Ethereum keystore files — among the slower wallet types to crack.

Which wallets use this format?

The UTC--* keystore JSON is a standard Ethereum software-wallet export format used by tools such as geth, MyEtherWallet, MyCrypto and some legacy Ethereum wallets. Many modern wallets instead use seed phrases, browser vaults or hardware-wallet flows, so do not assume every Ethereum wallet can produce or open a keystore JSON. Tools that do:

• Create/export V3 keystores: geth / OpenEthereum (command-line nodes), MyEtherWallet (MEW), MyCrypto, Mist, Parity and older tools; hardware-wallet companion apps vary — check whether yours supports keystore import/export
• Can import an existing V3 JSON, but do not create it natively: MetaMask — via “Import account with JSON file”; the JSON password decrypts that file during import and is not the same as the MetaMask wallet password. After import, keep the original JSON file / private key backed up separately: imported accounts need their own recovery material, and MetaMask’s ordinary account export is a private key

Wallets that create the format write the same scrypt or PBKDF2 keystore JSON, so one guide covers them; wallets that only import an existing JSON use that file’s own password.

How the keystore format works

The UTC--* JSON file is self-describing: it literally contains its own parameters in the crypto field.

After converting the JSON with ethereum2john.py (which produces the $ethereum$p*…/$ethereum$s*… line), hashcat cracks these as mode 15600 (PBKDF2) and mode 15700 (scrypt). Both are among the slower formats on this site — the scrypt variant is memory-hard, and the PBKDF2 variant’s speed depends on the stored iteration count.

Why this matters for your case

• Slower format means better clues are mandatory. A human-chosen password with fragments and patterns is still realistic. A long random password is not — the maths is the maths.
• The address in the filename helps verify. The keystore’s address helps identify the case and acts as the success target — the address alone is not proof of ownership.
• Check the KDF parameters. If your file used low scrypt params (e.g. N=8192 or N=262144 are common, but some old tools used less), your case is faster than average. Reading crypto.kdfparams.n in a text editor tells you instantly.

Your next steps

1. 1

   Back up the file read-only

   Copy it to two safe places before touching anything — the protection guide.

2. 2

   Read the KDF parameters

   Open the JSON and note kdf and its parameters. That single line changes the feasibility estimate — the format table explains how.

3. 3

   Rebuild the candidate list

   Fragments, patterns, reused words — the memory method. This matters more than any GPU.

4. 4

   Run the tools yourself

   Test your candidate list on a copy of the keystore file — the btcrecover walkthrough and the hashcat walkthrough (modes 15600/15700) cover it step by step.

Related reading

Frequently asked questions

What exactly is the UTC-- JSON file?

It is the standard Web3 Secret Storage keystore: your private key encrypted with your password, stored as a file like UTC--2021-01-01T00-00-00.000Z--address.json. It is what geth, MyEtherWallet and MyCrypto create, and it is the file you work with for recovery.

Why is an Ethereum keystore so slow to crack?

Ethereum keystore files are self-describing: read the actual kdf and kdfparams values from the JSON. Geth commonly uses scrypt with N=262,144, but Web3 Secret Storage does not prescribe a universal PBKDF2 iteration count — for PBKDF2, use the file’s c value. scrypt is memory-hard — the measured reference run is roughly 96 guesses per second on the 9950X CPU, versus hundreds for a wallet.dat.

Old keystores vs new ones — same password, different odds?

Yes, and sometimes dramatically. Early tools used much weaker derivation settings, so a 2016-era keystore can be searched orders of magnitude faster than a current one. Read the kdfparams in your file, then run the calculator with real numbers.

Sources & references

1. ethereum.org — Web3 Secret Storage (keystore specification)
2. hashcat — example hashes (wallet formats & modes)