# The internet gives bad advice about forgotten wallet passwords. We're the counterweight.
URL: https://forgotwalletpassword.com/about

About ForgotWalletPassword.com — Educational Initiative
 Skip to content
 About this site
 About ForgotWalletPassword.com — what this guide is and how it is written
 ForgotWalletPassword.com is a reference for people who locked themselves out of their own crypto. The site aims to base technical claims on primary sources wherever available, and corrections are documented when information changes or an error is found — not forum guesses, not panic, and not unverifiable promises.
 Who we are
 ForgotWalletPassword.com is an independent educational guide. It explains what you lost, how to search, what’s technically possible, and how to stay safe — free, for everyone, forever. It never asks for your files, your keys or your money, and it stays useful whether you ever need anything beyond the information on this site.
 It is operated by Crypto Recovers, a professional wallet-access recovery practice. That relationship is disclosed rather than hidden, and the editorial content stands entirely on its own: there are no paid placements or affiliate links, and nothing on this site requires hiring anyone to be useful.
 What we stand for
 Clarity about feasibility. Some cases are recoverable, some are not. We say which, in plain numbers — see when recovery is possible.
 Never asking for your keys. This site will never ask for your seed phrase, private keys or wallet password. Anyone who does is not us.
 No fear tactics. Scare copy sells “emergency recovery” services. We prefer calm, correct information and safe first steps: the first 24 hours.
 Prevention beats recovery. Most lockouts are avoidable. How to never lose access is the page we’d most like everyone to read before they need it.
 Where the technical details come from
 The technical parameters on this site (hashcat modes, key-derivation settings, iteration counts) come from working directly with these files — wallet.dat, Electrum keystores, Ethereum JSON files, BIP38 keys — and from the official tool documentation. They are the ones the tools actually use, documented across the encryption explainer, the format guides and the glossary.
 Editorial independence
 Every guide on this site aims to give a complete, self-contained answer — including the parts that say “this cannot be done.” Where the math says a case is not viable, we say so plainly; where it isn’t, we point you to the free tools and memory reconstruction instead. The diagnosis quiz on the homepage applies the same rules to your specific case.
 How this site verifies its facts
 Technical claims follow a strict source hierarchy, in order of preference:
 Primary sources — wallet source code and repositories, official wallet documentation, Bitcoin Improvement Proposals, and the official tool repositories/docs (btcrecover, hashcat, John the Ripper).
 Reproducible testing — measured runs with hardware, tool version and date recorded, as published on the benchmarks & methodology page.
 Archived official documentation — for discontinued wallets whose original sites are gone.
 Forums and Reddit — only to identify real problems people hit, never as authoritative proof.
 Every serious technical reference on this site shows its sources and a “last reviewed” date, and the master list carries its own review date so the database ages visibly instead of silently.
 About the author
 Robbert Bink is the editor of ForgotWalletPassword.com. He has focused on forgotten wallet password recovery since 2019 — from old wallet.dat files to modern keystores. Every guide on this site is written from real cases, with the math on what works and what doesn’t.
 Questions or corrections?
 Found an error, or want to suggest a topic? Contact us — and read the disclaimer for the fine print about what this site is and isn’t.
 Editorial contact
 Contact
 Questions, corrections and editorial feedback — this is a guide, not a service, and we want it right.
 Contact us →
 The fine print
 Disclaimer
 What this site is, what it isn’t, and why it’s not financial or legal advice.
 Read the disclaimer →
# BIP38 paper wallets — one long string, one password, no second chances.
URL: https://forgotwalletpassword.com/bip38-password-recovery

Forgot Your BIP38 Paper Wallet Password? How It Works
 Skip to content
 Wallet format · Bitcoin
 BIP38 paper wallets — one long string, one password, no second chances.
 If your paper wallet shows a long key beginning with 6P, your private key is BIP38-encrypted: it only exists behind a password that was never stored anywhere. The key itself is the file — and it is recoverable, with the right clues.
 By Robbert Bink · ~4 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 BIP38 keys are recoverable when you can reconstruct the password — because the whole encrypted key is right there on the paper, and human-chosen passphrases follow habits. The encryption is scrypt-based and slow (tens of guesses per second on a modern CPU), so your memory is worth more than any hardware.
 Which wallets use this format?
 BIP38 is a standard, not an app — the same encrypted format appears across many tools:
 bitaddress.org (encrypt or decrypt a private key)
 Paper-wallet generators from the early 2010s
 Blockchain.com paper-wallet exports
 Offline BIP38 decryptors (e.g. bitaddress.org) — decrypt first, then sweep the recovered key into a wallet; Electrum and most wallets do not accept an encrypted 6P string as an ordinary private-key import
 Wherever it was created, a BIP38 key protects exactly one private key — the string on the paper is the whole wallet.
What a BIP38 key is
 BIP38 is a standard for password-encrypting a Bitcoin private key so it can be printed safely. The result is a Base58 string that always starts with 6P — and it cannot be used until the password decrypts it:
 The password is stretched with scrypt (parameters N=16384, r=8, p=8 in the standard) plus SHA-256 passes to derive the key.
 btcrecover attacks these directly (--bip38-enc-privkey) at roughly 72 guesses per second on a modern CPU — one of the slower formats.
 There is no wallet file, no backup copy, no “reset”. The encrypted string is the wallet. Lose the paper or the password, and there is nothing else to attack.
 Why paper-wallet passwords are often recoverable
 Paper wallets were mostly created 2014–2019 by everyday people, using tools like bitaddress.org. That era had a pattern:
 Passwords were almost always human-chosen — a memorable phrase, name + year, a sentence. That is exactly the material the memory method reconstructs.
 Many people reused a password from another account or an earlier paper wallet. Dig through every stored copy — the same password is likely in your old notes.
 If you still have the unencrypted address printed on the paper (the public key), it helps identify the target funds and verify a successful result — but it does not prove ownership by itself.
 Write the key down carefully
 You need the exact Base58 string. Copy it character by character into a password journal — a single misread character makes every attempt fail. Make an exact offline transcription of the 6P… string instead of photographing it: the BIP38 string contains everything needed to reconstruct the private key except the passphrase, so a cloud-synced photo is sensitive recovery data. If you must photograph it for readability, do it offline, store it encrypted, and delete it from any synced photo library.
 Realistic feasibility
 Human password + fragments: realistic. This is one of the most recoverable scenarios — the search space is your habit set, not all possible strings.
 A long random passphrase (e.g. 20+ random characters): not feasible. No tool changes that.
 Wrong guesses cost nothing but time — there is no lockout on an offline key. Test a candidate list at home for free with open-source tools, then widen it with better clues.
 Paper wallets deserve extra care
 Never paste the full 6P string into a website, and never send it anywhere without a written agreement. Work offline, on a copy, with tools from official sources.
 Recovery tools and speeds
 BIP38 has one mainstream offline tool — and one important limitation:
 ToolHow it worksTypical speed*
 btcrecoverReads the 6P string directly with --bip38-enc-privkey~72 guesses/sec (CPU)
 hashcatNo BIP38 mode — btcrecover is the standard tool here—
 *Measured on the reference CPU (Ryzen 9 9950X) — see the benchmarks & methodology page. BIP38 is scrypt with a large memory cost, so GPUs gain little and a tight candidate list beats raw speed.
 Next steps
 1
 Copy the key exactlyCharacter-perfect transcription of the 6P string, kept private.
 2
 Rebuild the passwordNames, dates, phrases from that era — the memory method.
 3
 Test offlineYour candidate list against the key, using open-source BIP38 tools on an offline machine.
 4
 Try the tools, then decideBIP38 runs at only tens of guesses per second, so build a tight candidate list first — the btcrecover walkthrough handles BIP38 directly. Only a genuinely huge search space justifies an extended run — and on BIP38, a tighter candidate list beats more GPU time.
 Common mistakes
 Confusing BIP38 with BIP39. A 6P string is a password-encrypted private key; a BIP39 seed is 12–24 words. They are recovered completely differently — what did you lose?
 Misreading the key. One wrong character makes every attempt fail. Copy the exact Base58 string and double-check it before running anything.
 Assuming the address helps crack. The printed address confirms which funds you’re after, but it does not shorten the password search.
 Believing a “guaranteed” recovery of a random passphrase. A long random BIP38 passphrase is not feasible — no tool or service changes that. Check the math first.
 Frequently asked questions
 Can a BIP38 paper wallet be cracked?
 Yes, offline, with btcrecover (--bip38-enc-privkey) — at roughly 72 guesses per second on a modern CPU. The scrypt KDF is slow, so a human-chosen passphrase with clues is the realistic case; a long random one is not.
 Does knowing the Bitcoin address help recovery?
 The address confirms which funds the key belongs to and helps you identify the right key and verify a result — but an address alone does not prove ownership, and it does not reduce the password search space. Your memory and candidate list are what shrink it.
 What if the BIP38 passphrase was randomly generated?
 Then it is effectively impossible to brute-force — the search space is beyond any hardware. The realistic path is finding where it was stored: work the search checklist.
 Related reading
 Sources & references
 BIP38 — passphrase-protected private keys
 hashcat — example hashes (wallet formats & modes)
 Cite this page
 APA: Bink, R. (2026). BIP38 paper wallets — one long string, one password, no second chances. ForgotWalletPassword.com. https://forgotwalletpassword.com/bip38-password-recovery
 Markdown: [BIP38 paper wallets — one long string, one password, no second chances.](https://forgotwalletpassword.com/bip38-password-recovery)
 Guide · 04
 Is recovery technically possible?
 The speed table — BIP38 among the slower formats, and why that matters.
 Read the feasibility →
 Related format
 Ethereum keystore JSON
 The other scrypt-based wallet format — different file, similar reality.
 Keystore recovery →
 Overview
 Which wallet passwords can be recovered?
 BIP38’s verdict — and every other wallet — in one searchable table.
 See the master list →
# A fork wallet is a Bitcoin wallet in a different coat.
URL: https://forgotwalletpassword.com/bitcoin-fork-wallet-password-recovery

Forgot a Fork Wallet Password? LTC · DOGE · BCH · Dash
 Skip to content
 Format guide · fork wallets · wallet.dat variants
 A fork wallet is a Bitcoin wallet in a different coat.
 Bitcoin Core-derived fork clients — including Litecoin Core, Dogecoin Core and certain Bitcoin Cash/Dash node wallets — inherited Bitcoin Core’s wallet.dat encryption model. Non-Core wallets such as Electron Cash use different wallet formats, so check the wallet type first. If you know how wallet.dat guide works, you already know 90% of this page. Here’s the 10% that’s different.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Bitcoin Core-derived fork wallets — Litecoin Core, Dogecoin Core, Bitcoin Cash node wallets from the Core codebase, and Dash Core — share Bitcoin Core’s legacy wallet encryption: AES-256-CBC with the same iterated-SHA-512 key derivation, and the same dynamic iteration counts. Everything in the wallet.dat guide applies to those legacy encryption structures — only the file location and the client you use to unlock it change. One caveat: the filename does not tell you which backend is inside — modern Bitcoin Core descriptor wallets (0.21+) use SQLite, legacy wallets use Berkeley DB, and forks differ. Non-Core wallets such as Electron Cash use different wallet formats.
 The same encryption, with a backend caveat
 These Core-derived clients — Litecoin Core, Dogecoin Core, Bitcoin Cash node wallets from the Core codebase, Dash Core and others — forked from Bitcoin Core at various points, and the wallet encryption code carried over: the same AES-256-CBC encryption, the same iterated-SHA-512 key derivation, and the same dynamic iteration counts. One caveat before you assume a byte-identical file: the name wallet.dat does not tell you which database backend is inside. Modern Bitcoin Core descriptor wallets (0.21+) use SQLite, legacy Bitcoin Core wallets use Berkeley DB, and forks vary — Dogecoin Core, for example, still uses Berkeley DB. For the legacy encryption structures, the rules below apply. That means:
 the encryption is AES-256-CBC, with the master key protected by the same iterated-SHA-512 key derivation;
 the iteration count is dynamic — chosen when the wallet was first encrypted, which is why old wallets crack far faster than new ones (how wallet encryption works explains the mechanism);
 the measured speeds apply: a low-round wallet (reference ~68k iterations) checks at ~472 guesses/sec and a high-round one (reference ~267k) at ~122/sec on a typical modern CPU — roughly 4× apart, but the gap follows the rounds count, not the client version (btcrecover measurements).
 So the summary: the cracking-time math, the calculator, and the feasibility framework all apply unchanged.
 Where the wallet.dat lives (fork versions)
 CoinWindowsmacOS / Linux
 Litecoin Core%APPDATA%\Litecoin\wallets · %LOCALAPPDATA%\Litecoin\wallets~/.litecoin/wallets
 Dogecoin Core%APPDATA%\Dogecoin\wallets · %LOCALAPPDATA%\Dogecoin\wallets~/.dogecoin/wallets
 Bitcoin Cash (Bitcoin ABC/Core-era)%APPDATA%\Bitcoin\wallets · %LOCALAPPDATA%\Bitcoin\wallets (shared history)~/.bitcoin/wallets
 Paths are the clients’ documented defaults, and the data directory may differ by version or a custom datadir. Do not assume every Core-derived fork made the same Windows data-directory change: Bitcoin Core’s current Windows default is %LOCALAPPDATA%\Bitcoin with legacy %APPDATA%\Bitcoin still relevant, while for Dogecoin Core check %APPDATA%\Dogecoin first, and for Litecoin Core check %APPDATA%\Litecoin first unless the specific installed version documents otherwise — search %LOCALAPPDATA% as an extra fallback for each. If the file isn’t where you expect, the OS-wide search methods on how to find your wallet file will locate it. Note that some forks kept the Bitcoin directory name — searching for wallets/wallet.dat without a coin name catches them all.
 The unlock path is identical to Bitcoin Core
 1
 Secure copies first. Copy wallet.dat to several safe places before anything else — see protect your wallet files.
 2
 Check whether it’s even encrypted — without relying on startup prompts. An encrypted wallet can load and display information while locked, so “it opens” proves nothing. On a safe working copy with a matching Bitcoin Core version, use getwalletinfo in the client console: with passphrase encryption it reports unlocked_until, where 0 means the wallet is currently locked. Do not use “does the GUI ask at startup?” as an encryption test, and do not run recovery files in newer clients that might migrate them.
 3
 Try the unlock command. In the client’s console: walletpassphrase (or the GUI prompt). One careful attempt is fine — this is not a hardware wallet, there is no wipe-after-N-tries.
 4
 If it fails, it’s a cracking case. The exact procedure — wallet header check, iteration extraction, token-list attacks with btcrecover — is on the wallet.dat guide. The tools don’t care whether the coin is Bitcoin or Litecoin; the legacy encryption format is what matters — modern SQLite descriptor-wallet backends are a separate case.
 What is different for forks
 Your password is verified against a wallet, not a coin. A password from a 2014 Litecoin wallet works only on that wallet file — but if you know the pattern you used across wallets, one recovered pattern can unlock several.
 Old fork wallets are the easiest recovery cases in crypto. A Dogecoin wallet encrypted in 2014 used era-appropriate (low) iteration counts. Same password, far faster search than a 2023 wallet.
 Watch out for “wallet.dat is empty” confusion. Some forks display empty balances if the client can’t read the file. Encrypted files look like random bytes — the file identifier and the header checks in the wallet.dat guide will tell you if you’re looking at a real, encrypted wallet.
 Next step
 Open the wallet.dat guide and follow it as if you had a Bitcoin wallet — because technically, you do. And if the amounts are meaningful, the real numbers on what’s actually recoverable will keep your expectations realistic.
 Frequently asked questions
 Do Litecoin, Dogecoin and Bitcoin Cash use the same wallet.dat encryption?
 Yes, for the Core-derived clients: Litecoin Core, Dogecoin Core, Bitcoin Cash node wallets from the Core codebase and Dash Core kept Bitcoin Core’s legacy wallet encryption, including the iterated SHA-512 key derivation and the machine-chosen iteration count. That does not make every wallet.dat byte-identical: modern Bitcoin Core descriptor wallets (0.21+) use a SQLite backend while legacy wallets use Berkeley DB, and forks vary — the filename alone does not tell you which backend is inside. Non-Core wallets such as Electron Cash use a different wallet format.
 Which hashcat mode cracks fork wallet.dat files?
 Mode 11300 covers Bitcoin-family wallet.dat files, including Litecoin, Dogecoin, Bitcoin Cash and Dash. The extraction step is the same as for Bitcoin Core.
 Can I use the same btcrecover command for fork wallets?
 Yes — btcrecover reads the wallet.dat directly; where a fork needs it, add the right wallet type or BIP32 path. The walkthrough’s wallet.dat example works for the whole fork family.
Sources & references
 btcrecover — performance benchmarks
 Bitcoin Wiki — wallet encryption
 Cite this page
 APA: Bink, R. (2026). A fork wallet is a Bitcoin wallet in a different coat. ForgotWalletPassword.com. https://forgotwalletpassword.com/bitcoin-fork-wallet-password-recovery
 Markdown: [A fork wallet is a Bitcoin wallet in a different coat.](https://forgotwalletpassword.com/bitcoin-fork-wallet-password-recovery)
 The master guide
 wallet.dat guide
 The full procedure — header, iterations, token lists — applies to Core-derived forks that share the legacy encryption.
 Read the guide →
 Find it first
 How to find your wallet file
 Default paths and OS-wide search methods for every wallet family.
 Locate the file →
 The framework
 When recovery is possible
 Wallet format, era and password shape — the three inputs that decide your odds.
 Judge your case →
 Overview
 Which wallet passwords can be recovered?
 The fork wallet’s verdict — and every other wallet — in one table.
 See the master list →
# The Blockchain.com wallet has two locks — and only one matters.
URL: https://forgotwalletpassword.com/blockchain-wallet-password-recovery

