This is wrong in multiple ways. Your device won't connect to the same SSID unless it has the exact same password. If the hacker has your exact password, you have bigger concerns than a fake AP. (Like a hacker lurking in your freaking driveway, haha)
Obtaining passwords depends on if the website...