Best Wi-Fi adapters for pentesting and ethical hacking

Every ethical hacking guide points at the same short list of USB adapters, but the name on the box is the wrong thing to read. Two cards that cost the same and look the same can behave nothing alike, and the reason is the chip hidden inside.

My drawer is packed with these adapters. After years of buying, flashing and testing them on my own network and in my home lab, the pattern never changes. A card for wireless testing has to do two things a normal one cannot. It has to watch every frame in the air, which is monitor mode, and it has to send its own frames, which is packet injection. Whether a card can do both, and whether it still can after a kernel update, comes down to the chipset inside it, not the brand on the box. I have seen two near-identical sticks behave completely differently because of the chip under the label. Here is what I actually reach for, scored by use, and the real differences between the chips.

The shape tells you nothing about what a card can do. Each form factor comes with several different chipsets inside.

The chipsets I trust

Four chip families handle everything I need, so I don't buy anything else.

I reach for MediaTek's mt76 family first. The MT7610U and MT7612U do 2.4 and 5 GHz, the MT7921AU adds 6 GHz, and the MT7925U handles Wi-Fi 7. They're all in the kernel, and a single card can inject packets, run monitor mode, and spin up a fake access point at the same time, which is exactly what an evil-twin setup calls for.
I never leave home without my Atheros AR9271. It caps out at 150 Mbps on 2.4 GHz and the design dates back a while, but the injection works better than anything else I've tried and the driver has been in the kernel since 2010.
Ralink's RT5572 and RT3070 are old and slow. The RT5572 handles both 2.4 and 5 GHz, while the RT3070 does 2.4 only. But the rt2x00 driver behind them has lived in the kernel for over a decade and does everything an evil twin needs, so a cheap one still earns a spot in my drawer.
The Realtek RTL8812AU, RTL8811AU and RTL8814AU show up just about everywhere and reach a long way. They're the chips that have given me the most trouble, and I'll get to why below.

The chipset scorecard

Here is every chipset I would buy, scored out of ten for software support. A card gets points for having its driver in the kernel and for how long that driver has been there. It also scores for running monitor mode and a fake access point at the same time, for the bands it covers, and for active monitor mode. That order favours the older MediaTek, Atheros and Ralink chips, whose drivers have held up for years, and scores the newer Realtek and Wi-Fi 6E parts lower because their support is thinner.

#	Chipset	Bands	Monitor	Inject	Mon + AP	Active mon	In-kernel	Score
1	MediaTek MT7612U	2.4/5	Yes	Yes	Yes	Yes	4.19	9.5/10
2	MediaTek MT7610U	2.4/5	Yes	Yes	Yes	Yes	4.19	9.5/10
3	Ralink RT5572	2.4/5	Yes	Yes	Yes	No	3.10	8.5/10
4	Ralink RT3070	2.4	Yes	Yes	Yes	No	2.6.31	8/10
5	Atheros AR9271	2.4	Yes	Yes	Yes	No	2.6.35	8/10
6	MediaTek MT7921AU	2.4/5/6	Yes	Yes	Yes*	No	5.18	7/10
7	MediaTek MT7925U	2.4/5/6	Yes	Yes	Yes*	No	6.7	6.5/10
8	Realtek RTL8812AU	2.4/5	Yes	Yes	Patched	No	6.13	5/10
9	Realtek RTL8811AU	2.4/5	Yes	Yes	Patched	No	6.13	5/10
10	Realtek RTL8814AU	2.4/5	Yes	Yes	No	No	6.15	3.5/10

Table 1 shows a score out of ten, weighted toward software support. Mon + AP is the one-card evil-twin test. In-kernel marks the first kernel to ship the driver. Patched means you need an out-of-tree driver, and an asterisk means kernel 7.2 or newer.

What I actually reach for

The adapter I reach for first, and the one I tell beginners to grab, is an AR9271 card. Pick the Alfa AWUS036NHA or the TP-Link TL-WN722N v1. They're cheap, need no setup, and every tutorial assumes you have one.
For daily use on 2.4 and 5 GHz, I use an MT7612U card like the Alfa AWUS036ACM or the Panda PAU0D. It's never given me trouble, and it passes Alfa's own injection test.
When I need 5 GHz on the go, I reach for an MT7610U card. The Alfa AWUS036ACHM, the TP-Link Archer T2UH and the ASUS USB-AC51 all use that chip.
For the 6 GHz band I use an MT7921AU card, one of the Alfa AWUS036AXML, Fenvi AX1800 or Netgear A8000, and I keep an eye on the kernel, see below.
The Netgear A9000, built on the MT7925U chip, is the only new Wi-Fi 7 card I've found that passes every monitor-mode test.

Popular adapters by chipset

Shop by chipset. Here are the adapters I come across most for each one, across brands. The same chip costs less on some boards and works the same in Linux, so I buy on the chipset and only pay more for build quality when I need it.

