Coinomi’s password is a lock on the front door. The phrase is the key to the house.

Which wallets use this format?

The Coinomi vault is Coinomi’s own scrypt-encrypted wallet file — app data on Android/iOS and, on desktop, .wallet files in the Coinomi data directory. Only the Coinomi app creates or opens it — it is not a shared format.

The good news: the 24-word recovery phrase is the real backup. With the phrase, the vault password is irrelevant, and the wallet can usually be restored in Coinomi or another compatible BIP39 wallet — provided the same coin, account, passphrase setting and derivation path are supported.

Check the phrase first — it decides everything

Coinomi generates a 24-word recovery phrase when a wallet is created (with an optional extra passphrase, sometimes called the “25th word”). Whoever holds the phrase controls the normal wallet — and if a BIP39 passphrase was enabled, restoring requires both the exact phrase and the exact passphrase. If you wrote it down:

• restore the phrase in the Coinomi app (or another compatible BIP39 wallet) on any device — the same coin, account, passphrase setting and derivation path must be supported;
• set a new app password;
• the old password becomes irrelevant.

The password you forgot was protecting the local vault file — not the keys themselves. This is the same architecture as MetaMask and the other seed-based mobile wallets. If you have only part of the phrase, that’s seed reconstruction — outside this site’s scope; hunt for a complete backup with the search checklist.

If the phrase is gone: the vault file

Without the phrase, the only remaining target is the encrypted vault file. Where it lives depends on the platform — two realities here:

• Getting the file is the hard part. On Android, Coinomi stores its data in app storage, which normal users can’t browse — an old full-device backup (Titanium-style root backup, or an ADB backup from before Android 12’s restrictions) is the realistic source, and the old-phone extraction guide covers the paths step by step. On desktop, .wallet files sit in the Coinomi data directory (on Windows, for example, %localappdata%\Coinomi\Coinomi\wallets) and btcrecover can read them directly. On Android, if you never made a backup, this path usually dead-ends before any cracking begins.
• If you do get the vault, it’s scrypt. The measured speed for the Coinomi vault format is roughly 500 guesses per second on a modern CPU (btcrecover measurements). That’s the same league as Ethereum keystores and BIP38 — far slower per guess than wallet.dat or Blockchain.com. This assumes a password-protected wallet — biometrics, no-password or password + biometrics setups may depend on device-keystore material (see below).

So the verdict: a Coinomi vault without the phrase is a hard case. If the vault file exists and you remember the password’s shape, it’s a legitimate recovery project. If both are missing, no one — anywhere — can brute-force a random Coinomi password. The framework explains why.

Recovery tools and speeds

First determine how the wallet was protected: standard password-protected Coinomi wallets can be attacked from the wallet file with btcrecover. Wallets configured with biometrics, password + biometrics, or no password may additionally depend on device-keystore material — the wallet file alone may not be sufficient. If that applies, keep the device and its keystore intact before wiping anything. With a password-protected vault, two public tools can attack it — both work offline on a copy of the file:

*Measured on the reference CPU (Ryzen 9 9950X) — see the benchmarks & methodology page. The vault is scrypt, which is memory-hard: GPUs gain almost nothing, so the CPU rate is the real rate.

Practical steps in order

1. 1
   Search for the 24-word phrase — notebook, password manager, email draft, photo of a paper card. Work the 68-place checklist.
2. 2
   If the phrase exists, restore and move on — no cracking involved.
3. 3
   If it doesn’t, hunt old device backups for the vault file before considering anything else.
4. 4
   Only with the vault file in hand does the question become password cracking — and only then do the offline tools matter.

And the “25th word”?

Coinomi supports an optional passphrase layer on top of the 24 words (BIP39’s “passphrase” feature — the glossary explains the terminology). If you used one and don’t remember it, treat it as part of the seed problem: the calculator models passphrase search spaces, and the real numbers there are humbling. Most users didn’t set one — check before you panic.

Common mistakes

• Assuming the phrase is gone. Most “lost” phrases turn up in a notebook, a password manager, an email draft or an old photo — work the search checklist before concluding they’re gone.
• Pointing the tool at the wrong file. The vault is the scrypt-encrypted app data; a wallet export or the phrase are different things. Identify your file first.
• Not preserving the wallet data. On Android the vault only lives in app storage; on desktop it is a file in the Coinomi data directory. Before upgrading or wiping a device, back up the wallet data — the copy is what makes recovery possible.
• Expecting GPU speed. scrypt is memory-hard — a rented GPU rig will not crack a Coinomi vault meaningfully faster than a CPU.

Frequently asked questions

Is the Coinomi app password the same as the seed phrase?

No. The app password locks the on-device vault; the 24-word recovery phrase is the backup that recreates the wallet anywhere. With the phrase, the password stops mattering.

Can the Coinomi vault be cracked?

If the wallet was protected with a password and you have a copy of the vault file, usually yes — offline, with btcrecover or John the Ripper (coinomi2john), at roughly 500 guesses per second on a modern CPU. Wallets set up with biometrics, password + biometrics, or no password may additionally depend on device-keystore material, so the file alone may not be enough — keep the device intact until that is ruled out. scrypt is memory-hard, so this only works for human-chosen passwords with clues.

What if I never made a device backup?

Without the vault file there is nothing to attack — on Android the keys are only in app storage (on desktop they are .wallet files in the Coinomi data directory), so the password is irrelevant. The realistic path is the search checklist for the phrase.

Next step

Start with the phrase search — it’s the difference between a five-minute restore and a possibly-impossible crack. Then, depending on what you find, weigh your options with your actual facts in hand.

Sources & references

1. btcrecover — performance benchmarks