Forgot your Exodus wallet password? The seed is the key — the file can also be cracked.

What the Exodus password actually protects

Exodus Desktop stores your wallet in a local file called seed.seco, encrypted with a password you choose, and hashcat mode 28200 may apply to it. The mobile apps protect a local vault as well, but do not assume the same file or extractor route — the documented recovery path for a forgotten mobile passcode or device unlock is Exodus’s official 12-word recovery phrase or passkey restore. In both cases the password is a lock on the device — it is not what creates your addresses. That role belongs to the 12-word recovery phrase, which Exodus generates once and displays at setup. The password and the phrase are different layers: password vs seed phrase explains the difference in full.

The fast path: restore with the seed

If you still have the 12 words (paper backup, password manager, an old screenshot), the forgotten password never matters: restore Exodus with the phrase on a fresh install, set a new password, and the wallet rebuilds itself. That is the real answer in most real Exodus cases — the password question collapses as soon as the seed exists. Where old passwords hide and the 68-place search checklist are where most people find that seed or the password itself.

Before seed.seco: check these recovery sources first

“No seed” does not automatically mean “crack only”. Depending on how the wallet was set up, Exodus documents several official recovery paths that do not involve cracking anything — worth checking before you invest in an offline attack:

• A synced Exodus device. If the wallet still opens on another phone, tablet or computer where you are signed in, unlock it there and note the 12 words or move the funds — no cracking needed.
• The pre-February-2019 email backup. Wallets created before Exodus removed the email-backup option may have a backup of the recovery phrase in the inbox used at setup.
• Passkey + iCloud / Google Drive backup (mobile). Exodus Mobile offers passkey-based restore and cloud backups on some platforms — check whether that route exists before treating the case as crack-only.
• Archived data from an overwritten wallet. Exodus keeps archives of replaced wallets in some Desktop/Mobile flows — a previous wallet may still be recoverable from the app’s archived data.

These are “worth checking” paths, not guarantees — but they can restore access without a crack, so rule them out first. If none of them exist, the local password-protected file is the target below.

If none of those exist: cracking seed.seco

Without the seed — and after ruling out the recovery sources above — the remaining target is the password-protected seed.seco file. The workflow is the same as for every encrypted wallet on this site:

1. 1

   Protect the file

   Work on a read-only copy, offline, on a machine you trust. Never upload seed.seco to a public checker or unknown website — it contains your wallet. The protection rules apply.

2. 2

   Extract the hash line

   Run exodus2hashcat.py (ships in the official hashcat tools folder) on your copy. It produces the one-line hash that mode 28200 tests — no private keys ever leave your machine.

3. 3

   Build the attack from memory

   Exodus passwords are human-made: names, dates, phrases, patterns. Turn every fragment into a candidate list with the hint-list method, then run it with hashcat mode 28200 using a wordlist with rules or a mask.

4. 4

   Let the math decide

   Exodus uses scrypt, so each guess costs more than with simple hash formats — but hashcat mode 28200 has a working GPU implementation: published benchmarks on high-end cards report roughly 5,000–10,000 guesses per second. Real speeds vary substantially by hardware, so benchmark your own machine instead of assuming CPU-like speeds. Check your specific odds with the strength calculator and the feasibility guide before investing weeks.

Frequently asked questions

Does Exodus have a password?

Yes — Exodus Desktop protects its local wallet file (seed.seco) with a password you choose, and the mobile apps protect their local vault as well. On mobile, the documented recovery path for a forgotten passcode or device unlock is Exodus’s official 12-word recovery phrase or passkey restore, not a seed.seco-style file attack. It is a local lock; the wallet itself is secured by the 12-word recovery phrase.

Can an Exodus wallet password be cracked?

After ruling out Exodus’s other recovery paths — a synced Exodus device, the pre-February-2019 email backup, a passkey + iCloud/Google Drive backup, or archived wallet data — the protected seed.seco file can be attacked offline with hashcat mode 28200 after extraction with exodus2hashcat.py. The key derivation is scrypt — memory-hard, so each guess costs more than with simple hash formats. Hashcat’s mode 28200 still provides thousands of guesses per second on modern GPUs (published benchmarks roughly 5,000–10,000/s on high-end cards); exact speed varies by hardware, so benchmark your own machine. Human-chosen passwords with clues are realistic; long random ones are not, for anyone.

Do I need the password if I have the seed phrase?

No. Restoring Exodus with the 12-word recovery phrase rebuilds the wallet without the password — the password only locks the local file on the device where you set it. If you have the seed, the password question is moot.

Sources & references

1. hashcat — example hashes (mode 28200, official)
2. hashcat — official tools (exodus2hashcat.py)
3. Exodus — official site and downloads