Forgot Your Blockchain.com Password? The .aes.json File
 Skip to content
 Format guide · Blockchain.com · the .aes.json export
 The Blockchain.com wallet has two locks — and only one matters.
 Blockchain.com wallets are self-custody wallets with a recovery phrase, and most versions also had an optional wallet password that encrypts the local file. If you have the modern 12-word Recovery Phrase, the password is a paperweight for the addresses derived from that phrase. A legacy blockchain.info mnemonic is different — it is a legacy credential-recovery mnemonic, a password-recovery mechanism rather than a BIP39 wallet seed, and the difference matters (see below). If you only have the file, you’re in cracking territory — and the good news is the older formats are remarkably weak.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Two paths: with the modern 12-word BIP39 Recovery Phrase, restore the addresses derived from that phrase in a compatible BIP39 wallet and set a new password — the old one stops mattering for them. A legacy blockchain.info mnemonic is not that kind of seed: it is a password-recovery mechanism that can reveal the original wallet password from when the phrase was created. Without any phrase, the exported wallet.aes.json is what you crack; its oldest format: just 10 PBKDF2-SHA1 iterations, over 600,000 guesses per second.
 Blockchain.com cannot reset the password — it is a self-custody wallet. The sign-up email only retrieves your wallet identifier; the clean no-file path is the recovery phrase. For some legacy Blockchain.com wallets, the encrypted wallet file may still be retrievable if you know the Wallet ID and can pass the required account/2FA checks (btcrecover’s download-blockchain-wallet.py documents this) — treat that as a legacy exception, not a guarantee. See recovery without the wallet file.
 Which wallets use this format?
 This export format belongs to one wallet: Blockchain.com (formerly blockchain.info). If your file is named .aes.json, it came from their app or web wallet — no other major wallet writes it.
 Inside it, the encryption is anything but uniform: the old v0 format is extremely fast to test; v2 and v3 are much slower than v0, but both are still weak compared with modern memory-hard wallet formats — and in the benchmark shown here, v3 is faster than v2. The recovery phrase, if you have it, skips the password for the addresses derived from it.
First: do you have the recovery phrase?
 There are two distinct generations, and they use different phrases:
 Modern Blockchain.com (HD) wallets use a standard 12-word BIP39 seed. Import it into any BIP39-compatible wallet (or the current Blockchain.com app), set a new password, and move on. One caveat: imported addresses are not backed up by the Recovery Phrase — verify every expected address and balance after restoring before discarding the old wallet file or credentials.
 Legacy blockchain.info wallets used a mnemonic recovery phrase of 6–25+ words from a fixed list — not a BIP39 seed, and it works differently. That mnemonic is a password-recovery mechanism: a tool that supports the legacy format uses it to reveal the wallet password from the time the phrase was created. If the password was changed later, only that earlier password comes back. It does not regenerate your keys, and it does not restore the wallet the way a modern seed does.
 For the modern 12-word phrase, this is the same situation as MetaMask — the password protects the local copy, the phrase is the key. If you have most of the phrase but not all of it, that’s seed reconstruction — outside this site’s scope; the search checklist is your best tool for a complete copy. The legacy mnemonic is a different mechanism entirely: partial words do not complete into a wallet, they complete into the original password-recovery route described above.
 If the phrase is gone, check one more modern route before assuming the exported file is your only door: current Blockchain.com mobile app versions can create an encrypted cloud backup of the wallet (Apple iCloud or Google Drive). Blockchain.com documents that backup as the recovery path for cases where the wallet password and/or Recovery Phrase are lost — on a supported app version it restores on the same operating system and cloud account, with your app PIN if prompted. It is not a guarantee, but it is worth checking before you write the wallet off.
 The file: wallet.aes.json
 Blockchain.com’s wallet export produces a file named wallet.aes.json (older versions: wallet.json.aes). It’s an encrypted JSON that contains your private keys, and it’s what the site’s own backup system produced when you clicked “Download backup”. Three formats exist, and the differences matter enormously:
 FormatKey derivationMeasured speed (modern CPU)Reality
 v0 (earliest wallets)PBKDF2-SHA1, 10 iterations~627,580 guesses/secextremely weak by wallet standards — human-patterned passwords can be reachable; a genuinely random strong password is still not realistically brute-forceable
 v2PBKDF2-SHA1, 10,000 iterations~2,770 guesses/secweak by modern standards — patterned passwords are very reachable
 v3PBKDF2-SHA1, 5,000 iterations~5,450 guesses/secstill far weaker than a modern wallet.dat
 All three speeds are published measurements from the btcrecover benchmark suite (Ryzen 9 9950X, 2026) — btcrecover.readthedocs.io/Benchmarks. Note the KDF is SHA1-based, not SHA512: that, plus the low iteration counts, is why these files crack so much faster than a wallet.dat of the same era.
 Where the file hides
 The checklist on this site is the systematic way to search, but for Blockchain.com specifically, check these first:
 your downloads folder and old download history — every “Download backup” click left a file;
 email attachments — many users exported and emailed themselves the backup;
 old laptops, external drives and cloud storage from the era you used the wallet;
 the current app’s export feature — you can still export a file if you know the password, but that’s circular; the point here is finding a previous export.
 Work the full list on the ultimate search checklist, then read how to find wallet files for the technical search.
 Cracking the export (if you have it)
 With the file in hand, the process is exactly the one described on offline recovery tools: btcrecover reads the export directly, and hashcat attacks it as mode 12700 (the legacy My Wallet export), 15200 (V2/V3) or — for very early V0 wallets — 34700 (identify the version first). Your password’s shape — how you built it — matters more than the file. A memory reconstruction that narrows the password to “name + year + a symbol, about 9 characters” puts even a v2 file well within reach on a single machine.
 If your account also had the optional second password, it is stored as a separate hash — but the path is not parallel: in many workflows you must first recover or know the main wallet password before attacking the second-password hash.
 Never upload the .aes.json to a public checker or unknown website
 The file contains everything needed to move your funds except the password — which is exactly why recovery runs offline on your own machine, on a copy. Do not upload it to public checkers, browser tools, Telegram helpers, Discord users or unknown websites. If a professional recovery process requires the encrypted file or an extract, use a written agreement and a controlled/offline workflow.
 Recovery tools, in one table
 ToolMode / how it works
 btcrecoverReads the .aes.json export directly — no conversion
 hashcatMode 12700 (legacy My Wallet), 15200 (v2/v3), 18800 (second password) — very early V0 wallets use mode 34700 (identify first)
 John the Ripperblockchain2john for the same export
 Common mistakes
 Treating v0/v2/v3 the same. A v0 file tests over 100× faster than v3 — the format inside the file decides your odds, not the wallet brand.
 Treating the legacy mnemonic like a modern seed. Only the 12-word BIP39 Recovery Phrase restores the addresses derived from that phrase anywhere and makes the password a paperweight for them — imported addresses are not covered by the phrase and need their own private-key or wallet backups. A legacy 6–25+ word mnemonic is not a seed: it can reveal the original wallet password from when the phrase was created — it does not regenerate your wallet.
 Uploading the .aes.json. The export contains your keys. Everything runs offline on a copy — the protection rules.
 Using the wrong hashcat mode. 12700 vs 15200 vs 18800 target different formats, and very early V0 wallets use 34700; the wrong mode loads nothing or never cracks.
 Frequently asked questions
 Is the Blockchain.com wallet password the same as the recovery phrase?
 No. The password encrypts the local wallet.aes.json export. The modern 12-word BIP39 Recovery Phrase recreates the addresses derived from that phrase anywhere and makes the password irrelevant for them — imported addresses are not backed up by the phrase and need their own backups. Legacy blockchain.info wallets are different: their 6–25+ word mnemonic is not a BIP39 seed — it is a password-recovery mechanism that can reveal the wallet password from the time the phrase was created (if the password was changed later, only that earlier password is recovered).
 Which Blockchain.com format is fastest to crack?
 v0 — just 10 PBKDF2-SHA1 iterations, checked at over 600,000 guesses per second on one CPU. v2 and v3 use 10,000 and 5,000 iterations — still far weaker than a modern wallet.dat.
 I never downloaded a backup — can the file still exist?
 Not necessarily. First check old downloads folders, emailed backups and cloud storage from the era you used the wallet — the checklist walks through all of them. For some legacy wallets, the encrypted wallet payload can also be retrieved during a login attempt without the correct password, provided you still have the Wallet ID and can satisfy any required email/2FA checks — version-dependent, and the current account flow is not guaranteed to work for every wallet.
 Your verdict
 Phrase available: restore the addresses derived from it and set a new password — then verify every expected address and balance (imported addresses need their own backups) before discarding anything.
 v0/v2 file + any memory of the password: genuinely good odds. Run the calculator with the Blockchain.com rates.
 v3 file, zero memory of the password, fully random password: the math gets hard fast — run it before paying anyone.
 Whichever path applies, the next step is the same: secure every copy of the file, then weigh your options with real numbers.
 Sources & references
 btcrecover — performance benchmarks
 Cite this page
 APA: Bink, R. (2026). The Blockchain.com wallet has two locks — and only one matters. ForgotWalletPassword.com. https://forgotwalletpassword.com/blockchain-wallet-password-recovery
 Markdown: [The Blockchain.com wallet has two locks — and only one matters.](https://forgotwalletpassword.com/blockchain-wallet-password-recovery)
 Not sure it’s this wallet?
 Which wallet file do you have?
 Identify your wallet by file name, extension and app before you commit to a recovery path.
 Identify the format →
 The tools
 Choose the right tool
 How btcrecover and hashcat attack these files, token lists, and safe usage.
 See the tools →
 Your odds
 Password strength calculator
 Model the Blockchain.com formats with measured crack speeds, not guesses.
 Run the numbers →
 Overview
 Which wallet passwords can be recovered?
 The .aes.json row — and every other wallet — in one searchable table.
 See the master list →
 Feasibility
 Is recovery possible?
 Two locks, one verdict — the feasibility math behind the .aes.json file.
 See the verdict →
# A brain wallet has no file — the passphrase is the key. SHA-256 vs scrypt, the real tools, and the honest limits.
URL: https://forgotwalletpassword.com/brain-wallet-password-recovery

Forgot Your Brain Wallet Password? How Recovery Works
 Skip to content
 Wallet type · no file, the phrase is the key
 Forgot your brain wallet password? How recovery works
 Brain wallets have no file and no seed phrase: the private key is derived from a passphrase you memorised. This page covers the two derivation routes, the tools that actually test passphrases, realistic speeds, and when the real answer is “stop”.
 By Robbert Bink · ~10 min read · Published 10 August 2026 · Last reviewed: 13 August 2026
 The headline
 A brain wallet has no file, no vault and no password field — the private key is derived directly from a passphrase you memorised. Recovery is a search over candidate passphrases, and it works only when you remember enough to build a realistic candidate list and the address still holds a balance.
 The short answer
 A brain wallet is the one case where “forgot wallet password” really means “forgot the passphrase that is the key.” There is no file, so there is no encrypted verifier to test against in the usual sense. Instead, every candidate passphrase is hashed into a private key, that key is turned into a public address, and the result is compared with the address you have. Recovery is therefore a pure candidate-generation problem: the testing speed is excellent, but the search space is defined entirely by what you remember.
 What a brain wallet actually is
 Brain wallets were popular in the early 2010s as “a wallet in your head”: you memorised a passphrase, and the software derived your private key from it. No file, no backup, no seed phrase on paper — which is exactly why they are now a recovery topic instead of a storage method. Two derivation families matter, and they behave very differently under attack:
 bitaddress.org / brainwallet.org style — private_key = SHA-256(passphrase), then the key is converted into a secp256k1 public key and hashed into the familiar Bitcoin address. The passphrase is hashed exactly as typed. This is the classic, fast route, and most old brain wallets use it.
 WarpWallet / Memwallet style — WarpWallet derives the key from two runs XOR’d together: one scrypt pass (N=2¹⁸) and one PBKDF2-HMAC-SHA256 pass (2¹⁶ rounds) — not a single scrypt hash. It can be “salted” with the email address you entered at creation, is deliberately slow and memory-hungry, and if you used an email salt, you must reproduce that exact email as well.
 “Brain wallet password recovery” is therefore really passphrase reconstruction, and the tooling differs from normal wallet files. The good news: there is no encrypted file format to reverse. The bad news: with no file and no checksum, the search space is bounded only by what you remember.
 Step 0 · Check the address still holds funds
 Before anything else: look up your public address on a block explorer. Many old brain-wallet addresses were drained years ago by automated scanners that grind through common phrases and known quotes — if the known target address shows zero balance and no relevant history, a BTC recovery may not be worth pursuing. Before stopping completely, check whether the passphrase/private key could correspond to a compressed or uncompressed address variant or to relevant BTC-fork assets from the period in question.
 The address is public data and safe to look up anywhere. The passphrase is not: never type a suspected passphrase into a website that offers to “check” it. All real recovery runs offline on your own machine, for a simple reason — a checker website is just collecting phrases it can sweep itself.
 Why testing is fast — and where it isn’t
 For the SHA-256 route, each candidate costs one hash plus one elliptic-curve key derivation, and the key derivation is the bottleneck. That still puts the classic route in a completely different league from encrypted wallet files:
 RouteRealistic speedSource / note
 SHA-256 brain wallet, CPU~130,000 candidates/sec per core (≈440,000/sec with four instances in parallel)Brainflayer, documented at release and on the hashcat forum
 SHA-256 brain wallet, GPUtens of millions of candidates/sece.g. Hydra reports ~60 MKey/s on a modern GPU
 Scrypt brain wallet (WarpWallet / Memwallet)tens of candidates/secmemory-hard by design — the same league as BIP38
 Practical consequence: a tight, well-built list of a few million candidates takes minutes to hours on the SHA-256 route — the list, not the hardware, is what you should obsess over. For a WarpWallet or Memwallet the same list takes weeks to months, so the clues have to be much stronger there.
 The tools: btcrecover, brainflayer, and why hashcat is not on the list
 btcrecover is the easiest route and the same tool used everywhere else on this site. It reads brain wallets directly: --brainwallet for SHA-256 passphrases (bitaddress.org, liteaddress.org, paper.dash.org) and --warpwallet for scrypt-based WarpWallet/Memwallet. You supply your address and a token list of candidate passphrases, exactly as in the main walkthrough. → btcrecover step by step · Command cheat sheet
 Brainflayer is the dedicated brain-wallet cracker (open source, ryancdotorg/brainflayer). It builds a Bloom filter from a list of addresses and streams candidate passphrases from wordlists, matching any address it finds. It takes more setup than btcrecover, but it is the reference tool when you want to push very large wordlists through the SHA-256 route.
 Hashcat is not in the default lineup for this case. There is no official hashcat mode for the standard SHA-256(passphrase)→address route, because every candidate also needs full ECDSA public-key derivation and RIPEMD-160 hashing — a custom kernel, not a built-in mode. Maintained GPU projects exist (Hydra is the one with published brain-wallet benchmarks), but for a normal case you do not need hashcat here; don’t hunt for a mode number that doesn’t exist.
 Everything above runs fully offline. The only inputs are the public address and your candidate list — no wallet file, no upload, no account.
 The candidate list decides the case
 This is the part that actually wins or loses. Testing speed is identical for everyone; your memory is the only advantage you have. Start from what you know:
 exact phrase fragments, in order, including spaces and punctuation;
 capitalisation — Password, password and PASSWORD are three different keys;
 numbers and substitutions (@ for a, 1 for l, 0 for o);
 word order and missing words — “i love you”, “love you i”, “i love”;
 keyboard layout — the same phrase typed on QWERTY vs AZERTY (or on a phone) produces different bytes;
 the era and your habits — how you built passphrases back then decides the shape of the search.
 Then turn the memory into a candidate list with the same method as every other wallet on this site: a base wordlist from your life, mutated into variants. The hint-list guide explains the method, and the offline token builder generates btcrecover tokens.txt from your fragments without uploading anything. For brainflayer, use a plain wordlist — one candidate per line. → Build a password hint list · Offline token list builder · How your memory made it
 The math: if you remember the phrase roughly, variants like case and extra characters multiply the list a few times — perfectly testable on the SHA-256 route. If you only know it was “a quote” or “something with my dog’s name”, the space explodes far beyond anything hardware can cover. That is not a recovery case; it is a lottery.
 Edge cases worth testing
 Case and spacing normalisation — some generators lowercased or trimmed the input before hashing. If the address doesn’t match your first guess, test the lowercased and trimmed variants; it is cheap when the base list is small.
 WarpWallet email salt — you need the exact email you entered when creating the wallet, because it becomes part of the derived key. If unsure, test the few email addresses you used in that era.
 Repeated hashing — a known DIY variation is iterating SHA-256 more than once instead of once. If your exact generator is uncertain, test the single-hash route first, then the double-hash variant.
 Old clones — liteaddress.org, paper.dash.org and similar tools implemented the same SHA-256 route. The address match is what verifies a guess, so the exact generator matters less than the phrase itself.
 If you can pin down the creation era and the generator you used, write it down — it removes ambiguity about the derivation and lets you test once instead of testing every variant.
 What is not realistic
 Two dead ends. First, no memory of the phrase’s structure: with nothing to build a list from, the search space is the same as a random password — simply too large. Second, a known target address with no balance and no relevant history — but before calling it an ending, check whether the recovered key could correspond to a compressed or uncompressed address variant or control relevant BTC-fork assets: a zero balance on one address does not always mean the key is worthless. If those checks come up empty, both are genuine endings, and this page would mislead you if it pretended otherwise.
 After recovery: move the funds
 When a candidate matches, you get the private key — not a wallet app. Import it into a normal wallet, move the balance to a new wallet with a proper seed backup, and test the restore before relying on it. Then never create another brain wallet: the security depends entirely on a phrase you can remember, which is exactly the property that makes it crackable. → How to never lose access · Password vs seed phrase
 Frequently asked questions
 Can you recover a brain wallet password?
 Yes, but only when you remember enough about the passphrase to build a realistic candidate list — and only if the address still holds a balance. Testing is fast for SHA-256 brain wallets, but the candidate list, not the hardware, decides the case.
 Is there a hashcat mode for brain wallets?
 No official hashcat mode exists for the standard SHA-256(passphrase)-to-address route, because each candidate also requires full ECDSA public-key derivation and RIPEMD-160 hashing. Use btcrecover with --brainwallet or --warpwallet, or the dedicated brainflayer tool; GPU projects like Hydra exist for very large searches.
 How fast can you test brain wallet passphrases?
 For the classic SHA-256 route, brainflayer reaches about 130,000 candidates per second on one CPU core (about 440,000 per second with four instances in parallel), and GPU tools reach tens of millions per second. Scrypt-based wallets like WarpWallet and Memwallet are far slower — tens of candidates per second, similar to BIP38.
 Cite this page
 APA: Bink, R. (2026). Forgot your brain wallet password? How recovery works. ForgotWalletPassword.com. https://forgotwalletpassword.com/brain-wallet-password-recovery
 Markdown: [Forgot your brain wallet password? How recovery works](https://forgotwalletpassword.com/brain-wallet-password-recovery)
 The step that decides it
 Build a password hint list
 Turn memory fragments into a candidate list — the method that wins brain wallet cases.
 Build the list →
 The main tool
 btcrecover step by step
 Install, token list, run — the same workflow, with --brainwallet and --warpwallet.
 Run the walkthrough →
 One-page reference
 The command cheat sheet
 Every wallet format, one command — including the brain wallet rows.
 Open the cheat sheet →
 The full picture
 Which wallet passwords can be recovered?
 The brainwallet verdict alongside every other wallet format, filterable.
 See the master list →
# The full btcrecover walkthrough — install, token list, run, result.
URL: https://forgotwalletpassword.com/btcrecover-step-by-step

