Forgot your brain wallet password? How recovery works

The short answer

A brain wallet is the one case where “forgot wallet password” really means “forgot the passphrase that is the key.” There is no file, so there is no encrypted verifier to test against in the usual sense. Instead, every candidate passphrase is hashed into a private key, that key is turned into a public address, and the result is compared with the address you have. Recovery is therefore a pure candidate-generation problem: the testing speed is excellent, but the search space is defined entirely by what you remember.

What a brain wallet actually is

Brain wallets were popular in the early 2010s as “a wallet in your head”: you memorised a passphrase, and the software derived your private key from it. No file, no backup, no seed phrase on paper — which is exactly why they are now a recovery topic instead of a storage method. Two derivation families matter, and they behave very differently under attack:

• bitaddress.org / brainwallet.org style — private_key = SHA-256(passphrase), then the key is converted into a secp256k1 public key and hashed into the familiar Bitcoin address. The passphrase is hashed exactly as typed. This is the classic, fast route, and most old brain wallets use it.
• WarpWallet / Memwallet style — WarpWallet derives the key from two runs XOR’d together: one scrypt pass (N=2¹⁸) and one PBKDF2-HMAC-SHA256 pass (2¹⁶ rounds) — not a single scrypt hash. It can be “salted” with the email address you entered at creation, is deliberately slow and memory-hungry, and if you used an email salt, you must reproduce that exact email as well.

“Brain wallet password recovery” is therefore really passphrase reconstruction, and the tooling differs from normal wallet files. The good news: there is no encrypted file format to reverse. The bad news: with no file and no checksum, the search space is bounded only by what you remember.

Step 0 · Check the address still holds funds

Before anything else: look up your public address on a block explorer. Many old brain-wallet addresses were drained years ago by automated scanners that grind through common phrases and known quotes — if the known target address shows zero balance and no relevant history, a BTC recovery may not be worth pursuing. Before stopping completely, check whether the passphrase/private key could correspond to a compressed or uncompressed address variant or to relevant BTC-fork assets from the period in question.

The address is public data and safe to look up anywhere. The passphrase is not: never type a suspected passphrase into a website that offers to “check” it. All real recovery runs offline on your own machine, for a simple reason — a checker website is just collecting phrases it can sweep itself.

Why testing is fast — and where it isn’t

For the SHA-256 route, each candidate costs one hash plus one elliptic-curve key derivation, and the key derivation is the bottleneck. That still puts the classic route in a completely different league from encrypted wallet files:

Practical consequence: a tight, well-built list of a few million candidates takes minutes to hours on the SHA-256 route — the list, not the hardware, is what you should obsess over. For a WarpWallet or Memwallet the same list takes weeks to months, so the clues have to be much stronger there.

The tools: btcrecover, brainflayer, and why hashcat is not on the list

btcrecover is the easiest route and the same tool used everywhere else on this site. It reads brain wallets directly: --brainwallet for SHA-256 passphrases (bitaddress.org, liteaddress.org, paper.dash.org) and --warpwallet for scrypt-based WarpWallet/Memwallet. You supply your address and a token list of candidate passphrases, exactly as in the main walkthrough. → btcrecover step by step · Command cheat sheet

Brainflayer is the dedicated brain-wallet cracker (open source, ryancdotorg/brainflayer). It builds a Bloom filter from a list of addresses and streams candidate passphrases from wordlists, matching any address it finds. It takes more setup than btcrecover, but it is the reference tool when you want to push very large wordlists through the SHA-256 route.

Hashcat is not in the default lineup for this case. There is no official hashcat mode for the standard SHA-256(passphrase)→address route, because every candidate also needs full ECDSA public-key derivation and RIPEMD-160 hashing — a custom kernel, not a built-in mode. Maintained GPU projects exist (Hydra is the one with published brain-wallet benchmarks), but for a normal case you do not need hashcat here; don’t hunt for a mode number that doesn’t exist.

Everything above runs fully offline. The only inputs are the public address and your candidate list — no wallet file, no upload, no account.

The candidate list decides the case

This is the part that actually wins or loses. Testing speed is identical for everyone; your memory is the only advantage you have. Start from what you know:

• exact phrase fragments, in order, including spaces and punctuation;
• capitalisation — Password, password and PASSWORD are three different keys;
• numbers and substitutions (@ for a, 1 for l, 0 for o);
• word order and missing words — “i love you”, “love you i”, “i love”;
• keyboard layout — the same phrase typed on QWERTY vs AZERTY (or on a phone) produces different bytes;
• the era and your habits — how you built passphrases back then decides the shape of the search.

Then turn the memory into a candidate list with the same method as every other wallet on this site: a base wordlist from your life, mutated into variants. The hint-list guide explains the method, and the offline token builder generates btcrecover tokens.txt from your fragments without uploading anything. For brainflayer, use a plain wordlist — one candidate per line. → Build a password hint list · Offline token list builder · How your memory made it

The math: if you remember the phrase roughly, variants like case and extra characters multiply the list a few times — perfectly testable on the SHA-256 route. If you only know it was “a quote” or “something with my dog’s name”, the space explodes far beyond anything hardware can cover. That is not a recovery case; it is a lottery.

Edge cases worth testing

• Case and spacing normalisation — some generators lowercased or trimmed the input before hashing. If the address doesn’t match your first guess, test the lowercased and trimmed variants; it is cheap when the base list is small.
• WarpWallet email salt — you need the exact email you entered when creating the wallet, because it becomes part of the derived key. If unsure, test the few email addresses you used in that era.
• Repeated hashing — a known DIY variation is iterating SHA-256 more than once instead of once. If your exact generator is uncertain, test the single-hash route first, then the double-hash variant.
• Old clones — liteaddress.org, paper.dash.org and similar tools implemented the same SHA-256 route. The address match is what verifies a guess, so the exact generator matters less than the phrase itself.

If you can pin down the creation era and the generator you used, write it down — it removes ambiguity about the derivation and lets you test once instead of testing every variant.

What is not realistic

Two dead ends. First, no memory of the phrase’s structure: with nothing to build a list from, the search space is the same as a random password — simply too large. Second, a known target address with no balance and no relevant history — but before calling it an ending, check whether the recovered key could correspond to a compressed or uncompressed address variant or control relevant BTC-fork assets: a zero balance on one address does not always mean the key is worthless. If those checks come up empty, both are genuine endings, and this page would mislead you if it pretended otherwise.

After recovery: move the funds

When a candidate matches, you get the private key — not a wallet app. Import it into a normal wallet, move the balance to a new wallet with a proper seed backup, and test the restore before relying on it. Then never create another brain wallet: the security depends entirely on a phrase you can remember, which is exactly the property that makes it crackable. → How to never lose access · Password vs seed phrase

Frequently asked questions