How to view your Wi-Fi connection history in Windows

The Windows operating system has a sophisticated network profile management system that automatically remembers the settings of all networks to which the computer has ever connected. Storing history Wi-Fi connections are necessary for quick authentication when you re-enter the router's range, but they also pose certain privacy risks. Any access point you connect to at a cafe, airport, or friend's house remains in the system's list, even if you're physically hundreds of kilometers away.

Users often wonder where exactly the operating system stores this data and whether it can be viewed without using third-party software. Windows 10 and Windows 11 hide the full list of previously used networks from the casual view in the graphical interface, leaving only active or frequently used connections in the settings menu. However, system administrators and advanced users know that The full history is stored in the system registry and is accessible via the command line, allowing for detailed diagnostics or cleaning of traces of presence.

In this article, we'll explore all available methods for obtaining information about past connections, from simple commands to deep registry analysis. Data security depends directly on how well you control your saved network profiles, so knowing how to manage them is a basic skill for a digital hygienist.

Using the Command Prompt to View a List of Networks

The fastest and most reliable way to see a list of all saved Wi-Fi profiles is to use the built-in utility netshThis tool is a standard Windows component and requires no additional software installation, making it ideal for system administrators. This command displays the names of all networks (SSIDs) to which a laptop or PC with a wireless adapter has ever connected.

To start the procedure, you must open a command prompt with administrator rights. This is critical, as querying network profile information requires elevated security privileges. After launching the console, enter the command netsh wlan show profiles, which instantly generates a list of all access points known to the system.

• 📡 Full list: Absolutely all networks are displayed, including those that were removed from the visible list in the settings but remained in the registry.
• 🔒 Security type: In advanced mode, you can see the encryption type (WPA2, WPA3) used during the connection.
• 👥 Group profiles: The list may contain profiles added by the organization's group policies if the computer is corporate.

It's worth noting that this command only displays network names, but does not display connection dates or detailed usage statistics. However, for the primary connection audiences This is quite sufficient. If the list contains any unfamiliar names, this may indicate attempts to scan the surrounding area or that someone else has used your device.

⚠️ Attention: The command line displays profiles associated with the current user or system. If you use multiple accounts, the history may differ depending on the login you're logged in with.

The resulting list can be copied to the clipboard by simply highlighting the text and right-clicking (or pressing Enter in some console versions). This is convenient for creating reports or comparing with a known list of trusted networks.

Viewing detailed information and passwords using PowerShell

For more detailed information about a specific profile, including last-use dates (if logged by the system) and configuration settings, it's more convenient to use PowerShell. This tool offers a more flexible syntax and the ability to filter output, which is especially useful when working with large numbers of saved profiles.

To see detailed information about a specific network, use the command netsh wlan show profile name="Network_Name" key=clearAdding a parameter key=clear allows you not only to see the settings, but also to display the saved password in clear text, which is often required when connecting new devices to an existing network.

netsh wlan show profile name="Home_WiFi" key=clear

In the command output, pay attention to the section Security settingsIt contains information about the encryption type and, if a key parameter is used, the password itself. The detailed information also shows the MAC addresses (BSSIDs) of the access points to which the connection was established, which helps identify a specific router in areas with multiple networks with the same name.

• 🔑 Security Key: Allows you to recover a forgotten password for your own network without resetting the router.
• 📶 Radio mode: Indicates whether 802.11n, ac, or ax was used the last time you connected.
• 📍 BSSID: A unique access point identifier that helps distinguish your home router from a neighbor's router with a similar name.

Using PowerShell allows you to automate the data collection process. The script can loop through all profiles and export their names to a text file, simplifying analysis for suspicious connections. This is especially useful for corporate security, where it is necessary to control which networks service laptops are connected to.

Analyzing history through the Windows system registry

The most comprehensive, but also most complex, source of information is the Windows system registry. This is where all profile configuration files are stored, including those that may be hidden or corrupted in the interface. Accessing this data requires caution, as incorrectly editing registry entries can lead to instability in the network subsystem.