Recover a Wallet Password with btcrecover — Step by Step
 Skip to content
 Step-by-step guide · btcrecover · free, offline, open source
 How to run btcrecover yourself — the complete walkthrough.
 btcrecover is the free, open-source tool built specifically for forgotten wallet passwords. It works when you remember pieces: names, years, symbols, patterns. This is the exact path — install, token list, run, result — with the honest limits you need before you start.
 By Robbert Bink · ~8 min read · Published 7 August 2026 · Last reviewed: 14 August 2026
 The headline
 btcrecover can recover your wallet password — if the password lives in a space you can describe. You give it the pieces you remember (names, years, symbols, patterns) and it grinds out every plausible combination, offline, for free. If you remember nothing about the password, or it was generated randomly, no tool or service changes that.
 Before you start: is btcrecover the right tool?
 btcrecoverhashcat
 Best atWallet formats directly + token lists built from your memoryRaw speed, mask attacks and wordlists on the formats it supports
 Wallet filesReads wallet.dat, Electrum, Blockchain.com, keystores, BIP38, MultiBit and more directly — no conversionNeeds the wallet converted to a hash line first via the format’s *2john / *2hashcat extractor — BTCRecover’s own extract-* / --data-extract output is for BTCRecover’s extracted-data mode, not a generic hashcat input
 When to pick itYour case, almost always — it was built for exactly this problemWhen you know the shape of the password and want a mask or wordlist attack at GPU speed
 CostFree, open source (GPLv2)Free, open source (MIT)
 This guide is the full btcrecover walkthrough. If you’d rather attack with masks and wordlists, read the hashcat walkthrough instead. Both start with the same step: protect your file and collect your clues.
 Before investing an evening, check the math first: is recovery technically possible? — that page takes 5 minutes and will save you from burning days on a case that was never viable.
 The walkthrough — six steps
 1
 Protect what you have — before anything else
 Make a read-only copy of the wallet file and run every command on that copy. Never on the original, never on your only backup. Do it on a machine that is offline or at least clean, and download everything only from official sources. Ten minutes here prevents the two most common ways a case becomes unrecoverable — a corrupted only-copy and a trojan disguised as a “cracker”. The full protection rules, plus the printable offline toolkit that keeps every step on paper.
 2
 Find the wallet file
 You need the encrypted file itself. Common paths: %appdata%\Bitcoin\wallet.dat (Bitcoin Core), %appdata%\Electrum\wallets, wallet.aes.json (Blockchain.com), UTC--…json (Ethereum keystores), MultiBit’s key-backup folder. Don’t know where yours lives? The full file-location guide covers Windows, macOS and Linux. btcrecover also ships a walletfinder.py that scans a folder tree and auto-detects supported wallet files.
 3
 Install btcrecover (10 minutes)
 There is no installer — you download, unzip and install the Python dependencies. The official steps from the project’s own documentation:
 # 1. Download from the official repository
https://github.com/3rdIteration/btcrecover → Code → Download ZIP
# 2. Unzip, then open a terminal in the btcrecover-master folder
cd Downloads/btcrecover-master
# 3. Create and activate a virtual environment (recommended — keeps your system Python untouched)
python3 -m venv .venv
source .venv/bin/activate
# 4. Install the requirements (Python 3.10–3.13 recommended; needs Python installed first)
python -m pip install -r requirements.txt
# 5. Check it works
python btcrecover.py --help
 On Windows use py -m venv .venv then .venv\Scripts\activate, and the commands use python. A pip error about an externally-managed environment is Python protecting your system install — do not bypass it with --break-system-packages as a routine step; the virtual environment above is the fix. Reserve that flag for a last resort in a disposable VM or container.
 4
 Build your token list — the step that decides everything
 btcrecover builds whole passwords from the pieces you remember. Those pieces live in a plain-text file, usually called tokens.txt. The full method — what to write down, how to turn memory into candidates — is the password hint list guide, which includes a practice demo, the patterns for partial memory (fragments with unknown middles, endings, or lengths), and a downloadable offline builder that works without internet. The file format, in short:
 # one token per line; passwords are combinations of tokens from each line
# space-separated tokens on one line = alternatives (never combined together)
# + at line start = this token must be in every guess
# ^ = token only at the start · $ = token only at the end
# %d %1,3d %a %[chars] %y = wildcards (digit, 1–3 digits, letter, chars, symbol)
Amira amira AMIRA
2017 2016 2015
%0,1y
 That file covers “Amira + a year + maybe one symbol at the end” — a few hundred combinations, seconds to test. %y is “any single symbol”, so %0,1y means “zero or one symbol”. Add --max-tokens 4 if you’re not sure how many pieces combine. Before running a long search, always test the list — it lists the candidates without touching the wallet:
 python btcrecover.py --listpass --tokenlist tokens.txt
 Already have full candidate passwords? (from old notes, exports, or another tool) — use --passwordlist instead of a token list: each line is tried verbatim as one complete password. Without a filename, btcrecover prompts you to type them one per line; with a file, --passwordlist candidates.txt reads them directly. Typo options still apply on top.
 5
 Run the recovery
 Point btcrecover at your copied wallet file and token list. The classic wallet.dat case:
 python btcrecover.py --wallet wallet.dat --tokenlist tokens.txt --autosave progress.sav
 Two options that routinely save the case:
 Typos — if the password is probably right but mistyped: --typos 1 --typos-case --typos-swap --typos-repeat tries nearby variants (caps-lock slip, swapped or doubled characters). Keep the typo budget small — it multiplies the work.
 Autosave — --autosave progress.sav writes progress every ~5 minutes; if the machine reboots or you close the window, resume with --restore progress.sav (that flag must be the only option on the command line) instead of starting over.
 You’ll see a progress bar with an ETA. If the ETA says two weeks, that is the real answer about your current token list — see step 6.
 Three commands that save time. --length-min 8 --length-max 14 limits the guesses to the length you remember — a huge cut. --no-dupchecks skips duplicate-guess checking to save memory on very large token lists (add it up to four times). And if an ETA above one week makes btcrecover refuse to start, --max-eta 336 raises the built-in one-week cap for cases you want to let run.
 Two more for tricky memory. --regex-only '^[A-Z].*[0-9][0-9]$' tries only candidates that match the pattern (here: capital first, two digits at the end), and --regex-never does the opposite. --password-repeats-pretypos also tests doubled passwords (passwordpassword) — a common habit worth covering.
 6
 Read the result — and know when to stop
 Found: Password found: 'Amira2017@' — btcrecover stops, prints the password, and you unlock the wallet with it. Exhausted: Password search exhausted — every combination was tried and none worked. That means your memory of the pieces was wrong somewhere. Widen the tokens (more years, more spellings, other patterns you used) and try again. If the math says the search needs weeks of GPU time, let the feasibility numbers decide before you invest more — a fresh clue beats more GPU time, and the wallet files stay safe meanwhile.
 Going further — three cases worth knowing
 The BIP39 passphrase (25th word). Know your seed but lost the extra passphrase? btcrecover tests candidates against your wallet without a file: python btcrecover.py --bip39 --mnemonic "your twelve or twenty four words here" --addrs <known-address> --addr-limit 10 --tokenlist tokens.txt — you need the mnemonic plus one known address or your xpub as the target, and Ethereum/altcoin cases often need the appropriate --wallet-type. The 25th word, explained.
 Altcoins. Litecoin, Dogecoin, BCH and dozens of Bitcoin-derived coins share the wallet.dat format — btcrecover handles them with --wallet-type or --bip32-path. Fork wallets, explained.
 MultiBit Classic. If you kept the key-backup files, testing against a .key file is roughly 1,000× faster than the full wallet. The MultiBit guide.
 Never upload your wallet file to a public checker or unknown website
 btcrecover runs on your machine, offline. Never upload your wallet file or enter your seed phrase into a public checker or unknown website — legitimate recovery works on a local copy, and a file you upload to an unknown site is no longer under your control. A trusted, written remote process may use the encrypted file or an extract, but only under a controlled workflow. The file safety rules.
 These tools are free, and the people who build them get nothing when you succeed.
 btcrecover is volunteer-maintained open source (GPLv2), built on the original work of Christopher Gurnee, who created it in 2014. If it helps you, consider sending a tip — the addresses below are published by the project itself on its official GitHub README. This site is not affiliated with the developers.
 btcrecover — current maintainer
 37N7B7sdHahCXTcMJgEnHz7YmiR4bEqCrS
 Bitcoin. The README also lists BCH, LTC and ETH addresses for the same maintainer.
 btcrecover — original developer (Gurnec)
 3Au8ZodNHPei7MQiSVAWb7NB2yqsb48GW4
 The tool’s creator, who maintained it until 2017. The current maintainer passes a share of tips his way too.
 Password found — now what?
 A btcrecover success means the password is verified and the wallet opens — not that the journey is over. Do these in order:
 1
 Verify before you move anything. Open the wallet with the recovered password and confirm it loads with the expected addresses and balance before moving funds. (A wrong variant opening a different, empty wallet is a seed-passphrase phenomenon, not a verified encrypted-wallet password — see the passphrase guide.)
 2
 Store the password safely. The moment it works, save it in a password manager and keep one written fallback — then never reuse it for another wallet. That is the whole storage rule.
 3
 Note the balance first. Write down the balance and addresses before transferring, so you can spot problems immediately.
 4
 Move the funds to a fresh wallet. Old wallet software is discontinued and often unsafe to keep using — and importing old keys into modern software does not make them fresh. Create a new wallet with a new seed, back it up and verify it, then send/sweep the funds to its addresses.
 5
 Use only official software. The moment you have access is also the moment you are most careless — download wallets only from official sites, never from search ads or links in messages.
 Now that the password is back, make sure it stays that way — never losing access covers the storage rule.
 Frequently asked questions
 Does btcrecover need a GPU?
 No. btcrecover runs fine on a CPU — token-list searches on wallet.dat and most formats are fast enough without one. A GPU speeds up some modes, but the candidate list decides the case, not the hardware.
 How fast is btcrecover?
 It depends on the wallet format and its iteration count: an old low-round wallet.dat is checked hundreds of times per second on one CPU, a MultiBit Classic .key backup around a million times per second, and a scrypt keystore only about a hundred. The benchmarks page lists measured rates per format.
 Can btcrecover crack any wallet password?
 No — and no tool can. If the password is a long random string, the search space is beyond any hardware. btcrecover recovers human-chosen passwords when you can describe the pieces you remember.
 Is btcrecover safe to use?
 Yes — it is free, open-source software (GPLv2) from the official 3rdIteration repository. Run it offline on a read-only copy of your wallet file, and never upload the file to a public checker or unknown website.
Sources & references
 btcrecover documentation
 3rdIteration/btcrecover — maintained fork (source code)
 Cite this page
 APA: Bink, R. (2026). How to run btcrecover yourself — the complete walkthrough. ForgotWalletPassword.com. https://forgotwalletpassword.com/btcrecover-step-by-step
 Markdown: [How to run btcrecover yourself — the complete walkthrough.](https://forgotwalletpassword.com/btcrecover-step-by-step)
 Do this first
 Build a password hint list
 The method that decides whether any tool works: turn what you remember into candidates.
 Build your list →
 The other tool
 hashcat step by step
 Masks, wordlists and GPU speed — the full walkthrough, with the wallet hash modes.
 Read the hashcat guide →
 The third tool
 John the Ripper step by step
 The CPU specialist — the practical path for Monero .keys files and a clear way to learn wordlists and rules.
 Read the John guide →
 Check the math
 How long to crack a password?
 Real measured guesses-per-second per format — before you invest a week.
 See the numbers →
 The bigger picture
 Is recovery possible?
 Before you run it, read the math — what feasible really means.
 See the verdict →
# Coinomi's password is a lock on the front door. The phrase is the key to the house.
URL: https://forgotwalletpassword.com/coinomi-wallet-password-recovery

Forgot Your Coinomi Password? scrypt vault vs Seed Phrase
 Skip to content
 Format guide · Coinomi · the vault
 Coinomi’s password is a lock on the front door. The phrase is the key to the house.
 Coinomi is a multi-coin wallet (Android, iOS and desktop) whose funds are governed by a 24-word recovery phrase. The app password protects the on-device vault. Forgetting the password is a real problem only if the phrase is also gone — so the first question is always about the phrase, not the file.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 With your 24-word Coinomi recovery phrase, the app password is irrelevant — restore the phrase in Coinomi (or any compatible wallet) and set a new password. Without the phrase, you’d need the vault file, which is encrypted with scrypt (N=16384, r=8, p=1) — among the harder formats to crack.
 Which wallets use this format?
 The Coinomi vault is Coinomi’s own scrypt-encrypted wallet file — app data on Android/iOS and, on desktop, .wallet files in the Coinomi data directory. Only the Coinomi app creates or opens it — it is not a shared format.
 The good news: the 24-word recovery phrase is the real backup. With the phrase, the vault password is irrelevant, and the wallet can usually be restored in Coinomi or another compatible BIP39 wallet — provided the same coin, account, passphrase setting and derivation path are supported.
Check the phrase first — it decides everything
 Coinomi generates a 24-word recovery phrase when a wallet is created (with an optional extra passphrase, sometimes called the “25th word”). Whoever holds the phrase controls the normal wallet — and if a BIP39 passphrase was enabled, restoring requires both the exact phrase and the exact passphrase. If you wrote it down:
 restore the phrase in the Coinomi app (or another compatible BIP39 wallet) on any device — the same coin, account, passphrase setting and derivation path must be supported;
 set a new app password;
 the old password becomes irrelevant.
 The password you forgot was protecting the local vault file — not the keys themselves. This is the same architecture as MetaMask and the other seed-based mobile wallets. If you have only part of the phrase, that’s seed reconstruction — outside this site’s scope; hunt for a complete backup with the search checklist.
 If the phrase is gone: the vault file
 Without the phrase, the only remaining target is the encrypted vault file. Where it lives depends on the platform — two realities here:
 Getting the file is the hard part. On Android, Coinomi stores its data in app storage, which normal users can’t browse — an old full-device backup (Titanium-style root backup, or an ADB backup from before Android 12’s restrictions) is the realistic source, and the old-phone extraction guide covers the paths step by step. On desktop, .wallet files sit in the Coinomi data directory (on Windows, for example, %localappdata%\Coinomi\Coinomi\wallets) and btcrecover can read them directly. On Android, if you never made a backup, this path usually dead-ends before any cracking begins.
 If you do get the vault, it’s scrypt. The measured speed for the Coinomi vault format is roughly 500 guesses per second on a modern CPU (btcrecover measurements). That’s the same league as Ethereum keystores and BIP38 — far slower per guess than wallet.dat or Blockchain.com. This assumes a password-protected wallet — biometrics, no-password or password + biometrics setups may depend on device-keystore material (see below).
 So the verdict: a Coinomi vault without the phrase is a hard case. If the vault file exists and you remember the password’s shape, it’s a legitimate recovery project. If both are missing, no one — anywhere — can brute-force a random Coinomi password. The framework explains why.
 Recovery tools and speeds
 First determine how the wallet was protected: standard password-protected Coinomi wallets can be attacked from the wallet file with btcrecover. Wallets configured with biometrics, password + biometrics, or no password may additionally depend on device-keystore material — the wallet file alone may not be sufficient. If that applies, keep the device and its keystore intact before wiping anything. With a password-protected vault, two public tools can attack it — both work offline on a copy of the file:
 ToolHow it worksTypical speed*
 btcrecoverReads the extracted vault directly; token lists built from your memory~500 guesses/sec (CPU)
 John the Rippercoinomi2john extracts the vault to the same hash format btcrecover usessame order of magnitude
 *Measured on the reference CPU (Ryzen 9 9950X) — see the benchmarks & methodology page. The vault is scrypt, which is memory-hard: GPUs gain almost nothing, so the CPU rate is the real rate.
 Practical steps in order
 1
 Search for the 24-word phrase — notebook, password manager, email draft, photo of a paper card. Work the 68-place checklist.
 2
 If the phrase exists, restore and move on — no cracking involved.
 3
 If it doesn’t, hunt old device backups for the vault file before considering anything else.
 4
 Only with the vault file in hand does the question become password cracking — and only then do the offline tools matter.
 And the “25th word”?
 Coinomi supports an optional passphrase layer on top of the 24 words (BIP39’s “passphrase” feature — the glossary explains the terminology). If you used one and don’t remember it, treat it as part of the seed problem: the calculator models passphrase search spaces, and the real numbers there are humbling. Most users didn’t set one — check before you panic.
 Common mistakes
 Assuming the phrase is gone. Most “lost” phrases turn up in a notebook, a password manager, an email draft or an old photo — work the search checklist before concluding they’re gone.
 Pointing the tool at the wrong file. The vault is the scrypt-encrypted app data; a wallet export or the phrase are different things. Identify your file first.
 Not preserving the wallet data. On Android the vault only lives in app storage; on desktop it is a file in the Coinomi data directory. Before upgrading or wiping a device, back up the wallet data — the copy is what makes recovery possible.
 Expecting GPU speed. scrypt is memory-hard — a rented GPU rig will not crack a Coinomi vault meaningfully faster than a CPU.
 Frequently asked questions
 Is the Coinomi app password the same as the seed phrase?
 No. The app password locks the on-device vault; the 24-word recovery phrase is the backup that recreates the wallet anywhere. With the phrase, the password stops mattering.
 Can the Coinomi vault be cracked?
 If the wallet was protected with a password and you have a copy of the vault file, usually yes — offline, with btcrecover or John the Ripper (coinomi2john), at roughly 500 guesses per second on a modern CPU. Wallets set up with biometrics, password + biometrics, or no password may additionally depend on device-keystore material, so the file alone may not be enough — keep the device intact until that is ruled out. scrypt is memory-hard, so this only works for human-chosen passwords with clues.
 What if I never made a device backup?
 Without the vault file there is nothing to attack — on Android the keys are only in app storage (on desktop they are .wallet files in the Coinomi data directory), so the password is irrelevant. The realistic path is the search checklist for the phrase.
 Next step
 Start with the phrase search — it’s the difference between a five-minute restore and a possibly-impossible crack. Then, depending on what you find, weigh your options with your actual facts in hand.
 Sources & references
 btcrecover — performance benchmarks
 Cite this page
 APA: Bink, R. (2026). Coinomi’s password is a lock on the front door. The phrase is the key to the house. ForgotWalletPassword.com. https://forgotwalletpassword.com/coinomi-wallet-password-recovery
 Markdown: [Coinomi’s password is a lock on the front door. The phrase is the key to the house.](https://forgotwalletpassword.com/coinomi-wallet-password-recovery)
 Lost or partial phrase?
 The 68-place search checklist
 Hunt for a complete backup before anything else — reconstructing lost seed words isn’t covered here.
 Work the checklist →
 The framework
 When recovery is possible
 Why a scrypt vault without clues is a dead end, in plain numbers.
 Judge your case →
 Overview
 Which wallet passwords can be recovered?
 Coinomi’s verdict — and every other wallet — in one table.
 See the master list →
# hashcat doesn't read wallet files — extract the one-line hash it needs, with exact commands and modes.
URL: https://forgotwalletpassword.com/convert-wallet-to-hashcat-hash

