a hotel, an employer or a friend's router places the phone there at least once.

Since Android 11 the Wi-Fi stack is an updatable Mainline module (APEX), which is why its files moved to an apexdata folder.

Where it lives

Before Android 8, saved networks lived in wpa_supplicant.conf; that file is not used on the versions covered here. On most builds WifiConfigStore.xml is plain XML. Several Android 12+ system files use Android Binary XML (ABX): if the file starts with the bytes ABX, convert it first.

What it proves

• The SSIDs saved on the device, including hidden networks (HiddenSSID), and their security (open, WPA2-PSK, WPA3-SAE, enterprise EAP).
• Whether the phone ever connected successfully (HasEverConnected in the network status block).
• Who created and last modified each entry (CreatorName / CreatorUid, LastUpdateName / LastUpdateUid): com.android.settings for the user, another package for an app, the system for restored networks.
• The randomized MAC address the phone presents to that network (RandomizedMacAddress), plus the MAC randomization setting.
• The pre-shared key, in clear on many builds (or as encrypted data on builds that protect it with the Keystore).

It does not tell you when or how often the phone was on a network, and a saved network may come from a cloud restore of an older phone.

Key fields

Element names and the store Version change between releases; read the file before writing an extraction script.

Timestamps

The store has few reliable per-network timestamps. Some Android 8 and 9 builds wrote CreationTime and UpdateTime strings in a month-day-time format without a year; later builds dropped them, and some recent builds record connection-related times in the status block. Treat any of them as build-specific. The file's own modification time only shows the last change to any network. To date an association, correlate with usagestats screen events, bugreport Wi-Fi logs, photo EXIF, or the access point's logs.

xmllint --xpath '//Network/WifiConfiguration/string[@name="SSID"]/text()' WifiConfigStore.xml
python3 - <<'PY'
import xml.etree.ElementTree as ET
for net in ET.parse("WifiConfigStore.xml").iter("Network"):
    cfg = net.find("WifiConfiguration")
    get = lambda n: (cfg.find(f"*[@name='{n}']").text if cfg.find(f"*[@name='{n}']") is not None else None)
    status = net.find("NetworkStatus")
    ever = status.find("*[@name='HasEverConnected']") if status is not None else None
    print(get("SSID"), get("CreatorName"), get("RandomizedMacAddress"),
          ever.get("value") if ever is not None else None)
PY

Retention

A network stays until the user taps Forget, the app that suggested it withdraws the suggestion or is uninstalled, a device policy removes it, or the phone is factory reset. Networks can come back through a Google backup restore on a new phone, keeping their original SSID but a new creator context.

Collection

• Full file system extraction: copy the whole apexdata/com.android.wifi folder (or /data/misc/wifi on 8 to 10) and the per-user store. The main store sits in system device-encrypted storage, since the phone joins Wi-Fi before the user unlocks, so a privileged extraction reaches it even in BFU.
• Logical: adb shell dumpsys wifi lists configured networks, recent scan results and a connection log without root; keys are masked and the output format varies by build.
• Bugreport: includes the Wi-Fi service dump with recent connection events.

Parsing

ALEAPP reports saved Wi-Fi profiles and hotspot configuration. For manual work, xmllint or Python ElementTree are enough on plain XML; convert ABX first with abx2xml on a device running Android 12 or later, or with ccl_abx offline.

Investigator tips

• The RandomizedMacAddress for a network is stable for that SSID on most builds: search router, DHCP, captive portal or enterprise Wi-Fi logs for it to prove presence and get times.
• A CreatorName that is not Settings or the system points at an app that configured Wi-Fi; check it in installed packages. Stalkerware and MDM agents do this.
• Networks with HasEverConnected false were saved but never joined, often restored from another device.
• Hotspot configuration (WifiConfigStoreSoftAp.xml) shows the phone's own tethering SSID and passphrase, which other devices may have saved.
• Visits to captive portals often appear in Chrome history right after an association: a useful time anchor.