Chipset	Adapters
MediaTek MT7612U	Alfa AWUS036ACM, Panda PAU0D, Netgear A6210, ASUS USB-AC54 and USB-AC55, Edimax EW-7722UAC, PIX-LINK LV-UAC04
MediaTek MT7610U	Alfa AWUS036ACHM, TP-Link Archer T2UH and Archer T1U, Panda PAU0A and PAU0B, ASUS USB-AC51, Linksys AE6000, Sabrent NTWLAC, D-Link DWA-171 B1
Ralink RT5572	Panda PAU07, Panda PAU09
Ralink RT3070	Alfa AWUS036NH, TP-Link TL-WN7200ND, Panda PAU08
Atheros AR9271	Alfa AWUS036NHA, TP-Link TL-WN722N v1 and TL-WN721N, Netgear WNA1100, D-Link DWA-126
MediaTek MT7921AU	Alfa AWUS036AXML and AWUS036AXM, Fenvi FU-AX1800 and FU-AX1801D, EDUP EP-AX1672, COMFAST CF-952AX, BrosTrend AX9L, Panda PAU0F, Netgear A8000 and A7500, TP-Link TXE50UH
MediaTek MT7925U	Netgear A9000, Netgear A8500
Realtek RTL8812AU	Alfa AWUS036AC and AWUS036ACH, TP-Link Archer T4U v1, ASUS USB-AC56 A1, COMFAST CF-912AC, Netis WF2190, Tenda U12, Linksys WUSB6300 v1, Edimax EW-7822UAC, D-Link DWA-182 C1
Realtek RTL8811AU	Alfa AWUS036ACS, Netgear A6100, TP-Link Archer T2U Nano
Realtek RTL8814AU	Alfa AWUS1900, TP-Link Archer T9UH, ASUS USB-AC68, Netgear A7000, D-Link DWA-192, Edimax EW-7833UAC, COMFAST CF-958AC

Table 2. Adapters per chipset, in scorecard order. Cheap brands reuse a model name across chips, so check the chipset and the hardware revision. From the kernel device tables, airgeddon and morrownr.

Buy the chipset, not the brand

The chip does the work, so an unnamed stick with an MT7612U behaves just like the Alfa on the software side. I paid a third of the price by shopping for the chipset instead of the model. The rest of the story is what surrounds the chip.

The cheap clones I have bought skimp on the heatsink and get hot enough during a long capture to throttle the radio or drop the link. They fit smaller fixed antennas, thinner shielding and flimsier USB plugs. Twice I received a board with a relabelled or weaker chip than the listing promised.

For light use a clone is fine. For hours of capture or real range, the known brands have earned their place in my kit.

Why in-kernel drivers win

Every pick above comes down to one thing. Does the driver ship inside Linux, or do you bolt it on? Atheros uses ath9k_htc and MediaTek uses mt76, and both are in the kernel. That means I plug the card in and it works, and it keeps working after an update because the driver updates with everything else.

Realtek's pentesting chips had no in-kernel driver for years. You installed one through DKMS, it rebuilt against every kernel, and more than once a kernel bump left the driver behind and my card dead until someone patched it. The in-kernel rtw88 driver now covers them. It supports the RTL8811AU and RTL8812AU starting with kernel 6.13, and the RTL8814AU from kernel 6.15. It still will not run monitor mode and a fake access point on one card though. The evil-twin tool airgeddon agrees, listing the RTL8811AU and RTL8812AU as working only with patched drivers, and the RTL8814AU as unable to do it at all.

The driver built into Linux updates alongside the kernel, while a driver kept outside the tree has to be rebuilt for every new kernel. If that build fails, the card stops working.

What has actually bitten me

No hardware can get around the 6 GHz band or WPA3. WPA3 requires protected management frames, which stops the classic deauthentication trick, and the 6 GHz rules cap what a card is allowed to transmit. Wi-Fi 6E adds more channels but doesn't open up any new ways to attack the network.
Virtual machines break injection. I wasted an afternoon on USB passthrough before giving up, since the timing jitter they add makes injection unreliable. Now I run my tools on bare metal or from a live USB.
Two cheap cards work better than one for running an evil twin. I run one in monitor mode and let the other host the fake access point. Atheros and MediaTek chips can run both modes on one card, but a kernel bug dropped every injected frame while the fake access point stayed up. The fix arrived in 6.19 and went back to 6.12.66 and 6.18.6, but the MT7921AU and MT7925U only got theirs in 7.2. Two AR9271 sticks sidestep the whole problem and cost less than one high-end card.
A bug with the MT7921AU monitor mode tripped me up on a clean install. Kernel 6.17 broke it and the card captured nothing. The fix came in 6.19, and the point releases 6.17.13 and 6.18.2 picked it up too. I check the point release before blaming the card. Its active monitor mode, where the card acknowledges frames, never worked, and kernel 7.3 dropped it.
The same name can cover different chips. The TP-Link TL-WN722N v1 uses an Atheros chip, while the v2 and v3 use a weaker Realtek one. I always check the hardware revision before trusting the model number.

Checking a new card

I don't trust a listing until I've tested it myself. I plug the card in and run lsusb to read the chipset, iw list to check the valid interface combinations, or whether it can do monitor and access point at the same time, then aireplay-ng --test in monitor mode to confirm it injects. Those three commands have kept me from buying more bad boards than any review ever did.

What to buy

Start with an AR9271 card. The Alfa AWUS036NHA and a genuine TL-WN722N v1 are both good choices. If you do a lot of 2.4 and 5 GHz work on a modern system, get an MT7612U card like the Alfa AWUS036ACM. For the 6 GHz band, pick an MT7921AU card, such as the Alfa AWUS036AXML or the Fenvi AX1800, and check your kernel version. The Netgear A9000 is worth watching as Wi-Fi 7 keeps improving.

I only run tests on networks I own or have explicit permission to test, and I'd advise the same.