Convert a Wallet to a hashcat Hash — the Extraction Step
 Skip to content
 Tools · the extraction step
 Convert a wallet to a hashcat hash
 hashcat does not read wallet files — it works on a one-line hash that an extraction script pulls out of your wallet first. This page covers where those scripts live, the exact command for every major wallet format, how to verify the line, and the errors that follow a mismatch.
 By Robbert Bink · ~9 min read · Published 10 August 2026 · Last reviewed: 14 August 2026
 The headline
 hashcat doesn’t read wallet files — it tests one-line hashes, so a separate script must extract that line from your wallet first: salt, KDF parameters and a verification value, nothing else. For most formats one command does it — bitcoin2john.py wallet.dat > wallet.hash, then hashcat -m 11300 wallet.hash. Ethereum keystores need the step too: ethereum2john.py converts the JSON — hashcat does not read the raw file.
 The short answer
 Every wallet format has one extraction script that produces the line hashcat needs, and one mode number that matches it. Three script families cover the formats on this site:
 *2john.py — the extractors in John the Ripper jumbo’s run/ folder. Many of their outputs work in both John and hashcat after formatting cleanup. Ethereum keystores are the clearest case where the conversion is required: ethereum2john.py reads the UTC JSON and produces the $ethereum$p*…/$ethereum$s*… line that both hashcat (modes 15600/15700) and John need — hashcat does not read the raw JSON. Examples: bitcoin2john.py, electrum2john.py, blockchain2john.py, multibit2john.py.
 *2hashcat.py — the extractors in hashcat’s tools/ folder, for formats the 2john family doesn’t cover as cleanly: metamask2hashcat.py, exodus2hashcat.py, bisq2hashcat.py.
 extract-*.py — btcrecover’s scripts in its extract-scripts/ folder. These produce btcrecover’s own bc:-style base64 for --data-extract, not a hashcat line. They are the right tool for the btcrecover path, and the wrong tool for the hashcat path.
 The recipes below use the first two families. If the conversion step feels like a project of its own, that is the strongest argument for btcrecover instead — it does the extraction internally and reads these wallets directly. The hashcat path earns its keep when you have a specific mask or wordlist attack in mind.
 Why extraction exists
 hashcat is a general-purpose cracker, not a wallet parser. Each mode number corresponds to one hash type — 11300 is Bitcoin/Litecoin wallet.dat, 26600/26610/26620/31900 cover the MetaMask vault generations, and so on. The extraction script reduces your wallet to the small piece hashcat actually needs: the salt, the KDF parameters (like the iteration count), and a verification value that a correct password reproduces. An extracted hash is not normally a plaintext private key, but it can contain highly sensitive encrypted wallet material — for some formats, possession of the extracted data together with the recovered password may be sufficient to expose wallet secrets. Treat every extracted hash as sensitive as the original wallet file.
 The one-line recipes
 Copy the wallet file to a working folder first, then run the extractor and redirect its output into a text file. The commands assume Python 3 and the script in your current folder or PATH:
 Wallet / fileExtract the linehashcat mode
 wallet.dat — Bitcoin Core, Litecoin, Dogecoin, BCH, Dashbitcoin2john.py wallet.dat > wallet.hash-m 11300
 Electrum — wallet fileelectrum2john.py <file> > e.hashFollows the $electrum$N prefix: 1/2/3 → -m 16600 · 4 → -m 21700 · 5 → -m 21800
 Blockchain.com — wallet.aes.jsonblockchain2john.py <file> > bc.hash-m 12700 (legacy My Wallet) · -m 15200 (v2/v3) · -m 18800 (2nd password) · very early V0: -m 34700 (identify first)
 MultiBit — Classic .key / .wallet / HDmultibit2john.py <file> > mb.hash-m 22500 (.key) · -m 27700 (.wallet) · -m 22700 (HD)
 MetaMask — extension/mobile vaultmetamask2hashcat.py --vault vault.json > mm.hash — the extractor reads the KDF parameters from the vault-m 26600 (legacy extension) · -m 26610 (newer dynamic-iteration) · -m 31900 (mobile) — 26620 only in newer/development hashcat builds; use the modes your installed version supports
 Exodus Desktop — seed.secoexodus2hashcat.py seed.seco > ex.hash-m 28200
 Bisq — .walletbisq2hashcat.py bisq.wallet > bisq.hash-m 29800
 Ethereum keystore — UTC--*.jsonethereum2john.py UTC--*.json > eth.hash (remove any filename: prefix)-m 15600 (PBKDF2) · -m 15700 (scrypt)
 BIP38 paper key — 6P…No hashcat modebtcrecover --bip38-enc-privkey
 Then run hashcat against the extracted file, for example: hashcat -m 11300 wallet.hash words.txt -r rules/best66.rule. The full attack setup — masks, wordlists, rules — is on the hashcat walkthrough.
 Verify the line before you run
 Three quick checks catch nearly every “it doesn’t work” moment:
 The marker matches the mode. The line should start with the right prefix: $bitcoin$… for 11300, $electrum$… for the Electrum modes, $blockchain$… for 12700/15200, $metamask$… for the MetaMask modes. A $bitcoin$ line with -m 26600 will never load.
 Strip the filename prefix. Several 2john scripts print wallet.dat:$bitcoin$64$… — hashcat needs only the part after the colon. The hashcat forum gives this as the most common formatting mistake.
 Compare with the example hashes. hashcat’s example-hashes page shows exactly what a valid line looks like per mode. If your line looks nothing like the example, the mode is wrong or extraction failed.
 Common errors — and the real cause
 “No hashes loaded” — the mode number doesn’t match the hash type in the line. Check the marker and the example hashes before changing anything else.
 “Separator unmatched” — a malformed line, almost always a leftover filename prefix or a line that was wrapped when copied. Re-run the extractor with a clean redirect.
 Extractor produces nothing — the wallet may simply not be encrypted. Bitcoin Core, for example, only encrypts wallet.dat after you set a password; an unencrypted wallet has no password hash to extract. That is not a tool failure.
 Every one of these has a step-by-step fix on the troubleshooting index.
 When you don’t need this page
 Ethereum keystores — btcrecover reads them directly (the simpler route). If you choose the hashcat path, the conversion is one command: ethereum2john.py UTC--*.json > eth.hash — hashcat does not read the raw JSON.
 btcrecover — it parses the wallet internally, so no hash line is ever needed. The walkthrough is the simpler route for most people.
 John the Ripper — it uses the same *2john.py extractors; the JtR walkthrough covers its side of the same lines.
 Safety note
 Extraction and cracking both run fully offline on your own machine. The extracted line is not normally a plaintext private key, but for some formats it contains sensitive encrypted wallet material — possession of the extract together with the recovered password may be enough to expose wallet secrets. Treat it like the wallet file: keep it local, never paste it into a public checker or unknown website, and delete the working copy when you’re done. Anyone who asks you to upload a “hash” or wallet file to a public checker or unknown website is not running a safe recovery — a legitimate remote route works through a clear written process with the extract line, never through random uploads. The file safety rules apply to hash lines exactly as they do to wallet files.
 Frequently asked questions
 How do I convert wallet.dat to a hashcat hash?
 Run bitcoin2john.py wallet.dat > wallet.hash, then use hashcat -m 11300 wallet.hash. bitcoin2john.py ships in John the Ripper jumbo’s run folder and produces the $bitcoin$… line mode 11300 needs.
 Why does hashcat say “No hashes loaded”?
 The mode number does not match the hash type in the extracted line — for example a $bitcoin$ line run with the wrong mode. Check that the line starts with the right marker ($bitcoin$, $electrum$, $blockchain$…) and compare it with the example hashes for your mode.
 Is the extracted hash line a private key?
 Not normally. The extracted line contains the salt, KDF parameters and a verification value that candidate passwords are tested against. It is not a plaintext private key, but for some formats it contains encrypted wallet material that, together with the recovered password, can expose wallet secrets. Treat every extracted hash as sensitive as the original wallet file.
 Cite this page
 APA: Bink, R. (2026). Convert a wallet to a hashcat hash. ForgotWalletPassword.com. https://forgotwalletpassword.com/convert-wallet-to-hashcat-hash
 Markdown: [Convert a wallet to a hashcat hash](https://forgotwalletpassword.com/convert-wallet-to-hashcat-hash)
 What comes next
 hashcat step by step
 Install, modes, masks and wordlists — the full attack after your line is extracted.
 Run the walkthrough →
 The simpler route
 btcrecover step by step
 No extraction, no mode numbers — btcrecover reads the wallet file directly.
 Try btcrecover →
 One-page reference
 The command cheat sheet
 Every wallet format, one command: extract, mode, run — in a single table.
 Open the cheat sheet →
 Stuck?
 Troubleshooting index
 “No hashes loaded”, separator errors, extraction failures — the fixes, step by step.
 Find the fix →
# Two doors. One for this site, one for your case.
URL: https://forgotwalletpassword.com/contact

Contact ForgotWalletPassword.com — Editorial Questions
 Skip to content
 Contact
 Questions, feedback or something you can’t find?
 This is the contact page for ForgotWalletPassword.com, the educational guide operated by Crypto Recovers. Whether it is a factual error, a topic you want covered, or a question the guides didn’t answer — write to the address below.
 Contact
 Spot a factual error? Have a topic you want covered? Something on this site that didn’t answer your question? Mail the address below.
 Email
 hello@forgotwalletpassword.comPlease do not send wallet files, seed phrases or passwords to this address.
 Quick tip before you write
 The answer to your question is often already on the site — the FAQ, the diagnosis quiz and the glossary cover most of what people ask about.
 What happens next
 Mail is read within a few working days; factual corrections are usually applied within the same week. If your question is about your own case, we will point you to the right guide — the feasibility and tool guidance is on the site, for everyone.
 And if you are ever unsure whether a service, email or message about your wallet is legitimate, write to us first — we would rather you ask than act on something uncertain.
 And for the fine print about what this site is and isn’t, read the disclaimer.
 Security researchers
 Found a factual error in our encryption or tooling sections (KDFs and iterations, format specifics, tool behaviour)? Flag it with the page name and your source — technical corrections are our top priority and are applied fast.
 About us
 About this site
 Who we are, what we stand for, and what this site does and doesn’t cover.
 Read about us →
 Quick answers
 Frequently asked questions
 Eleven of the most common questions, answered directly and briefly.
 Browse the FAQ →
# How much crypto is really lost to forgotten passwords?
URL: https://forgotwalletpassword.com/lost-crypto-statistics

Lost Bitcoin & Wallet-Access Statistics — Source-Cited
 Skip to content
 Data · every figure source-cited
 How much crypto is lost — and how much is forgotten passwords?
 Numbers are only useful when they’re traceable. Every figure on this page comes from a published source — a Chainalysis study, a Kaspersky survey, or a documented news case — and each one links to its origin. Where a number is an estimate, we say so, and we say why.
 By Robbert Bink · ~10 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Roughly 2.8–3.8 million Bitcoin — 13–18% of all that will ever exist — is estimated to be permanently lost, and 32% of crypto owners in a 2023 Kaspersky survey had lost access to a crypto-related account at some point. The documented cases: 7,002 BTC locked in an IronKey, 7,500 BTC in a landfill, and 1,700 BTC held by German police.
 How much Bitcoin is permanently lost?
 The most-cited estimate comes from Chainalysis, first published in 2017. Chainalysis segmented the Bitcoin supply by coin age and transaction activity and estimated how much was likely permanently out of circulation. Its 2017 analysis estimated that roughly 2.78–3.79 million BTC was effectively gone — commonly quoted as ~3.7 million BTC, about 17–23% of the circulating supply at the time.1 At late-2017 prices that was roughly $32 billion; at recent prices the same coins would be worth several hundred billion.
 Two things are worth noting about that headline number. First, it predates the 2021 and 2024 bull runs, and the supply has since grown — but no newer study has revised the share dramatically. Second, and more important: forgotten passwords are only one slice of it.
 Why these numbers are estimates — and why that matters
 No analyst can see a wallet and know why its coins never move. The estimate captures the combined result of everything that permanently removes coins from circulation:
 wallets whose passwords and seed phrases were forgotten or misplaced;
 hardware wallets and USB drives that failed or were destroyed;
 owners who died without passing on their access;
 paper wallets lost, damaged, or thrown away;
 coins deliberately burned, or stuck on dead exchanges and services.
 The conclusion: the true “forgotten password” figure is lower than the total lost-Bitcoin figure, but there is no reliable way to split it out. What the cases below show is that the forgotten-password slice alone is large enough to matter — three documented incidents alone account for roughly 16,200 BTC.
 Three documented cases that made the numbers real
 These are the cases with enough public documentation to verify: the amounts, the circumstances, and the sources. They are why this problem gets covered by mainstream media — and they are all preventable in hindsight.
 Stefan Thomas — 7,002 BTC, two guesses left on an IronKey
 In 2011 Stefan Thomas, a German-born programmer, was paid 7,002 BTC for making an animated video explaining Bitcoin. He stored the private keys on an IronKey USB drive, which wipes itself permanently after 10 incorrect password attempts. He wrote the password down on paper, lost the paper, and by the time BBC reported the story in January 2021 he had used 8 of his 10 attempts — two guesses remained for a holding worth roughly $240 million at the time.2 He publicly decided to keep trying to remember rather than risk attempt nine. The drive has never been unlocked.
 Why it matters for you: hardware that erases itself after a limited number of tries changes the strategy completely — guessing becomes risky, not just slow. Some hardware wallets impose retry limits, delays or device-reset behaviour after repeated incorrect PIN attempts; the exact behaviour is device-specific, so check the manufacturer’s documentation before guessing.
 James Howells — 7,500 BTC thrown out with a bin bag
 In the summer of 2013, IT engineer James Howells of Newport, Wales, threw away a hard drive containing the private keys to 7,500 BTC. His partner had mistakenly put the bag in the rubbish; it went to the Docksway landfill. At the time the coins were worth roughly £500,000; by the December 2024 High Court hearing over his bid to excavate the site, the same stash was worth over £500 million.3 Newport City Council has repeatedly refused permission to dig, citing environmental permits. In January 2025, the High Court dismissed the claim, effectively ending that legal route. The coins remain in the ground, unreachable.
 Why it matters for you: “I know exactly where it is” is not the same as “I can get to it.” The first thing to do after a password loss is secure every remaining copy of the wallet file — before it follows the bin bag.
 The 1,700 BTC German police cannot unlock
 In February 2021, prosecutors in Kempten, Bavaria announced they had seized 1,700 BTC (then worth about $60 million) from a convicted fraudster who had used victims’ computers for mining. The password problem: the man refused to hand it over, and the wallet’s encryption was robust enough that German law enforcement could not break it.4 The coins have sat locked in state custody since.
 Why it matters for you: if a state prosecutor’s office with real technical resources cannot crack a properly encrypted wallet without the password, neither can anyone who emails you a quote. Anyone who claims instant success against modern encryption is not telling you the truth.
 What surveys say about everyday access loss
 Lost-Bitcoin studies measure the extreme tail. Surveys measure the everyday version. Kaspersky’s Crypto Threats 2023 report — a survey of 2,000 American adults conducted in October 2022 — found that 32% of people who own or have owned crypto said they had lost access to a crypto-related account at some point.5 The same survey found only 15% used a cold wallet and only 34% used two-factor authentication — which is exactly the behaviour profile that produces forgotten wallet passwords.
 The practical takeaway: if you’re reading this because you locked yourself out, you are not in a rare category. Roughly one in three people who have ever held crypto has been where you are. That’s why this site exists, and why the systematic search — not panic — is the statistically correct first move.
 Why the same password gets harder to crack every year
 The second force behind the headlines is that wallet encryption has been getting stronger on purpose. The number of key-derivation iterations determines how many guesses a computer can try per second — and wallets have been ratcheting that number up for a decade. These are the verified parameters, taken from the format specifications and from measurements published by the open-source recovery tool btcrecover:
 Wallet formatKey derivationCost (verified)Measured speed, modern CPU
 wallet.dat — low-round (original ~25,000 baseline)
 iterated SHA-512 (EVP_BytesToKey)
 ~25,000+ rounds — machine-tuned; the original Core baseline was 25,0006
 not benchmarked separately
 wallet.dat — reference wallets
 iterated SHA-512 (EVP_BytesToKey)
 measured on btcrecover reference wallets: 67,908–267,488 rounds (machine-tuned)7
 472 / 122 guesses per second7
 Ethereum keystore JSON
 scrypt or PBKDF2-HMAC-SHA256
 scrypt N=262,144 r=8 p=1 · PBKDF2 262,144 iterations8
 ~96 guesses per second (scrypt)7
 BIP38 paper-wallet key
 scrypt
 N=16,384 r=8 p=89
 ~72 guesses per second7
 MetaMask vault
 PBKDF2-SHA256
 10,000 iterations (measured)7
 ~5,160 guesses per second7
 Iteration counts for wallet.dat are dynamic — the wallet picks a count based on the machine that encrypted it — so real wallets vary; the figures shown are the values measured on the reference wallets in the btcrecover benchmark suite. Ethereum keystores: 262,144 is the current geth default for both scrypt and PBKDF2; older wallets created by early tools used lower values, which is one reason an old keystore can be far easier to crack.
 Read that table once more, because it explains the entire industry: a modern wallet.dat lets a cracker try only a few hundred guesses per second, and an Ethereum scrypt keystore only around a hundred. Older files are often faster to test — old wallet.dat files frequently have fewer rounds (the exact count is stored in the file), and some early Ethereum keystores used very low KDF costs — which is why an old wallet can be dramatically easier. That is why “when is recovery possible” has a real, technical answer — and why the answer keeps changing with your wallet’s age.
 What the numbers mean for your own wallet
 An old wallet is your best luck. Older wallet.dat files often have fewer key-derivation rounds, especially if they were encrypted on slower hardware — but the exact round count is stored in the wallet and is not determined by the year alone, so identify the file and read the stored parameters before estimating cracking speed. The same password that would take centuries to crack in a high-round wallet may be reachable in a low-round one. Identify your file first.
 You are one of ~32%, not a freak case. Losing access is statistically normal. The recovery path is methodical search, not shame and panic.
 Know the numbers before you pay anyone anything. If the math on your case says no, that is the real answer — and knowing it protects you from anyone who promises otherwise.
 Prevention beats every statistic. The prevention guide is short — and it is the one page worth reading before you ever need it.
 Don’t let the headline numbers set your expectations
 “Millions of Bitcoin are lost” is also how every sales pitch starts. The truth: the cases above are unrecoverable despite millions of dollars of incentive and government resources. Your odds depend only on your wallet’s format and your password’s pattern — check those, not the news.
 Sources
 Chainalysis lost-Bitcoin estimate, reported by Fortune, “Lost Bitcoins: Research estimates up to 3.79 million Bitcoins are gone forever” (Nov 2017) — fortune.com/2017/11/25/lost-bitcoins
 BBC News, “Man has two guesses to unlock bitcoin worth $240m” (Jan 2021) — bbc.com/news/technology-55645408
 The Guardian, “Man has ’finely tuned’ plan to find £500m bitcoin thrown in tip, Cardiff court told” (Dec 2024) — theguardian.com (Dec 3, 2024)
 Reuters, “Police seize $60 million of bitcoin! Now, where’s the password?” (Feb 2021); also covered by Ars Technica — reuters.com (Feb 5, 2021)
 Kaspersky, “Crypto Threats 2023” survey of 2,000 U.S. adults (Oct 2022), released Mar 2023 — prnewswire.com (Mar 22, 2023)
 Bitcoin Core’s wallet encryption uses a dynamic rounds count chosen by the encrypting machine — the mechanism is documented on the Bitcoin Wiki’s wallet-encryption technical page — en.bitcoin.it/wiki/Wallet_encryption. The ~25,000-round baseline for old wallets comes from Bitcoin Core’s own crypter code (DEFAULT_DERIVE_ITERATIONS); the exact count in any wallet was chosen at encryption time based on machine speed, and the btcrecover reference wallets measure 67,908–267,488 rounds (source 7).
 BTCRecover, “Performance Benchmarks” — measured passwords-per-second and wallet iteration counts on reference hardware (Ryzen 9 9950X, RTX 5090), published on the project’s readthedocs — btcrecover.readthedocs.io/Benchmarks
 Ethereum Foundation, “Web3 Secret Storage Definition” — official KDF test vectors (PBKDF2 c=262,144; scrypt n=262,144 r=8 p=1) — ethereum.org/docs (Web3 secret storage)
 BIP-0038, “Passphrase-protected private key” — scrypt parameters n=16384, r=8, p=8 — github.com/bitcoin/bips (BIP-0038)
 Compiled and checked 6 August 2026. All source URLs verified live at the time of writing. Where the original sources report ranges (as Chainalysis does), this page reproduces the range rather than inventing a single number.
 Cite this page
 APA: Bink, R. (2026). How much crypto is really lost to forgotten passwords?. ForgotWalletPassword.com. https://forgotwalletpassword.com/lost-crypto-statistics
 Markdown: [How much crypto is really lost to forgotten passwords?](https://forgotwalletpassword.com/lost-crypto-statistics)
 Your odds, quantified
 Password strength calculator
 Enter what you remember about your password and get real time-to-crack estimates based on the measured speeds above.
 Run the numbers →
 The mechanics
 How long to crack a wallet password?
 Search space, guess rates, and why “smart” attacks beat brute force by millions.
 Read the math →
 Before the math matters
 The ultimate search checklist
 68 places a forgotten password hides — because most recoveries are found, not cracked.
 Start searching →
 The bigger picture
 Which wallet passwords can be recovered?
 The numbers meet the verdicts: every wallet in one searchable table.
 See the master list →
# Not every forgotten crypto password is a recovery case.
URL: https://forgotwalletpassword.com/custodial-wallet-reset