Connection history is stored along the path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\ProfilesWithin this branch are subkeys with unique identifiers (GUIDs), each of which corresponds to a specific network connection. Within each GUID section, you can find the parameter ProfileName, containing the network name, and DateCreated or DateLastConnected, if the system kept such a log.

A standard utility is used to navigate the registry. regeditYou can launch it through the Run menu (Win+R) by entering the corresponding program name. When you navigate to the specified path, you'll see a structure where each profile is assigned a unique key. This allows you to track even networks that were connected a long time ago and were automatically removed from the priority list.

It's important to understand that dates in the registry are often stored in Unix Time format (number of seconds since 1970) or in the specific Windows FILETIME format. Reading them in a readable format may require additional calculators or scripts. However, the presence of a registry entry is cast-iron proof that a connection to this network was made.

⚠️ Attention: Before making any changes to the registry, be sure to back it up. Incorrectly deleting keys can result in the loss of all network settings and the inability to connect to the internet.

Viewing connection events via the Windows log

The Windows operating system maintains detailed event logs, recording virtually all significant actions, including attempts to connect to wireless networks. The Event Viewer is a powerful diagnostic tool that allows you to reconstruct the connection history, even if the profiles themselves have been deleted.

To find the connection history, you need to open the event log through search or command eventvwr.mscThe logs we need are located along the path: Applications and Services Logs → Microsoft → Windows → WLAN-AutoConfigThis is where adapter initialization events, successful connections, and authorization errors are recorded.

In the list of events, you should pay attention to the following codes:

• ✅ Event ID 8001: Successful connection to a wireless network. The network name (SSID) will be included in the event description.
• ❌ Event ID 8003: Disconnect from the network. Allows you to determine the duration of the connection session.
• ⚠️ Event ID 8002: Connection error. Useful for diagnosing issues with specific routers.

Filtering events by code allows you to quickly visualize the timeline of user movements or device operation. This is especially valuable when conducting digital expertise or investigating security incidents. The log stores data until it becomes full, so old records can be accessed even months later.

How to filter events?

In the right-hand log panel, select "Filter Current Log" and in the "All Event Codes" field, enter 8001, 8002, and 8003, separated by commas. This will hide unnecessary technical entries and leave only relevant connections.

Clearing history and network profiles

After analyzing your connection history, it's often necessary to delete old or suspicious profiles. This not only clears up the list but also improves security by preventing automatic connections to unsecured or fake access points with known names (Evil Twin).

Removal can be done via the graphical interface: Settings → Network & Internet → Wi-Fi → Manage known networksHere, simply select the unwanted network and click the "Forget" button. However, for bulk clearing or deleting hidden profiles, it's more efficient to use the command line.

The command to delete a specific profile looks like this: netsh wlan delete profile name="Network_Name"If you need to delete all profiles at once (a radical method), you can use a PowerShell script that will loop through all the names and execute the delete command. This will restore the network settings to their factory defaults.

After clearing the profiles, it is recommended to restart the computer. This will allow the network service WLAN AutoConfig Restart the scan process and apply the changes. If you deleted the home network profile, the system will prompt you for the password again the next time you connect, classifying the network as a new one.

Questions and Answers (FAQ)

Is it possible to find out the exact time and date of the first Wi-Fi connection?

You can try to find the exact date of the first connection in the registry (the DateCreated parameter in the Profiles branch), but this data is not always accurate due to system reinstallations or resets. A more reliable source is the Windows event log (WLAN-AutoConfig), unless it has been cleared.

Is the history of visited websites saved in the Wi-Fi connection history?

No, the Wi-Fi profile history only contains network names (SSIDs) and connection parameters. The list of visited websites is stored in the browser and is not directly related to Windows network settings. However, the router owner can view browsing logs on their device.

What should I do if an unknown network appears in my history?

If you see a network you haven't connected to, this could be due to background Windows services scanning the surrounding area, or it could be due to other people using your device. We recommend deleting this profile and scanning your computer with an antivirus for malware that alters network settings.

Are deleted profiles restored after reinstalling Windows?

When you perform a clean installation of Windows by formatting the disk, all local profiles and connection history are permanently deleted. If you use the "Go back to the previous version" feature or sync settings via a Microsoft account, some data may be restored from the cloud or a backup.