The Blockchain.com wallet has two locks — and only one matters.

Which wallets use this format?

This export format belongs to one wallet: Blockchain.com (formerly blockchain.info). If your file is named .aes.json, it came from their app or web wallet — no other major wallet writes it.

Inside it, the encryption is anything but uniform: the old v0 format is extremely fast to test; v2 and v3 are much slower than v0, but both are still weak compared with modern memory-hard wallet formats — and in the benchmark shown here, v3 is faster than v2. The recovery phrase, if you have it, skips the password for the addresses derived from it.

First: do you have the recovery phrase?

There are two distinct generations, and they use different phrases:

• Modern Blockchain.com (HD) wallets use a standard 12-word BIP39 seed. Import it into any BIP39-compatible wallet (or the current Blockchain.com app), set a new password, and move on. One caveat: imported addresses are not backed up by the Recovery Phrase — verify every expected address and balance after restoring before discarding the old wallet file or credentials.
• Legacy blockchain.info wallets used a mnemonic recovery phrase of 6–25+ words from a fixed list — not a BIP39 seed, and it works differently. That mnemonic is a password-recovery mechanism: a tool that supports the legacy format uses it to reveal the wallet password from the time the phrase was created. If the password was changed later, only that earlier password comes back. It does not regenerate your keys, and it does not restore the wallet the way a modern seed does.

For the modern 12-word phrase, this is the same situation as MetaMask — the password protects the local copy, the phrase is the key. If you have most of the phrase but not all of it, that’s seed reconstruction — outside this site’s scope; the search checklist is your best tool for a complete copy. The legacy mnemonic is a different mechanism entirely: partial words do not complete into a wallet, they complete into the original password-recovery route described above.

If the phrase is gone, check one more modern route before assuming the exported file is your only door: current Blockchain.com mobile app versions can create an encrypted cloud backup of the wallet (Apple iCloud or Google Drive). Blockchain.com documents that backup as the recovery path for cases where the wallet password and/or Recovery Phrase are lost — on a supported app version it restores on the same operating system and cloud account, with your app PIN if prompted. It is not a guarantee, but it is worth checking before you write the wallet off.

The file: wallet.aes.json

Blockchain.com’s wallet export produces a file named wallet.aes.json (older versions: wallet.json.aes). It’s an encrypted JSON that contains your private keys, and it’s what the site’s own backup system produced when you clicked “Download backup”. Three formats exist, and the differences matter enormously:

All three speeds are published measurements from the btcrecover benchmark suite (Ryzen 9 9950X, 2026) — btcrecover.readthedocs.io/Benchmarks. Note the KDF is SHA1-based, not SHA512: that, plus the low iteration counts, is why these files crack so much faster than a wallet.dat of the same era.

Where the file hides

The checklist on this site is the systematic way to search, but for Blockchain.com specifically, check these first:

• your downloads folder and old download history — every “Download backup” click left a file;
• email attachments — many users exported and emailed themselves the backup;
• old laptops, external drives and cloud storage from the era you used the wallet;
• the current app’s export feature — you can still export a file if you know the password, but that’s circular; the point here is finding a previous export.

Work the full list on the ultimate search checklist, then read how to find wallet files for the technical search.

Cracking the export (if you have it)

With the file in hand, the process is exactly the one described on offline recovery tools: btcrecover reads the export directly, and hashcat attacks it as mode 12700 (the legacy My Wallet export), 15200 (V2/V3) or — for very early V0 wallets — 34700 (identify the version first). Your password’s shape — how you built it — matters more than the file. A memory reconstruction that narrows the password to “name + year + a symbol, about 9 characters” puts even a v2 file well within reach on a single machine.

If your account also had the optional second password, it is stored as a separate hash — but the path is not parallel: in many workflows you must first recover or know the main wallet password before attacking the second-password hash.

Recovery tools, in one table

Common mistakes

• Treating v0/v2/v3 the same. A v0 file tests over 100× faster than v3 — the format inside the file decides your odds, not the wallet brand.
• Treating the legacy mnemonic like a modern seed. Only the 12-word BIP39 Recovery Phrase restores the addresses derived from that phrase anywhere and makes the password a paperweight for them — imported addresses are not covered by the phrase and need their own private-key or wallet backups. A legacy 6–25+ word mnemonic is not a seed: it can reveal the original wallet password from when the phrase was created — it does not regenerate your wallet.
• Uploading the .aes.json. The export contains your keys. Everything runs offline on a copy — the protection rules.
• Using the wrong hashcat mode. 12700 vs 15200 vs 18800 target different formats, and very early V0 wallets use 34700; the wrong mode loads nothing or never cracks.

Frequently asked questions

Is the Blockchain.com wallet password the same as the recovery phrase?

No. The password encrypts the local wallet.aes.json export. The modern 12-word BIP39 Recovery Phrase recreates the addresses derived from that phrase anywhere and makes the password irrelevant for them — imported addresses are not backed up by the phrase and need their own backups. Legacy blockchain.info wallets are different: their 6–25+ word mnemonic is not a BIP39 seed — it is a password-recovery mechanism that can reveal the wallet password from the time the phrase was created (if the password was changed later, only that earlier password is recovered).

Which Blockchain.com format is fastest to crack?

v0 — just 10 PBKDF2-SHA1 iterations, checked at over 600,000 guesses per second on one CPU. v2 and v3 use 10,000 and 5,000 iterations — still far weaker than a modern wallet.dat.

I never downloaded a backup — can the file still exist?

Not necessarily. First check old downloads folders, emailed backups and cloud storage from the era you used the wallet — the checklist walks through all of them. For some legacy wallets, the encrypted wallet payload can also be retrieved during a login attempt without the correct password, provided you still have the Wallet ID and can satisfy any required email/2FA checks — version-dependent, and the current account flow is not guaranteed to work for every wallet.

Your verdict

• Phrase available: restore the addresses derived from it and set a new password — then verify every expected address and balance (imported addresses need their own backups) before discarding anything.
• v0/v2 file + any memory of the password: genuinely good odds. Run the calculator with the Blockchain.com rates.
• v3 file, zero memory of the password, fully random password: the math gets hard fast — run it before paying anyone.

Whichever path applies, the next step is the same: secure every copy of the file, then weigh your options with real numbers.

Sources & references

1. btcrecover — performance benchmarks