Exchange or Custodial Wallet Password? Just Reset It
 Skip to content
 Guide 03
 Not every forgotten crypto password is a recovery case.
 If you searched for “forgot wallet password” because of a Coinbase, Kraken, Binance or other exchange account, this page is for you — and the news is good. Custodial accounts reset through identity, not cryptography. This site’s entire topic is the other kind of wallet: the self-custody kind where only you hold the key.
 “Coinbase” and “Coinbase Wallet” are not the same recovery case
 Coinbase exchange accounts are custodial and recover through account reset/KYC. Coinbase Wallet / Base App wallets are self-custody: recovery depends on the recovery phrase, cloud backup, passkey/signer setup, or remaining device access — Coinbase cannot recover or move funds from a self-custody wallet for you. If you mean the Wallet app, see identify your wallet and the password vs seed flow instead.
 By Robbert Bink · ~4 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Exchange and custodial accounts recover through email, KYC and 2FA — the password reset is free, official, and has nothing to do with cracking. You never need a recovery service for this. This site exists for self-custody wallets (wallet.dat, keystores, seed phrases) where the password is the only door — if a platform can reset you, you’re in the easy category.
 Custodial vs self-custody: the one distinction that decides everything
 Custodial (exchange)Self-custody (this site’s topic)
 Who holds the keys?the platformyou
 Forgot password?reset via email / phone / KYC / 2FA recoveryno reset exists — the password (or seed) IS the key
 Forgot 2FA?ID-verification recovery processdepends on the wallet architecture — some self-custody 2FA wallets, such as Electrum 2FA, can be restored from the wallet seed without the second factor
 Can a “recovery service” help?no — reset runs through the platform onlyonly by cracking (with your file, offline)
 That’s the whole page in a table. Exchanges like Coinbase, Kraken, Binance, Bitstamp and Gemini all run documented account-recovery flows: start with the password reset, escalate through support with identity documents if 2FA is also lost. It’s slow bureaucracy, not cryptography — and it’s free.
 Why the reset is always free
 No private party can reset an exchange account. The reset path runs through the platform’s own verification, and it is free. Anyone outside that flow asking for money is taking yours, not recovering anything.
 When it is a real recovery case
 The rules flip the moment any of these are true:
 your funds are on a self-custody wallet — any file with a wallet.dat, keystore JSON, or a seed phrase you must keep secret;
 a platform shut down or froze withdrawals, and the “reset” doesn’t work (a withdrawal problem, not a password problem);
 you exported a wallet file and lost its password — the export isn’t a custodial account anymore, it’s a self-custody file.
 In those cases, welcome to the real topic: identify what you have, then follow the search and feasibility paths.
 The boundary, stated plainly
 This site’s reason for existing is the wallets where forgetting the password can mean losing the funds forever — the lost-Bitcoin numbers exist because of them. If your situation is a platform login, you’re not in that group: the platform can reset you, and it’s the only party that can. If someone charges you for that middle step, they are not part of the platform’s process.
 The core distinction
 Password vs seed phrase
 Which “password” you forgot changes everything about what’s recoverable.
 Learn the difference →
 Are you sure it’s custodial?
 Which wallet file do you have?
 If there’s a file on your computer, the rules are different — identify it.
 Identify the format →
 The bigger picture
 Which wallet passwords can be recovered?
 Where reset cases sit in the full picture — every wallet in one table.
 See the master list →
# What this site is — and what it isn't.
URL: https://forgotwalletpassword.com/disclaimer

Disclaimer — ForgotWalletPassword.com
 Skip to content
 Legal fine print
 What this site is — and what it isn’t.
 Read this before acting on anything here. It’s short, it’s plain English, and it protects both of us.
 Educational information only
 ForgotWalletPassword.com publishes educational information about crypto wallet passwords, wallet file formats and password recovery. Everything on this site is provided “as is”, for general information, and may change without notice. It is not financial, investment, legal or technical advice tailored to your situation.
 No guarantee of results
 Crypto recovery is governed by mathematics, not promises. No statement on this site can guarantee that a forgotten password will be recovered. Where this site describes feasibility (“possible”, “unlikely”, “impossible”), those are technical assessments based on password space and cracking speeds, not promises. Any offer that guarantees success or demands payment upfront should be treated with caution.
 No custody of your keys, ever
 This site will never ask for your seed phrase, private keys or wallet passwords, and we do not collect them. If you receive a message that claims to be us asking for such information — on any platform — it is an impersonator. Report it and do not respond — genuine contact from us only ever happens through the contact page.
 Relationship to Crypto Recovers
 ForgotWalletPassword.com is an educational initiative operated by Crypto Recovers. This site and the recovery service are separate: this site does not itself provide recovery services, and the service’s terms, pricing and process are governed by its own agreements. The presence of links to the service on this site does not constitute an endorsement of any specific outcome.
 Accuracy
 We work to keep technical details (hashcat modes, KDF parameters, file paths) accurate and current. Software changes: wallet versions update iteration counts, tools change, and operating systems move folders. If you spot something outdated, tell us and we will fix it.
 External links
 Links to third-party sites (tools, wallets, services) are provided for convenience. We are not responsible for their content, their security, or what they do with your data. Always download software from official sources and verify what you install — see offline recovery tools for the safety checklist.
 Your responsibility
 You are responsible for the security of your own wallet files, passwords and seed phrases, and for deciding what — if anything — to share with any service. Read protect your wallet files before engaging anyone.
 Limitation of liability
 You use this site and follow its instructions at your own risk. To the fullest extent permitted by applicable law, the operator and its owners, employees and contributors are not liable for any loss or damage — including, but not limited to, loss of funds, loss of data, or loss of access to a wallet or device — arising out of or in connection with your use of this site, its content, or anything you do (or do not do) after reading it.
 Nothing on this site creates a contract, a guarantee of results, or a professional relationship between you and the operator. If you are unsure whether an action is safe, stop and get specialist help first.
 Contact
 Questions about this disclaimer: contact us. See also the privacy policy and the terms of use.
 Who we are
 About this site
 The mission, the editorial standards and the operator relationship.
 Read about us →
 Your data
 Privacy policy
 What this site collects, what it never sees, and your rights.
 Read the privacy policy →
 Using this site
 Terms of use
 Acceptable use, no guarantees, intellectual property and liability.
 Read the terms →
 Get in touch
 Contact
 Corrections, questions and the right channel for a recovery case.
 Contact us →
# How this site handles your data — local tools, hosting logs and your rights.
URL: https://forgotwalletpassword.com/privacy-policy

Privacy Policy — ForgotWalletPassword.com
 Skip to content
 Privacy
 How this site handles your data.
 Short version: the tools run in your browser, the site never sees your wallet data, and the only personal data in play is hosting logs and email.
 The short version
 ForgotWalletPassword.com is an educational site about recovering forgotten crypto wallet passwords. The interactive parts of this site — the search, the token builder, the calculators and the quiz — run entirely in your browser. Your search terms, password fragments, token lists and wallet-related input never leave your device, and we cannot see them.
 This site does not ask for your seed phrase, private keys or wallet passwords — not in forms, not in email, not anywhere. If someone asks you for them while claiming to represent this site, they are an impersonator.
 Data controller
 ForgotWalletPassword.com is operated by Crypto Recovers, the Dutch sole proprietorship of Robbert Bink. For privacy questions, the data controller is:
 Crypto Recovers (Robbert Bink), KVK 75927276
 Le Mairekade 77, 1013 CB Amsterdam, The Netherlands
 support@cryptorecovers.com · cryptorecovers.com/imprint
 What this site collects
 Visiting this site involves very little data processing:
 Server logs. Like any website, the hosting and CDN providers record standard technical data when a page is requested — IP address, browser type, requested pages and timestamps — to keep the site secure, available and protected against abuse. These logs are kept only as long as needed, and no longer than 90 days unless required longer for security or legal reasons.
 Contact email. If you write to us through the contact page or the listed email addresses, we receive your message and contact details. We use them only to answer you and to process corrections or questions. Communication records are kept for up to 12 months after the conversation ends, unless longer retention is required by law or for dispute resolution.
 We do not set advertising or tracking cookies on this site and we do not run analytics scripts here. If that ever changes, this page will be updated first.
 What this site never sees
 The local features are local by design: the site search indexes the guides in your browser, the token builder composes a btcrecover tokens.txt on your machine, and the calculators compute in the browser. None of that input is transmitted to us and none of it is stored by us. This site also never receives wallet files, hashes or seed phrases.
 Legal basis
 Under the EU General Data Protection Regulation (GDPR) and the Dutch Data Protection Act (UAVG), the processing described above is based on:
 Legitimate interest for operating, securing and improving the site (server logs, abuse protection);
 Your request when you contact us with a question or correction;
 Consent wherever a specific processing requires it.
 Sharing
 We never sell personal data. Data is only shared with the processors needed to run the site — hosting and CDN providers, and the email provider used for correspondence — under their own data-processing obligations, and only when required by law. Links to third-party sites (tools, wallets, services) are outside this policy; their own policies apply there.
 Your rights
 If you are in the EU/EEA, you have the right to access, correct, delete or restrict the use of your personal data, to object to processing, to data portability and to withdraw consent at any time. You can exercise these rights by emailing support@cryptorecovers.com. You also have the right to lodge a complaint with your local data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.
 Recovery service data is separate
 This site is separate from Crypto Recovers’ recovery service. If you contact the service or become a client, its own privacy policy applies to that processing — including recovery files, identification data, payments and the service’s retention rules. Nothing you do on this site feeds into the service.
 Changes
 We may update this privacy policy when the site or its processing changes. Material changes will be reflected in the date above. The current version is dated 15 August 2026.
 Contact
 Privacy questions: contact us or email support@cryptorecovers.com. See also the disclaimer and the terms of use.
 Legal fine print
 Disclaimer
 Educational content only — what this site is, what it isn’t, and who is responsible.
 Read the disclaimer →
 Using this site
 Terms of use
 Acceptable use, no guarantees, intellectual property and liability.
 Read the terms →
 Get in touch
 Contact
 Corrections, questions and the right channel for a recovery case.
 Contact us →
# Electrum wallets — recoverable, but slower than you hope.
URL: https://forgotwalletpassword.com/electrum-wallet-password-recovery

Forgot Your Electrum Wallet Password? Recovery Guide
 Skip to content
 Wallet format · Bitcoin
 Electrum wallets — recoverable, but slower than you hope.
 Electrum is one of the oldest Bitcoin wallets, and its encrypted wallet files are recoverable with the right clues. But there is a twist: the part that matters most in Electrum is not the file — it is the seed phrase, and the two are recovered very differently.
 By Robbert Bink · ~4 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Electrum wallet passwords can be recovered when you have clues — but the encryption is deliberately slow, so realistic recovery depends on a human-chosen password and a good candidate list. And the single most important fact: if you still have your seed phrase, you do not need the password at all.
 Which wallets use this format?
 Electrum’s encrypted file format is shared by the whole Electrum family — each coin runs its own fork of the same client:
 Electrum for Bitcoin (the original)
 Electrum-LTC for Litecoin
 Electron-Cash for Bitcoin Cash
 Electrum-DASH for Dash
 Plus smaller forks (Electrum-GRS, Electrum-XVG and more)
 The encrypted keystore format introduced in Electrum 2.8 works the same across these clients — older 1.x–2.7 files use a different, weaker scheme (details below) — and so does the seed phrase, which can bypass the password entirely.
How Electrum encryption works
 Electrum 2.8+ wallets store an encrypted keystore protected by your password using a PBKDF2-based key derivation (older 1.x–2.7 files use a weaker double-SHA-256 scheme).
 The wallet file itself is a JSON-like structure; the password derives the key that unlocks the stored seed and keys.
 hashcat supports Electrum as modes 16600 (v1/2.x), 21700 and 21800 (2.8+) — the salt type in the hash picks the mode. Testing speed sits in the hundreds to low-thousands of guesses per second class on a high-end GPU, depending on salt type — slower than old wallet.dat, faster than Ethereum scrypt keystores.
 Modern Electrum versions and seed-derived wallets (type “standard”) can often be restored from the seed phrase alone, making the password mostly irrelevant — see below.
 The seed phrase changes everything
 Electrum’s default wallet derives all keys from a 12-word seed. That seed — not the wallet file — is the true backup:
 If you have the seed: restore it in the matching Electrum-family wallet for that coin and wallet type — Electrum for Bitcoin, Electron Cash for Bitcoin Cash, Electrum-LTC for Litecoin, and so on — and choose a new password. Do not assume a seed from one Electrum-family fork belongs in ordinary Bitcoin Electrum. Done — in normal cases. If old funds do not appear, check the wallet type, seed type and Electrum’s gap limit before assuming the seed or password is wrong. No cracking needed. If a password protects a wallet whose seed you know, the wallet can simply be recreated.
 If you have the seed but added an extra passphrase layer: you face the “25th word” problem — see what did you lose?
 If you have neither seed nor password: recovery means attacking the encrypted file itself, which is the slow path.
 Check your backups before you spend anything
 The single highest-value action for an Electrum user is the systematic search for the seed — the paper card, the note, the old backup. If the seed exists, the password problem evaporates.
 If you must attack the file
 Treat it like every other wallet file:
 1
 Back up read-onlyCopy the wallet file and keep the original untouched. The five moves come first.
 2
 Rebuild the candidate listYour memory of the password matters more than the hardware. The memory method generates the raw material.
 3
 Check feasibilityClues + human password = realistic. Random 16+ characters = not. The feasibility guide shows the arithmetic.
 4
 Run the tools yourselfTest your candidate list on a copy of the wallet file — the btcrecover walkthrough or the hashcat walkthrough (Electrum modes 16600 / 21700 / 21800) takes you through it. One exception: Electrum 2FA / TrustedCoin wallets are not covered by the standard btcrecover route — current btcrecover documentation excludes 2FA wallets, so identify the wallet type before following the generic commands.
 Related reading
 Frequently asked questions
 Is an Electrum wallet password recoverable?
 If you still have the 12-word seed, the password stops mattering — restore the wallet and set a new one. Without the seed, the encrypted wallet file itself is the target: it cracks offline, but Electrum’s key derivation is deliberately slow, so clues and a tight candidate list matter even more than usual.
 Which hashcat mode does Electrum use?
 Run electrum2john.py on a copy of the wallet file and let it detect the format — for fully encrypted wallets it processes the encrypted container (the base64 BIE1 prefix), not the JSON. The mode follows the generated $electrum$N prefix: 1/2/3 → 16600, 4 → 21700, 5 → 21800. The extractor ships with John the Ripper jumbo; btcrecover reads Electrum wallets directly.
 Does the seed phrase make the Electrum password irrelevant?
 Yes, if you have it: the seed recreates the wallet on any fresh install, so the old password no longer matters. The password only protects the local wallet file — which makes Electrum a seed-first wallet, and a file-attack case only when the seed is gone.
Sources & references
 Electrum — official wallet
 hashcat — example hashes (wallet formats & modes)
 Cite this page
 APA: Bink, R. (2026). Electrum wallets — recoverable, but slower than you hope. ForgotWalletPassword.com. https://forgotwalletpassword.com/electrum-wallet-password-recovery
 Markdown: [Electrum wallets — recoverable, but slower than you hope.](https://forgotwalletpassword.com/electrum-wallet-password-recovery)
 Guide · 04
 Is recovery technically possible?
 All wallet formats compared — speed classes and the line.
 Read the feasibility →
 Related format
 wallet.dat
 The classic Bitcoin wallet file — faster to test than Electrum.
 wallet.dat guide →
 Start here
 What did you lose?
 Password, seed, PIN or passphrase — which one is actually blocking you?
 Find out →
 Overview
 Which wallet passwords can be recovered?
 Electrum’s row — and every other wallet — in one searchable table.
 See the master list →
# Ethereum keystore files — the slowest, most secure wallets to crack.
URL: https://forgotwalletpassword.com/ethereum-keystore-password-recovery

Forgot Your Ethereum Keystore Password? UTC JSON Files
 Skip to content
 Wallet format · Ethereum
 Ethereum keystore files — among the slower wallet types to crack.
 Those long files named UTC--2020-06-01T… are encrypted Ethereum keystores from geth, MyCrypto, MyEtherWallet and the EVM wallets that use the standard format. They are among the harder wallet types to brute-force — which makes your clues worth more. (MetaMask has its own vault format — covered separately.)
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Ethereum keystore passwords are recoverable when you have real clues — but the format is among the slower common wallet types, so raw brute force is a non-starter. The password is stretched with scrypt (commonly N=262,144 in geth-generated files) or PBKDF2 (iteration count stored in the file) before AES-128-CTR decryption. Around a hundred guesses per second on the reference CPU, not millions.
 Which wallets use this format?
 The UTC--* keystore JSON is a standard Ethereum software-wallet export format used by tools such as geth, MyEtherWallet, MyCrypto and some legacy Ethereum wallets. Many modern wallets instead use seed phrases, browser vaults or hardware-wallet flows, so do not assume every Ethereum wallet can produce or open a keystore JSON. Tools that do:
 Create/export V3 keystores: geth / OpenEthereum (command-line nodes), MyEtherWallet (MEW), MyCrypto, Mist, Parity and older tools; hardware-wallet companion apps vary — check whether yours supports keystore import/export
 Can import an existing V3 JSON, but do not create it natively: MetaMask — via “Import account with JSON file”; the JSON password decrypts that file during import and is not the same as the MetaMask wallet password. After import, keep the original JSON file / private key backed up separately: imported accounts need their own recovery material, and MetaMask’s ordinary account export is a private key
 Wallets that create the format write the same scrypt or PBKDF2 keystore JSON, so one guide covers them; wallets that only import an existing JSON use that file’s own password.
How the keystore format works
 The UTC--* JSON file is self-describing: it literally contains its own parameters in the crypto field.
 crypto.kdfscrypt (default in most tools) or pbkdf2. Tells you which derivation was used.
 scrypt paramsDefault N=262144, r=8, p=1 — a deliberately memory-hard and slow setting. Lower N (older or non-default) = faster to test = easier.
 PBKDF2PBKDF2-HMAC-SHA256 — the iteration count is stored in the file’s kdfparams (c); Web3 Secret Storage does not prescribe a universal value.
 crypto.cipherUsually aes-128-ctr. The password-derived key decrypts the stored private key.
 After converting the JSON with ethereum2john.py (which produces the $ethereum$p*…/$ethereum$s*… line), hashcat cracks these as mode 15600 (PBKDF2) and mode 15700 (scrypt). Both are among the slower formats on this site — the scrypt variant is memory-hard, and the PBKDF2 variant’s speed depends on the stored iteration count.
 Why this matters for your case
 Slower format means better clues are mandatory. A human-chosen password with fragments and patterns is still realistic. A long random password is not — the maths is the maths.
 The address in the filename helps verify. The keystore’s address helps identify the case and acts as the success target — the address alone is not proof of ownership.
 Check the KDF parameters. If your file used low scrypt params (e.g. N=8192 or N=262144 are common, but some old tools used less), your case is faster than average. Reading crypto.kdfparams.n in a text editor tells you instantly.
 Never paste keystore JSON into a website
 Keystore files are meant to be uploaded to wallets — which is exactly why they are prime phishing bait. Never paste your keystore JSON into a “checker”, “decryptor” or “validator” website. Work offline, on a copy, with tools from official sources.
 Your next steps
 1
 Back up the file read-onlyCopy it to two safe places before touching anything — the protection guide.
 2
 Read the KDF parametersOpen the JSON and note kdf and its parameters. That single line changes the feasibility estimate — the format table explains how.
 3
 Rebuild the candidate listFragments, patterns, reused words — the memory method. This matters more than any GPU.
 4
 Run the tools yourselfTest your candidate list on a copy of the keystore file — the btcrecover walkthrough and the hashcat walkthrough (modes 15600/15700) cover it step by step.
 Related reading
 Frequently asked questions
 What exactly is the UTC-- JSON file?
 It is the standard Web3 Secret Storage keystore: your private key encrypted with your password, stored as a file like UTC--2021-01-01T00-00-00.000Z--address.json. It is what geth, MyEtherWallet and MyCrypto create, and it is the file you work with for recovery.
 Why is an Ethereum keystore so slow to crack?
 Ethereum keystore files are self-describing: read the actual kdf and kdfparams values from the JSON. Geth commonly uses scrypt with N=262,144, but Web3 Secret Storage does not prescribe a universal PBKDF2 iteration count — for PBKDF2, use the file’s c value. scrypt is memory-hard — the measured reference run is roughly 96 guesses per second on the 9950X CPU, versus hundreds for a wallet.dat.
 Old keystores vs new ones — same password, different odds?
 Yes, and sometimes dramatically. Early tools used much weaker derivation settings, so a 2016-era keystore can be searched orders of magnitude faster than a current one. Read the kdfparams in your file, then run the calculator with real numbers.
 Sources & references
 ethereum.org — Web3 Secret Storage (keystore specification)
 hashcat — example hashes (wallet formats & modes)
 Cite this page
 APA: Bink, R. (2026). Ethereum keystore files — among the slower wallet types to crack. ForgotWalletPassword.com. https://forgotwalletpassword.com/ethereum-keystore-password-recovery
 Markdown: [Ethereum keystore files — among the slower wallet types to crack.](https://forgotwalletpassword.com/ethereum-keystore-password-recovery)
 Guide · 04
 Is recovery technically possible?
 Every wallet format’s speed class — and where keystores rank.
 Read the feasibility →
 Related format
 BIP38 paper wallets
 The other scrypt-based format — encrypted private keys starting with “6P”.
 BIP38 guide →
 Overview
 Which wallet passwords can be recovered?
 The keystore’s verdict — and every other wallet — in one table.
 See the master list →
# Forgot your Exodus password? The 12-word seed restores it — and seed.seco can be cracked offline.
URL: https://forgotwalletpassword.com/exodus-wallet-password-recovery

Forgot Your Exodus Password? Seed vs seed.seco
 Skip to content
 Wallet guide · Exodus · seed.seco
 Forgot your Exodus wallet password? The seed is the key — the file can also be cracked.
 Exodus is one of the most popular desktop wallets, and its password question is usually a misunderstanding: the password only locks the local wallet file (seed.seco). If you have the 12-word recovery phrase, the password becomes irrelevant. If you don’t — check Exodus’s other recovery sources first (synced device, email backup, passkey + cloud), and only then treat the protected file itself as the offline target. This page explains both paths plainly.
 By Robbert Bink · ~5 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The headline
 Exodus’s password is a local lock on the wallet file — the real key is the 12-word recovery phrase. With the seed, the password becomes irrelevant. If the seed is gone too, check Exodus’s other recovery sources below first; only when those are ruled out does the protected seed.seco file become the offline target with hashcat (mode 28200) — scrypt makes each guess more expensive than simple hash formats, but hashcat’s mode 28200 still reaches thousands of guesses per second on modern GPUs, so benchmark your actual hardware; only a human-chosen password with clues is realistic.
 What the Exodus password actually protects
 Exodus Desktop stores your wallet in a local file called seed.seco, encrypted with a password you choose, and hashcat mode 28200 may apply to it. The mobile apps protect a local vault as well, but do not assume the same file or extractor route — the documented recovery path for a forgotten mobile passcode or device unlock is Exodus’s official 12-word recovery phrase or passkey restore. In both cases the password is a lock on the device — it is not what creates your addresses. That role belongs to the 12-word recovery phrase, which Exodus generates once and displays at setup. The password and the phrase are different layers: password vs seed phrase explains the difference in full.
 The fast path: restore with the seed
 If you still have the 12 words (paper backup, password manager, an old screenshot), the forgotten password never matters: restore Exodus with the phrase on a fresh install, set a new password, and the wallet rebuilds itself. That is the real answer in most real Exodus cases — the password question collapses as soon as the seed exists. Where old passwords hide and the 68-place search checklist are where most people find that seed or the password itself.
Before seed.seco: check these recovery sources first
 “No seed” does not automatically mean “crack only”. Depending on how the wallet was set up, Exodus documents several official recovery paths that do not involve cracking anything — worth checking before you invest in an offline attack:
 A synced Exodus device. If the wallet still opens on another phone, tablet or computer where you are signed in, unlock it there and note the 12 words or move the funds — no cracking needed.
 The pre-February-2019 email backup. Wallets created before Exodus removed the email-backup option may have a backup of the recovery phrase in the inbox used at setup.
 Passkey + iCloud / Google Drive backup (mobile). Exodus Mobile offers passkey-based restore and cloud backups on some platforms — check whether that route exists before treating the case as crack-only.
 Archived data from an overwritten wallet. Exodus keeps archives of replaced wallets in some Desktop/Mobile flows — a previous wallet may still be recoverable from the app’s archived data.
 These are “worth checking” paths, not guarantees — but they can restore access without a crack, so rule them out first. If none of them exist, the local password-protected file is the target below.
If none of those exist: cracking seed.seco
 Without the seed — and after ruling out the recovery sources above — the remaining target is the password-protected seed.seco file. The workflow is the same as for every encrypted wallet on this site:
 1Protect the fileWork on a read-only copy, offline, on a machine you trust. Never upload seed.seco to a public checker or unknown website — it contains your wallet. The protection rules apply.
 2Extract the hash lineRun exodus2hashcat.py (ships in the official hashcat tools folder) on your copy. It produces the one-line hash that mode 28200 tests — no private keys ever leave your machine.
 3Build the attack from memoryExodus passwords are human-made: names, dates, phrases, patterns. Turn every fragment into a candidate list with the hint-list method, then run it with hashcat mode 28200 using a wordlist with rules or a mask.
 4Let the math decideExodus uses scrypt, so each guess costs more than with simple hash formats — but hashcat mode 28200 has a working GPU implementation: published benchmarks on high-end cards report roughly 5,000–10,000 guesses per second. Real speeds vary substantially by hardware, so benchmark your own machine instead of assuming CPU-like speeds. Check your specific odds with the strength calculator and the feasibility guide before investing weeks.
 Never upload seed.seco — and never share the 12 words
 The file holds your wallet, and the phrase can empty it. A legitimate recovery process should never ask for your seed phrase or private keys; the encrypted file or an extracted hash may be used for local/offline password testing, but never uploaded to public checkers or sent to unknown parties.
 Frequently asked questions
 Does Exodus have a password?
 Yes — Exodus Desktop protects its local wallet file (seed.seco) with a password you choose, and the mobile apps protect their local vault as well. On mobile, the documented recovery path for a forgotten passcode or device unlock is Exodus’s official 12-word recovery phrase or passkey restore, not a seed.seco-style file attack. It is a local lock; the wallet itself is secured by the 12-word recovery phrase.
 Can an Exodus wallet password be cracked?
 After ruling out Exodus’s other recovery paths — a synced Exodus device, the pre-February-2019 email backup, a passkey + iCloud/Google Drive backup, or archived wallet data — the protected seed.seco file can be attacked offline with hashcat mode 28200 after extraction with exodus2hashcat.py. The key derivation is scrypt — memory-hard, so each guess costs more than with simple hash formats. Hashcat’s mode 28200 still provides thousands of guesses per second on modern GPUs (published benchmarks roughly 5,000–10,000/s on high-end cards); exact speed varies by hardware, so benchmark your own machine. Human-chosen passwords with clues are realistic; long random ones are not, for anyone.
 Do I need the password if I have the seed phrase?
 No. Restoring Exodus with the 12-word recovery phrase rebuilds the wallet without the password — the password only locks the local file on the device where you set it. If you have the seed, the password question is moot.
 Sources & references
 hashcat — example hashes (mode 28200, official)
 hashcat — official tools (exodus2hashcat.py)
 Exodus — official site and downloads
 Cite this page
 APA: Bink, R. (2026). Forgot your Exodus wallet password? The seed is the key — the file can also be cracked. ForgotWalletPassword.com. https://forgotwalletpassword.com/exodus-wallet-password-recovery
 Markdown: [Forgot your Exodus wallet password? The seed is the key — the file can also be cracked.](https://forgotwalletpassword.com/exodus-wallet-password-recovery)
 Every wallet
 The master list
 Exodus and every other crackable or resettable wallet in one searchable table — with the tool for each.
 Open the master list →
 The tool
 hashcat step by step
 Modes, masks and wordlists — the full walkthrough, including mode 28200 for Exodus.
 Read the hashcat guide →
 The distinction
 Password vs seed phrase
 Which layer did you actually lose? The answer decides whether this is even a password problem.
 Check what you lost →
 Same model
 MetaMask vault vs seed
 Another wallet where the password locks the device and the phrase is the real key.
 Read the MetaMask guide →
# Wallet password recovery — the questions everyone asks.
URL: https://forgotwalletpassword.com/faq

Crypto Wallet Password Recovery FAQ — Straight Answers
 Skip to content
 Quick answers
 Wallet password recovery — the questions everyone asks.
 Straight answers, each one linked to the guide that goes deeper.
 Short answer
 Usually, yes — if the password was human-chosen and you still have clues. Recovery tests candidate passwords against an encrypted wallet file, keystore, hash/extract or known target address — a seed phrase itself is not cracked like a wallet password. If you still have the seed phrase, you usually restore the wallet in compatible software; only an additional seed passphrase is tested separately. The three deciding factors are what you remember, the wallet format, and whether the password was random. A random 16-character password is effectively impossible; a human-chosen one with hints is often realistic.
 Each question below links to the guide that covers it in depth.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 I forgot my wallet password — can it be recovered?
 Usually yes, if the password was human-chosen and you have clues. Recovery works by testing candidate passwords against the encrypted wallet file. Three factors decide the outcome: what you remember, the wallet format, and whether the password was random. A random 16-character password is effectively impossible to brute-force; a human-chosen one with hints is often realistic.
 Start with the quick diagnosis, then follow where old passwords hide and the feasibility guide. For a one-glance verdict on your specific wallet — reset, crackable, or impossible — see the master list of recoverable wallet passwords. When you’re ready to run the recovery yourself, the complete DIY route — protect, find, rebuild clues, run the tool — is on one page: recover a wallet password yourself.
 What is the difference between a wallet password and a seed phrase?
 A wallet password unlocks an encrypted wallet file on your device. A seed phrase (recovery phrase, commonly 12/18/24 words) is the master backup for the accounts and keys derived from that phrase — imported private keys, hardware-wallet accounts, additional recovery phrases and some legacy wallet data may need separate backups. If you still have the seed phrase, you can usually restore the seed-derived accounts in a compatible wallet that supports the same recovery standard and derivation scheme, and choose a new password. If you only lost the password but still have the file, the keys still exist inside it — targeted recovery is possible.
 A seed phrase is not just another password. Never type it into this website, a form, an email, or any unknown tool — whoever receives it can recreate the wallet and move the funds.
 PINs and extra passphrases are two more distinct cases. See what did you actually lose?
 Does my wallet provider know my password?
 For a self-custody wallet, no. The wallet software stores an encrypted file on your device; the password is only ever used locally, and no company has a copy or a reset button. That’s exactly why a forgotten password is a recovery problem rather than a reset.
 For a custodial account (an exchange), the provider holds the keys and can reset your login after identity verification — see exchange & custodial wallets.
 What should I never send to a wallet password recovery service?
 Your seed phrase, private keys and wallet password. Never send them to a recovery provider, website or helper — those values alone can move the funds. Legitimate recovery runs with local, offline, verified tools on your own machine; such tools may ask you to enter this material locally, which is completely different from sharing it.
 How long does it take to crack a wallet password?
 It depends almost entirely on clues and format. With strong clues and a human password: hours to a few weeks of GPU time. With a random password: effectively forever. Formats also differ hugely — old wallet.dat files run hundreds of guesses per second on a CPU (thousands with a GPU), while Ethereum scrypt keystores run at only around a hundred.
 See the full speed table in is recovery technically possible?
 Can a lost seed phrase be recovered?
 Not on this site. A completely lost seed phrase cannot be rebuilt from nothing — but access may still be recoverable if another key-bearing backup, wallet file or functioning device survives (for example an encrypted vault with its password). Reconstructing missing or reordered words is a specialist matter this site deliberately leaves out.
 Before concluding it is gone, run the 30-minute sweep: paper, notes, photos, email, password managers, old devices. If your seed words are intact but you forgot the passphrase layered on top (the 25th/13th word), that is a password problem — and one of the most recoverable there is.
 I forgot my wallet password and I have no seed phrase — can it still be recovered?
 Sometimes — the wallet file is a second door. If the password-encrypted wallet file still exists, the password can be tested against it offline with btcrecover, hashcat or John the Ripper. A human-made password with genuine clues is often realistic; a long random one is not — the math is on the feasibility page.
 Some wallets also have their own no-file routes to check first — for example, the Blockchain.com mobile app can create an encrypted iCloud/Google Drive backup that restores the wallet on the same OS/cloud account with your PIN. If the seed is gone and the file is gone, there is nothing to test and recovery is not possible — see recovery without the wallet file for the rare exceptions. For your exact wallet, the master list gives the verdict in one glance.
 What is the 25th word / BIP39 passphrase?
 An optional extra passphrase layered on your seed creates a hidden wallet: the same 12–24 words with a different passphrase derive completely different keys. If you forgot it, the seed alone opens a different, empty wallet.
 Good news: passphrases are almost always human-chosen — which makes them one of the most recoverable types when you reconstruct your own habits. The memory method is built for exactly this.
 What are BIP38 paper wallets and can they be recovered?
 A BIP38 paper wallet is a Bitcoin private key encrypted with a password and printed, usually as a string starting with 6P. The encrypted string is the wallet — there is no backup file.
 Recovery is possible if you can reconstruct the password: scrypt-based encryption runs at only tens of guesses per second, so human-chosen passphrases with clues are realistic, while long random ones are not. The BIP38 guide has the details.
 What should I do immediately after forgetting my wallet password?
 Five things, in order:
 Make read-only backup copies of the wallet file.
 Write down everything you remember about the password.
 Note the wallet type and version.
 Note the wallet address and last activity.
 Check your password managers and notes for a stored copy — and if the manager’s own password is gone, recover the manager.
 Do not reinstall the wallet, wipe the device, upload files to public checkers or unknown websites, or share your seed phrase with anyone. The five-move guide explains why each step matters.
 I recovered the password — what now?
 Verify the wallet opens and the balance matches what you expect, then move the funds to a maintained wallet using official software only — and note the balance before you transfer so you can spot problems immediately.
 Never lose access covers the storage rule.
 Can a wallet password be recovered without the wallet file?
 No — and the reason is technical: a candidate password is usually tested against an encrypted file, so without the file there is usually nothing to test. The real exceptions are not cracking: a seed phrase restores the wallet, a custodial account resets via KYC, a brain wallet has no file by design, and a BIP38 6P… encrypted private key is itself the test target. What still works without the file
 Do I need a GPU to crack a wallet password?
 No — the tools run on any machine, and CPU-only recovery is realistic for the slower formats and for small candidate lists. A GPU mainly makes fast formats dramatically faster. See the measured speeds to judge your own case before you buy anything.
 Are wallet recovery services safe to use?
 Treat them as dangerous until proven otherwise. Legitimate professionals run the same free tools offline on your copy; scammers ask for your file, your seed, upfront payment or remote access. Run the red-flag checklist first, and check the reported-services list — never share your seed phrase with anyone, ever.
 What happens if I enter the wrong wallet password too many times?
 It depends on the wallet. Hardware wallets wipe themselves after a small number of wrong PIN attempts (the PIN is not the backup — the seed is). Most software wallets do not permanently lock from wrong passwords, but some apps throttle or time you out, and exchanges lock after repeated failures. The rule is the same everywhere: test your candidate list on a copy, never on the original — the prevention guide explains the layers.
 Is it legal to recover my own wallet password?
 In general, recovering access to your own wallet, your own files and your own machine is a legitimate access-recovery activity. Laws and authorization requirements can vary by country and situation, and this site is not a source of legal advice — never use these tools on someone else’s wallet or device without explicit legal authority. This site’s scope is your own access recovery only.
 Not sure where you stand?
 Run the quick diagnosis
 Get a first verdict on your exact situation in under a minute.
 Start the diagnosis →
 Go deeper
 Is recovery technically possible?
 The full feasibility equation — every format, every speed class.
 Read the feasibility →
# The first 24 hours — do these in order, calmly.
URL: https://forgotwalletpassword.com/first-24-hours

The First 24 Hours After Forgetting Your Wallet Password
 Skip to content
 Guide 04
 The first 24 hours — a calm order, not a countdown.
 The password is gone, but the money is still on the blockchain and the file is still on your disk — nothing is lost yet. There is usually no blockchain countdown: the same steps work whether you start today, tomorrow or next week — but data-retention countdowns exist. Cloud trash, recently deleted photos/files, email trash, backup retention and SSD behavior can be time-sensitive, so freeze the device and check recoverable-trash and backup-retention windows promptly. This page is simply the most efficient order, so you never have to wonder what to do next.
 By Robbert Bink · ~4 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 The one-sentence plan
 Do not touch anything. Back up the wallet file read-only. Write down every clue you remember. Then search, rebuild, and only then decide. The cases that become unrecoverable do so through specific mistakes — reinstalls, wipes, repeated guesses, or paying the wrong person — not through the passage of time. Avoid those mistakes whenever you start.
 Step 1 · Freeze everything
 1
 Stop using the wallet appClose it. Some wallets migrate or rewrite files on update or shutdown. Until you know what you are doing, the app stays closed.
 2
 Do not guessA handful of careful attempts is fine. Repeated guessing is dangerous on hardware wallets and self-wiping devices, which can wipe after a small number of failures. For wallet files, do not hammer the live app or the original file — make a forensic copy and test offline against the copy.
 3
 Do not reinstall, wipe, or “fix” anythingNo disk clean-up tools, no reformats, no “repair” software. Deleted ≠ gone, but only while the disk stays untouched — and on a modern SSD with TRIM, deleted data can become unrecoverable quickly even without obvious overwriting. If the only copy may have been deleted from an SSD, stop using the device immediately, avoid rebooting or installing recovery tools on it, and image the drive or get specialist help before experimenting.
 4
 Do not pay anyone or share your seedInstant recovery for a fee is not how this works — legitimate recovery is an offline process.
 Step 2 · Secure the evidence
 This step protects everything else you still have. Full instructions in protect your wallet files, but the essence:
 1
 Copy the wallet file read-onlyFind the file (.dat, .json, or whatever your wallet uses — not sure? identify it here) and copy it to a USB stick and a second device. Mark both read-only.
 2
 Write down the wallet detailsApp name, version, file extension, when you installed it, the wallet address with the funds. This identifies your case and feeds the feasibility math — it helps, but never proves ownership on its own.
 3
 Write down every clueLength, characters, words, dates, patterns, other passwords from that era. Memory decays fastest under stress — write it down while it’s fresh, on paper or in a password journal.
 Step 3 · Search, rebuild, assess
 Step
 What to do
 Guide
 1
 Run the 30-minute sweep: password managers, browsers, notes, email, old devices, backups, photos. Then, if nothing turns up, work the full 68-place checklist.
 Where old passwords hide
 2
 Rebuild the password from habits: base word, number, symbol, capitalisation rule, substitutions.
 How your memory made it
 3
 Identify the exact wallet format and version — it decides the encryption speed and your odds.
 Which wallet file do you have?
 4
 Read the feasibility equation — format, memory, randomness.
 Is recovery technically possible?
 5
 Decide: test your own candidate list offline, or work the feasibility math and the search checklist first.
 The mistakes that end recoverable cases
 Reinstalling the wallet before backing it up. Wiping the device “to start fresh”. Typing hundreds of guesses into the real app until it locks. Uploading the file to an online “decryptor”. Paying a stranger who “found your funds”. Sending your seed phrase to anyone. Each of these converts a possible recovery into an impossible one — and all of them are avoidable.
 Starting later — the same steps apply
 If the search and memory work came up empty, your case moves to the feasibility stage: is your wallet type technically recoverable with the clues you have? The answer decides whether running offline tools yourself is worth the time — and when it is, the complete DIY route takes you from file to password. If you are contacted out of the blue about your case, treat it with caution. Meanwhile, if you haven’t yet: set up the backups that make this the last time it ever happens.
 The foundation
 Protect your wallet files
 The five moves that keep your case recoverable — step one, in detail.
 Secure the evidence →
 Next resource
 Which wallet file do you have?
 Identify your wallet by file extension and app — then jump to the right specialist page.
 Identify the format →
 Not sure yet?
 Run the quick diagnosis
 Get a first verdict on your exact situation in under a minute.
 Start the diagnosis →
 The bigger picture
 Which wallet passwords can be recovered?
 The full table behind your first moves — every wallet, one verdict.
 See the master list →
# Every wallet term on this site, explained like you are not a developer.
URL: https://forgotwalletpassword.com/glossary

Crypto Wallet Password Recovery — Plain-English Glossary
 Skip to content
 Resource · plain English
 Every wallet term on this site, explained like you are not a developer.
 Half of recovery confusion is vocabulary: people hunt for a “password” when they lost a “passphrase”, or fear “brute force” without knowing what it costs. This glossary defines the terms — and links every one to the guide that uses it.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Wallet fundamentals
 Seed phrase (recovery phrase)The master backup for the accounts and keys derived from that phrase. Commonly 12/18/24 words (BIP39); other schemes use other lengths (e.g. Monero 25). Lose it completely and seed-derived accounts can never be recreated — imported private keys, hardware-wallet accounts and some legacy wallet data may need separate backups. Full guide · the passphrase on top
 Wallet passwordUnlocks an encrypted wallet file on your device (e.g. wallet.dat, a keystore). Different problem from a lost seed. What did you lose?
 PassphraseAn optional extra phrase layered on a seed, creating a hidden wallet. It can be any string; on a BIP39 seed it is sometimes called the 13th/25th word. Same seed + different passphrase = different wallet. Explained
 Private keyThe secret number that proves ownership of a wallet address. A seed phrase is a compact backup of many private keys. Password vs seed phrase
 Wallet addressThe public identifier others use to send you funds — useful when checking a recovery case, but an address alone does not prove ownership. Write it down
 PINA short device code on hardware wallets. It never leaves the device; forgetting it means restoring from the seed. Four doors explained
 Paper walletA private key printed on paper, often BIP38-encrypted (6P…). The paper itself is the wallet. BIP38 guide
 Brain walletA wallet with no file: the private key is derived directly from a passphrase you memorised (SHA-256 on bitaddress.org-style tools, scrypt on WarpWallet/Memwallet). Forgetting the passphrase means reconstructing it. Recovery deep-dive
 Hardware walletA dedicated device (Ledger, Trezor, Coldcard…) that keeps keys offline. Its PIN is temporary; its seed is the backup. Prevention guide
 Standards & file types
 BIP39The standard that turns 128–256 bits of randomness into a 12/15/18/21/24-word seed phrase, drawn from a fixed 2048-word list with a built-in checksum. the passphrase (25th word)
 BIP32 / HD walletHierarchical deterministic wallets: one seed derives an unlimited tree of addresses. Why one seed backs up everything. The master-backup rule
 BIP38A standard for password-encrypting a private key so it can be printed safely — the 6P… strings. Recovery deep-dive
 wallet.datThe wallet file of Bitcoin Core and classic Bitcoin desktop clients — iterated SHA-512 encryption (OpenSSL EVP_BytesToKey), hashcat mode 11300. Recovery deep-dive
 Ethereum keystore / UTC JSONThe UTC--*.json files of geth, MyCrypto, MyEtherWallet — scrypt or PBKDF2 plus AES-128-CTR. Recovery deep-dive
 Electrum wallet fileThe encrypted keystore of the Electrum Bitcoin wallet — PBKDF2-based from 2.8+ (older files use double SHA-256); hashcat modes 16600/21700/21800 (by salt type). Recovery deep-dive
 Monero wallet file (.keys)The encrypted wallet file of Monero’s official wallets — ChaCha20 (ChaCha8 in older versions) with a CryptoNight-based key derivation. Not supported by one-command tools like btcrecover; only specialist tools like John the Ripper document it. The seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — restores the wallet without the password. Full Monero guide · Identify your wallet
 Armory wallet (armory.wallet)The wallet file of the legacy Armory Bitcoin client — AES-256-CFB with a memory-hard ROMix-SHA-512 KDF and hardware-tuned rounds. There is no hashcat mode. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py) — a compatible extraction step is still required, and the format remains slow (tens of thousands of candidates per hour at best), so only strong clues make cracking realistic; the Armory paper backup (its own Root Key / chain-code format, not a BIP39 12-word phrase) is the fastest restore path. Never lose access
 Phantom walletTraditional Phantom wallets use a 12-word recovery phrase. Phantom also supports Google/Apple account-based wallets: those recover on a new device with the same Google/Apple account plus the PIN you set, and a recovery phrase can be exported only while you still have access — if you are logged out everywhere without a backup, the account access and PIN are the critical material. Imported private keys and recovery phrases need their own backups before any reset. Seed phrase passphrase guide
 Encryption & cracking
 KDF (key derivation function)The deliberately slow function (PBKDF2, scrypt, or wallet.dat’s repeated-SHA-512 scheme) that turns a password into a decryption key. Its speed sets the whole feasibility question. The speed table
 PBKDF2A key-derivation function with a tunable iteration count — 1,024 (Electrum) up to hundreds of thousands, for example 600,000–900,000 in newer MetaMask vaults (read the stored value). More iterations = slower attacks. Feasibility
 scryptA memory-hard KDF (Ethereum keystores store scrypt or PBKDF2 parameters in the JSON under kdfparams — geth-style keystores commonly use N=262144, r=8, p=1, but other wallets or libraries may differ; BIP38 uses N=16384, r=8, p=8) — even slower per guess on GPUs. Keystore guide · BIP38 guide
 AESThe symmetric cipher used after the KDF step — AES-256-CBC in wallet.dat, AES-128-CTR in Ethereum keystores. wallet.dat · keystore
 EntropyHow much randomness a password contains — the real measure of how hard it is to guess. Human passwords have low entropy; 16 random characters have very high. The equation
 Brute forceTrying every possible password. Only realistic when the search space is small — i.e. when you have clues. Feasibility
 MaskA structural template for guessing, e.g. ?u?l?l?l?d?d?d (capital + 3 letters + 3 digits) — how tools shrink the search space with structure. Built from your habits
 Token fileA list of candidate words/fragments fed to a recovery tool — your memory work turned into input. The candidate list
 Hash lineThe small extracted line tools crack instead of the wallet file itself: salt + KDF parameters + a verification value. It is not normally a plaintext private key, but it can contain highly sensitive encrypted wallet material — treat it as sensitive as the wallet file. wallet.dat becomes $bitcoin$…; Ethereum keystores are converted with ethereum2john.py. hashcat walkthrough · John walkthrough
 hashcatA GPU-accelerated password recovery tool with wallet-specific modes (11300, 15600/15700, 16600/21700/21800). The modes table
 btcrecoverThe open-source tool purpose-built for wallet.dat and related Bitcoin-era wallets — free, offline, well documented. wallet.dat guide
 GPUGraphics hardware repurposed for parallel guessing. Fast — but the wallet’s KDF decides how many guesses per second it actually gets. Feasibility
 Terms are doorways here
 Every definition above links to the guide that explains it in context. If a term confused you, click its link — the answer is one page away. And if you are unsure which term describes your situation, run the diagnosis.
 Cite this page
 APA: Bink, R. (2026). Every wallet term on this site, explained like you are not a developer. ForgotWalletPassword.com. https://forgotwalletpassword.com/glossary
 Markdown: [Every wallet term on this site, explained like you are not a developer.](https://forgotwalletpassword.com/glossary)
 The technical core
 Is recovery technically possible?
 KDFs, iteration counts, speed classes — the arithmetic behind every term here.
 Read the feasibility →
 Identification
 Which wallet file do you have?
 Match your extension to the right specialist guide.
 Identify the format →
 Questions
 Frequently asked questions
 The questions people actually ask — answered plainly.
 Open the FAQ →
 The bigger picture
 Which wallet passwords can be recovered?
 Every term meets its wallet: the master list in one searchable table.
 See the master list →
# Changelog — what changed on this site, and when
URL: https://forgotwalletpassword.com/changelog

Changelog — what changed on this site, and when
 Skip to content
 Transparency · dated · verifiable
 Changelog — what changed on this site, and when
 Every substantive change below is dated and was verified before it went live. Corrections are listed the same way as additions — this site is only as trustworthy as its willingness to show its work.
 By Robbert Bink · ~2 min read · Published 13 August 2026 · Last reviewed: 16 August 2026
 How to read this page
 This log lists changes that affect what you read or use: new pages and guides, new tools and widgets, factual corrections, and structural fixes that change how the site works. Small wording tweaks and formatting-only changes are not logged here. Every entry below was verified before going live — the same checks (structure, links, schema, search index, contrast and mobile layout) run before anything ships.
 Corrections are listed as prominently as additions on purpose. If a claim on the site changes, the old claim was wrong or misleading, and the correction is part of the record. The "last reviewed" date on each page shows the last time that page went through the full check.
 Pages are organised for clarity over hype: the diagnosis quiz stops early when the answer is already clear, the master list shows the verdict for every wallet in one glance, and pages that cannot help you say so instead of sending you down a tool path. If a page changes because a tool or format changed, the page and its sources update together.
 16 August 2026
 Corrected (source link, launch prep): the “should you pay a wallet recovery service?” page’s UK fraud-reporting link pointed to the former Action Fraud site — Action Fraud was replaced by the national Report Fraud service (City of London Police, since 4 December 2025), so the sources list now links https://www.reportfraud.police.uk/ (“UK Report Fraud — report a fraud”) and the report-to-your-local-authority step now names Report Fraud instead of Action Fraud (EN + NL).
 Changed (diagnosis quiz): the quiz no longer asks whether you shared your seed phrase with a website or a person — the question and its “Stop — your seed phrase may be compromised” verdict are removed. The flow is now password → file → memory → how-it-was-created, and passphrase → memory → how-it-was-created (EN + NL).
 15 August 2026
 Corrected (7 points from a new deep re-audit): (1) Dogechain.info now has its own master-list row — it is not the bitcoinj scrypt family: it uses PBKDF2-HMAC-SHA256 + AES with parameters/version stored in the wallet data, btcrecover reads the export directly, and hashcat mode 32500 covers the applicable/older format while newer payload variants (e.g. AES-GCM) may differ, so identify the wallet format first (EN + NL). (2) keplr2john.py is now consistently scoped to the legacy Keplr extension format on the file-finder, John walkthrough, old-phone guide and cheat sheet — the master list already had the v2 caveat (EN + NL). (3) the Electrum troubleshooting entry no longer tells you to confirm use_encryption in the raw JSON of a fully encrypted 2.8+ wallet — for fully encrypted files, identify the BIE1/BIE2 encrypted storage format or let the current extractor detect it, because the wallet JSON only becomes readable after decryption (EN + NL). (4) the encrypted-drive table now lists BestCrypt separately with hashcat 23900 (v3) / 24000 (v4) alongside bestcrypt2john, instead of presenting BestCrypt as John-only (EN + NL). (5) MetaMask mode 26620 is no longer called a community-only build — current/development hashcat includes 26620 and 26630 with dynamic iteration counts; the walkthrough mode table, extraction table and JSON-LD now list 26600/26610/26620/26630 with "check the installed version" (EN + NL). (6) Blockchain.com: very early legacy V0 wallets are now called out as a separate algorithm — hashcat mode 34700 (Blockchain, My Wallet, Legacy Wallets) is added to the master list, hashcat walkthrough, offline-tools mode table, cheat sheet, convert page and Blockchain.com guide, and 12700 is no longer labelled "original/v0" (EN + NL). (7) the "a wrong variant can open a different, empty wallet" warning is removed from the hashcat, John and btcrecover password-found steps — it is a seed-passphrase phenomenon (still kept on the BIP39 passphrase pages), not a verified encrypted-wallet password result (EN + NL).
 Corrected (7 points from a deep re-audit): (1) tezos2john.py is no longer described as a generic extractor for password-protected Tezos client key files — it is the Tezos ICO/fundraiser route (15-word mnemonic, fundraiser email, tz1 address), now stated on the file identifier, file-finder and John the Ripper walkthrough (the master list already had it) (EN + NL). (2) fork wallets no longer share "exactly the same wallet.dat format" as a blanket claim — the Core-derived clients share Bitcoin Core's legacy wallet encryption, but the filename does not tell you which database backend is inside (legacy Berkeley DB vs modern SQLite descriptor wallets, and forks differ), now on the fork guide, wallet.dat guide and file identifier (EN + NL). (3) the master list's security-model taxonomy now splits "Seed-based" from "Passphrase-as-key" — BIP38 encrypted private keys and brain wallets are no longer lumped into a "restore the phrase or key and the forgotten password stops mattering" category, because the passphrase itself is the recovery target (EN + NL). (4) the "recovery without the wallet file" flow and FAQ now list BIP38 encrypted private keys as a real exception (the 6P… string is itself the encrypted recovery target), alongside the seed phrase, custodial accounts and brain wallets — four real cases, not three (EN + NL). (5) the FAQ no longer says the seed phrase derives every key in the wallet — it is the master backup for the accounts and keys derived from that phrase, while imported private keys, hardware-wallet accounts, additional recovery phrases and some legacy wallet data may need separate backups; the same wording now backs the glossary's seed-phrase definition (EN + NL). (6) the no-file flow, the Blockchain.com guide and the FAQ now point to the Blockchain.com mobile app's encrypted cloud backup (Apple iCloud / Google Drive) as a documented recovery route when the wallet password and/or Recovery Phrase are lost — restore on the same OS/cloud account with your app PIN; not a guarantee, but worth checking before writing the wallet off (EN + NL). (7) Armory is no longer presented as unsupported by current maintained tooling — current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py), with the caveat that a compatible extraction step is still required and the format remains slow (master list, glossary, file identifier; EN + NL).
 Corrected (6 points from a deep re-audit): (1) KeePass KDBX 4 no longer automatically means Argon2 — KDBX 4 lets you choose AES-KDF or Argon2, so the password-manager guide, hashcat walkthrough, hint list, cheat sheet and encrypted-file guide now say to identify the version and KDF first (keepass2john reports it) and list the current hashcat modes 34300 (Argon2) and 34301 (AESKDF) (EN + NL). (2) the Exodus guide now checks other recovery sources before seed.seco — a synced Exodus device, the pre-February-2019 email backup, passkey + iCloud/Google Drive backup, and archived data from an overwritten wallet — and only treats the local file as the crack target once those are ruled out (EN + NL). (3) MetaMask now opens with "how was this wallet created?" — SRP-created wallets follow the classic local-vault flow, while Google/Apple/Telegram-created wallets protect the Secret Recovery Phrase with the social account and MetaMask password together, so "no SRP" no longer universally means "crack the local vault" (EN + NL). (4) the Monero guide no longer sends a forgotten optional passphrase to the BIP39 25th-word page without context — Monero's passphrase is a seed offset (mnemonic + offset derive a different wallet), now explained with the official restore-from-seed guide (EN + NL). (5) Monero's .keys file is no longer "the only door" — the page now lists three routes: seed restore, official restore-from-keys (primary address + private spend/view keys), and only then password recovery on the .keys file (EN + NL). (6) the John the Ripper FAQ no longer says "or your distro's john package" as if any package works — distro packages only count if they are real jumbo builds with the wallet formats and *2john scripts; Debian/Ubuntu's john is core-only (EN + NL).
 Added (legal, launch prep): the disclaimer now carries an explicit "Limitation of liability / Aansprakelijkheid" section — the site and its instructions are used at your own risk, and to the fullest extent permitted by law the operator is not liable for loss or damage, including loss of funds, arising from following them (EN + NL). New pages: Privacy Policy (data controller Crypto Recovers / Robbert Bink, KVK 75927276, Le Mairekade 77, 1013 CB Amsterdam; local tools never send search/token/calculator input to the server; server logs ≤ 90 days; contact email ≤ 12 months; no advertising/tracking cookies or analytics on this site; GDPR rights; recovery-service data handled under the separate Crypto Recovers privacy policy) and Terms of Use (educational use only, acceptable use on your own wallets/devices, no professional relationship, no guarantees, intellectual property, "as is"/"as available" warranty disclaimer, limitation of liability, Dutch law / Amsterdam courts). The footer now links About · Contact · Disclaimer · Privacy · Terms on every page (EN + NL). Both new pages are in the sitemap (62/62), llms.txt/llms-full.txt, the search index (EN + NL) and carry WebPage + BreadcrumbList JSON-LD. A site-wide claim audit (EN + NL) confirmed every guarantee/success mention is a negation or scam warning — the site promises no results anywhere.
 Corrected (site-wide, safety copy): the site no longer says "never your file / never your hash" as an absolute — it now distinguishes seed phrase/private keys (never share) from encrypted wallet files and hashes/extracts (sensitive, but technically needed for legitimate recovery; only local/offline or within a clear written, trusted process, never public checkers or unknown websites). Updated: the nav tagline ("never your seed, never public uploads"), the online-crackers page itself (hero, answer box, safety rules, meta/og/tw/JSON-LD), the convert page ("not doing recovery" → "not running a safe recovery"), Exodus, Blockchain.com .aes.json, the btcrecover/hashcat/John/offline-tools callouts, the FAQ upload rule, the DIY page, the scammers rule, the encrypted-file page (4 spots), password manager, hint list, cheat sheet, master list, Monero, when-recovery-is-possible and protect-your-wallet-files (EN + NL).
 Corrected (honest math & wording): (1) the how-long cracking-time table is split into blind brute force (full range — 6 lowercase random = 26⁶ ≈ 309M candidates: wallet.dat hours to about a day, Ethereum scrypt ~37 days, BIP38 ~50–83 days; 8 chars letters+digits = centuries–millennia/forever; 12+ random = forever) and smart attack (fast only with strong clues / small candidate lists). (2) password-vs-seed no longer says "funds are not gone … doors can be opened … almost always recoverable" — the correct file makes recovery possible, but odds depend on the format, file condition, password strength and memory. (3) the FAQ no longer says passwords are tested "against the wallet file (or seed phrase)" — testing targets an encrypted wallet file, keystore, hash/extract or known address; a seed phrase itself is not cracked like a wallet password. (4) John the Ripper is no longer blanket-labelled "the classic CPU cracker" — many wallet formats are CPU-oriented, some have GPU/OpenCL support depending on the Jumbo build; Monero .keys stays a CPU-style route. (5) the entropy calculator now says clue reductions are rough examples, not predictions. (6) lost-crypto-statistics no longer claims wallet.dat "before roughly 2021" used "far weaker settings" — older files often have fewer rounds, but the exact count is stored in the file and not determined by the year. (7) guide numbers fixed on protect-your-wallet-files (feasibility = guide 08, old-passwords sweep = guide 05) and the Coinbase Wallet / Base App closure note was added to the master-list seed-based taxonomy (EN + NL).
 Corrected (1Password Secret Key, PDF modes, glossary scrypt, prevention advice): (1) the password-manager walkthrough no longer says "a cracked master password opens the vault" as a blanket — for some managers it may, but for modern 1Password accounts the account password alone is not enough: the Secret Key, an already signed-in device, Emergency Kit, recovery code or another supported recovery route may also be required. (2) PDF modes on the encrypted-file page and the cheat sheet now list 10400/10500/10600/10700 and, in some cases, 25400 — let pdf2john output and hashcat --help decide. (3) the glossary scrypt entry no longer presents N=262144, r=8, p=1 as universal for Ethereum keystores — the parameters are stored in the JSON under kdfparams; geth-style keystores commonly use those values, others may differ. (4) the never-lose-access sealed-envelope advice now warns not to put every access component in one place (EN + NL).
 Corrected (should-i-pay consistency): the service page no longer mixes two strictness levels — the Level 2 bullet, the red-flag bullet and the before-you-pay checklist title + hint now all say the same thing: never upload the wallet file to a public checker or unknown website; only under a clear written agreement with a verified professional may the encrypted file itself be processed in a controlled workflow; the standard remote route is the extract (level 3); your seed phrase is never shared under any contract (EN + NL).
 Corrected (post-audit, external technical audit): (1) the Ethereum keystore scrypt labels on the benchmarks page, the cracking-time table and the entropy calculator now state the geth/Web3 standard N=2¹⁸ = 262,144 (r=8 p=1) instead of N=2¹⁷, with the fine-print that the published btcrecover suite’s reference test uses N=2¹⁷ — the measured 96/s applies to that test, and a standard 2¹⁸ keystore tests roughly 2× slower per guess on the same hardware (EN + NL). (2) the wallet-identifier widget’s Ethereum KDF label now reads scrypt N=2¹⁸ r=8 p=1 (geth standard) · or PBKDF2 262,144 iterations (EN + NL). (3) the classic Coinbase Wallet note on the master list and wallet identifier no longer carries the unverifiable specific closure date — it now says the classic Coinbase Wallet is being retired in favor of the Base App, with the recovery phrase and addresses remaining (EN + NL). Re-verified correct, no change: the “official btcrecover benchmark suite” sourcing, best66.rule, every hashcat mode and *2john extractor, FAQPage schema, sitemap/robots/redirects and the crack-time arithmetic.
 Changed (diagnosis quiz): the homepage diagnosis quiz no longer asks “have you already paid anyone?” — the paid-a-“recovery”-service option and its verdict are removed; the risk step now only asks whether you shared your seed phrase (No / Shared), with the question and the “no” answer reworded accordingly (EN + NL).
 Changed (theme default): the site now starts in light mode on first visit regardless of the operating system’s color scheme; the light/dark toggle and any saved preference still work exactly as before (EN + NL, all 128 pages).
 Changed (diagnosis flow — quiz + what-to-do): (1) the homepage quiz is now the single interactive router — its first question is reworded from terminology (“password / seed / passphrase / PIN”) to plain access language (“What are you trying to open or restore?” with concrete descriptions), and the password verdicts now link to the master list (verdict per wallet) so the quiz routes to the site’s strongest asset. (2) a machine-generated (password-manager) password with no or only fragmentary memory now gets an honest “effectively unrecoverable” verdict instead of “possible”. (3) the what-to-do page is no longer a competing six-question decision tree — it is the same flow in reading form, with a prominent link to the interactive diagnosis and the same branches and destinations (custodial, seed, passphrase, wallet-file password, PIN, not-a-password-problem). Title/meta/JSON-LD, the nav label (“the diagnosis flow”), the homepage and guides cards, search keywords and every “six-question decision tree” reference are updated site-wide (EN + NL).
 14 August 2026
 Corrected (7 content points + 2 cleanups): (1) BIP39 passphrase is no longer CPU-only on the benchmarks page — the official BTCRecover set includes an RTX 5090/OpenCL measurement (~19,950/s), now shown in the table, and the CPU-only fine-print is removed (EN + NL). (2) the entropy calculator now uses the real RTX 5090/OpenCL rates — BIP39 19,950, Blockchain.com v2 9,470, v3 20,030 (with CPU noted where slower) — instead of copying CPU rates into the GPU column (EN + NL). (3) the wallet.dat "old/pre-0.21 vs modern/0.21+" framing is removed — age can be a rough clue, but the machine-tuned nDeriveIterations stored in the file determines cost; the lost-statistics rows are now "low-round (original ~25,000 baseline)" and "reference wallets", and the wallet.dat answer box says "especially low-round files" (EN + NL). (4) the Chainalysis methodology description is corrected — it segmented the supply by coin age and activity, not "counted five-years-untouched addresses"; the "five-years-untouched method" phrasing is removed (EN + NL). (5) the hashcat walkthrough's MetaMask line no longer sends newer extension vaults to 26600 — it now says extension vaults may use 26600 or 26610 depending on the extracted hash/layout and to use the installed version's supported mode (EN + NL). (6) "restore the wallet anywhere" is qualified on the old-phone, Monero and Blockchain.com pages — restore in the original or a compatible wallet that supports the same seed type, coin and derivation settings (EN + NL). (7) "hardware wallet PINs work the same way" is replaced with the device-specific statement (retry limits, delays, reset behaviour; check the manufacturer's docs) (EN + NL). Cleanups: MultiBit superlatives softened ("one of the fastest common formats" / "exceptionally weak by modern standards") and the benchmarks freshness date is now 14 August (EN + NL).
 Corrected (missed-propagation cleanup, 7 items): (1) the homepage Ethereum card no longer says "the slowest common format" — now "among the slower common formats" (EN + NL). (2) the homepage fork-wallet card no longer says "same encryption, same recovery rules" — it now notes that wallet type/version and Windows data-directory defaults differ per coin, so check each client's actual setup (EN + NL); the fork-wallet page meta/JSON-LD descriptions now say the same. (3) the homepage MetaMask card no longer says "the seed restores instantly" — it now says the seed restores its SRP-derived accounts and imported private-key/JSON or hardware accounts need their own recovery material (EN + NL). (4) the homepage Exodus card no longer says "the 12-word seed restores instantly" — now "restores the wallet without the password" (EN + NL). (5) what-to-do Q2 no longer says "most wallets restore completely" — now the seed-derived-accounts nuance with the imported-accounts caveat (EN + NL). (6) password-vs-seed-phrase: the seed row no longer says "the wallet can never be recreated on any device" and the MetaMask line no longer says "the phrase restores everything" — both now carry the seed-derived/imported-accounts nuance (EN + NL). (7) verified already clean: the old "the .dat / keystore file Electrum encrypts" and "the Android scrypt vault" nav labels (rounds 44/37) and the UTC– en-dash (round 47) — 0 occurrences remain.
 Corrected (2 points; 1 mostly already fixed and enhanced): (1) the password-manager page's 1Password guidance already required conversion with 1password2john.py for agilekeychain/cloudkeychain and treated 31800 as a separate format (round 22) — the 31800 row and the walkthrough step now additionally say to verify the exact local format and required extraction route first (EN + NL). (2) the 68-place checklist no longer says Time Machine snapshots restore files you deleted years ago as a guarantee — it now says old backups can be thinned or deleted when the backup disk fills and local snapshots are short-lived, so check the backup timeline around the wallet setup period without assuming years-old deleted files are present (EN + NL).
 Corrected (3 points): (1) the 68-place checklist no longer implies a dead laptop drive is automatically readable — if the disk uses BitLocker, FileVault or another full-disk encryption system, the unlock password, recovery key or account-based recovery route is also required (both drive entries, EN + NL). (2) the Linux/macOS grep example now uses real shell quotes — grep -Rni "seed" ~ instead of smart quotes that would be treated as literal characters (EN + NL). (3) "no countdown / nothing expires / time alone never does" is now qualified — there is usually no blockchain countdown, but data-retention countdowns (cloud trash, recently deleted files/photos, email trash, backup retention, SSD behavior) are time-sensitive, so freeze the device and check recoverable windows promptly (first-24-hours page + DIY page, EN + NL).
 Corrected (2 points): (1) the custodial flow page now carries an explicit callout distinguishing Coinbase exchange (custodial, reset/KYC) from Coinbase Wallet / Base App (self-custody — recovery depends on the recovery phrase, cloud backup, passkey/signer setup or remaining device access; Coinbase cannot recover or move funds for you) (EN + NL). (2) "Deleted ≠ gone" now carries the SSD/TRIM caveat on both the first-24-hours and protect-your-wallet-files pages — on a modern SSD deleted data can become unrecoverable quickly, so stop using the device immediately, avoid rebooting or installing recovery tools on it, and image the drive or get specialist help before experimenting (EN + NL).
 Corrected (2 points): (1) the password-vs-seed-phrase device-password row is no longer too reassuring — on phones and encrypted devices a forgotten passcode may require erasing the device, which can destroy local wallet data, so the page now says not to reset/wipe/factory-reset/reinstall before checking whether wallet data, backups or app storage can be preserved (table row + flow bullet, EN + NL). (2) Ethereum keystore filename patterns are now written with two regular hyphens — UTC--*.json / UTC--<timestamp>--<address> — the en-dash UTC– variants (16 files) and single-hyphen UTC-* variants are all corrected (EN + NL).
 Corrected: the 68-place search checklist no longer tells people to just "delete the photo afterward" when a photographed seed sheet is found in a cloud photo library — the seed is digitally exposed, so the route is: treat it as compromised, restore/check the wallet safely, create a fresh wallet with a new seed, move the funds to fresh addresses, and only then clean up the photo, trash folders, cloud backups and synced devices (EN + NL).
 Corrected: BIP38 encrypted private keys are now an explicit "no wallet file" case — the recovery-without-file page adds Exception 5 (a 6P… string is the encrypted recovery target itself; the forgotten passphrase is tested offline, e.g. btcrecover --bip38-enc-privkey) and its FAQ now lists four real cases; the "when it's not a password problem" page no longer says cracking only helps with an encrypted wallet file — it now notes the exceptions where the test target is not a wallet file (BIP38 encrypted private keys, brain wallets, supported seed-passphrase recovery). Also repaired a truncated Dutch answer-box paragraph on the latter page (EN + NL).
 Corrected: the global navigation/sidebar label for Electrum no longer calls it "the .dat / keystore file Electrum encrypts" — Electrum wallet files normally have no fixed .dat extension (the default is default_wallet in the Electrum wallets folder); the label now reads "the encrypted wallet file in Electrum's wallets folder" sitewide (60 EN + 61 NL files).
 Corrected: the password-vs-seed-phrase page no longer labels Electrum wallets as .aes files — Electrum wallet files have no fixed extension (often default_wallet in the Electrum wallets folder); the sentence now lists .dat, keystore JSON (UTC--*.json) and an Electrum wallet file in the Electrum data folder (EN + NL).
 Corrected: the password hint list's BTCRecover examples no longer put spaces between fixed text and wildcards — tokens on one line are alternatives in BTCRecover, so Markus %1,6a 2019 becomes Markus%1,6a2019 and %1,4a !23$ becomes %1,4a!23$, with python btcrecover.py --listpass --tokenlist tokens.txt added so readers can preview the candidates actually generated; the hashcat mask for "starts with Markus" now literally includes Markus (Markus?a?a?a?a?a?a?d?d?d?d) (EN + NL).
 Corrected (2 points): (1) the fork-wallet guide no longer says every Core-derived fork's current Windows default is %LOCALAPPDATA% — it now splits per client: Bitcoin Core current %LOCALAPPDATA%\Bitcoin with legacy %APPDATA% still relevant, Dogecoin Core check %APPDATA%\Dogecoin first, Litecoin Core check %APPDATA%\Litecoin first unless the installed version documents otherwise, with %LOCALAPPDATA% as an extra fallback (EN + NL). (2) the file-finder now lists the legacy Windows geth keystore location %APPDATA%\Ethereum\keystore alongside the current %LOCALAPPDATA%\Ethereum\keystore, and says to search both before concluding none exists (EN + NL).
 Corrected (4 points; 1 already fixed and re-verified): (1) the offline-tools page no longer says a high-round wallet.dat is "low hundreds" on GPU — the benchmarked high-round reference is low hundreds per second on CPU, with GPU results reaching several thousand depending on the wallet parameters and tool path (EN + NL). (2) the hashcat walkthrough's mode-list JSON-LD now labels 13400 as KeePass (AES-KDF) — the mode table already carried the AES-KDF / KDBX4 caveat (EN + NL). (3) the hashcat walkthrough's protected-documents summary now lists RAR 12500/23700/23800/13000 with "mode depends on what rar2john produces" instead of only 12500/13000 (EN + NL). (4) the encrypted-file LUKS row now splits the extraction route: Hashcat uses luks2hashcat.py (14600/29511–29543 LUKS1 variants; 34100 for supported LUKS2/Argon2 configs after checking the KDF), John uses luks2john (EN + NL). VeraCrypt/TrueCrypt extraction: re-verified — already split into veracrypt2hashcat.py / truecrypt2hashcat.py (round 32), no truecrypt2john remains.
 Corrected (3 points; 1 already fixed and re-verified): (1) the BIP39 passphrase command on the cheat sheet and btcrecover walkthrough is now a complete, runnable form — --bip39 --mnemonic "…" --addrs <known-address> --addr-limit 10 --tokenlist tokens.txt — with the note that the mnemonic plus a known address/xpub target are required, and that Ethereum/altcoin cases often need --wallet-type (EN + NL). (2) Ethereum keystore "no extraction" claims: re-verified — the extraction guide and hashcat walkthrough already say hashcat does not read the raw UTC JSON and require ethereum2john.py / the $ethereum$… format (rounds 19/20); no change needed. (3) the wallet identifier now carries a current Coinbase note — the classic Coinbase Wallet closes on 15 August 2026, the recovery phrase and addresses remain, and some classic-wallet networks are not supported in the Base App (EN + NL). (4) the password-vs-seed-phrase table no longer says the phrase derives every key in the wallet — it now says seed-derived wallets derive their normal accounts and that manually imported private keys, JSON accounts, hardware-wallet accounts or accounts from another phrase may need separate recovery material (EN + NL).
 Corrected (5 points): MultiBit — the guide, FAQ and cheat sheet no longer claim the Classic .wallet "needs hashcat 27700 / multibit2john": btcrecover can read it directly, but the .key backup is strongly preferred because it is much faster; hashcat 27700 / John via multibit2john are alternatives that require extraction (EN + NL). Coinomi — the sidebar label is no longer "the Android scrypt vault" (sitewide EN + NL), the vault section now notes that the crackable-file assumption applies to password-protected wallets (biometrics / no-password / password + biometrics need device-keystore material), and the old-phone guide notes that Coinomi Desktop/Windows is not a phone-extraction case (%LOCALAPPDATA%\Coinomi\Coinomi\wallets) (EN + NL). Seed-passphrase: the "if one is lost, the other still unlocks the wallet" sentence is not present in the current build (round 23 fix, re-verified — the page says both are required and either may mean permanent loss of access). Blockchain.com: the "recover without wallet file" page now carries the same legacy payload-retrieval exception as the guide (Wallet ID + email/2FA during a login attempt; not a reset, not guaranteed) (EN + NL).
 Corrected (17 points from a 23-point audit; 6 were already fixed in earlier rounds and re-verified): (1) Ethereum keystore KDF path is now crypto.kdfparams.n (was crypto.scrypt.n) (EN + NL). (2) PBKDF2 262,144 is no longer hardcoded as universal in the encryption explainer — the count is stored in the file's kdfparams.c (EN + NL). (3) the ~96 guesses/sec Ethereum figure is now labelled as the measured 9950X CPU reference run, not a GPU claim (guide FAQ + JSON-LD, how-long page, EN + NL). (4) the how-long measured table keeps the Ethereum benchmark at N=2¹⁷ only (was N=2¹⁷–2¹⁸) (EN + NL). (5) Ethereum is now "among the slower/harder common wallet formats", not "slowest/most secure/hardest" (H1, intro, answer box, hashcat paragraph, cite, EN + NL). (6) MetaMask SRP restores only SRP-derived accounts — imported accounts need their own material (already fixed in round 24, re-verified). (7) Coinomi: "whoever holds the phrase controls the funds, full stop" now says the phrase plus any optional BIP39 passphrase are both required to restore (EN + NL). (8) FAQ: "no legitimate tool ever needs your credentials" now distinguishes entering material locally into verified offline tools from sending it to anyone; "wallet can never be recreated" now says access may still be recoverable from a surviving key-bearing backup, wallet file or device (EN + NL). (9) Bitcoin Core backend row is now wallet-type based (legacy BDB vs SQLite descriptor wallets), not "0.21+ = SQLite" (EN + NL). (10–12) Armory: historical btcrecover distinction and root-key paper backup were already fixed in round 24 (re-verified); the "16 MB" KDF constant is now "memory/iteration parameters calibrated per wallet" (EN + NL). (13) WarpWallet: no longer described as plain scrypt — scrypt N=2¹⁸ XOR PBKDF2-HMAC-SHA256 2¹⁶ rounds (master list + brain-wallet guide + JSON-LD, EN + NL). (14) master list "one of two security models" now lists seed/key-based, file-based, hardware/device-based and custodial (EN + NL). (15) never-lose-access "almost every wallet is seed-backed" now follows the wallet-type taxonomy, and the PIN row says failed-PIN behavior is model-specific — devices may wipe, lock or permanently brick (EN + NL). (16) how-long page: the ratio math is fixed (~1.3×, not 5×, vs the 122/s row), the BIP38 GPU row is restored (43/s OpenCL; CPU measured faster at 72), the 12+/16+ statements carry the full-printable-alphabet assumption, and the "6 lowercase" example is now actually lowercase (bfqxwm) (EN + NL). (17) master list MetaMask row no longer presents 900k as a universal default — read the stored count (EN + NL). The MetaMask timeline split (round 26) is re-verified.
 Corrected (11 points from a 13-point audit; 4 were already fixed in earlier rounds and re-verified): (1) rented-GPU guidance no longer says an extracted hash line is safe to upload generically — remote-compute safety is format- and extractor-dependent (ethereum2john.py warns against sharing its extracts; some btcrecover extracts are minimized for cloud), and an untrusted rented machine may learn the recovered plaintext password (offline-tools page, EN + NL). (2) Monero: the file table and FAQ no longer call the extensionless wallet file "JSON, not encrypted" — both <walletname> (encrypted wallet cache) and <walletname>.keys (encrypted keys/settings) are password-encrypted per official Monero docs; .cache is a derived file, not the standard documented pair (EN + NL). (3) BIP38: the guide no longer suggests Electrum/MultiBit can import an encrypted 6P key directly — decrypt offline with a BIP38-capable tool first, then sweep into a fresh wallet (EN + NL). (4) Ethereum keystore: the "which wallets" list now separates wallets that create/export V3 JSON from wallets that only import it (MetaMask: import via "Import account with JSON file", the file keeps its own password; MetaMask's ordinary export is a private key) (EN + NL). (5) "move funds to a maintained wallet" is now "create a fresh wallet with a new seed, back it up, verify, then send/sweep" — importing old keys does not make them fresh — applied consistently in the hashcat, btcrecover and John walkthroughs (EN + NL). (6) btcrecover walkthrough: no longer implies btcrecover's own extracts are generic hashcat input — the format's *2john/*2hashcat extractor is the conversion route (EN + NL). (7) hashcat mode table heading now says "official modes plus separately labelled community/development modes" (EN + NL). (8) offline-tools: "Handles all the crypto formats" → "many common crypto-wallet formats" (EN + NL). (9) Blockchain.com intro now explicitly calls the legacy mnemonic a "legacy credential-recovery mnemonic, not a BIP39 wallet seed" (EN + NL). Already fixed and re-verified: wallet.dat "opens without password = never encrypted" (rounds 17/25), Ethereum raw-JSON → hashcat (round 19), Exodus Mobile seed.seco (round 22), Blockchain.com v3 "genuinely slow" (round 17).
 Corrected (8 points): Tezos — the cheat sheet and master list no longer describe tezos2john.py as a generic client-key-file extractor: it is the Tezos ICO/fundraiser password route using mnemonic + fundraiser email + tz1 address. BTC.com/Blocktrail — the raw PDF is not a direct --wallet input; the recovery-sheet wallet data (passwordEncryptedSecretMnemonic) must be prepared first (cheat sheet + master list). Bither — the supported btcrecover target is the SQLite wallet database (format-3), not every exported/encrypted backup (cheat sheet + master list). block.io — "PIN search is fast" is replaced with the real KDF (PBKDF2-HMAC-SHA256) and a check-the-stored-iteration-count-first note (legacy ~2,048 vs newer 100,000+), plus the browser/Network data route (master list + cheat sheet). The "billions of combinations in minutes to hours" token-attack claim on the cracking-time page is corrected to runtime = candidate count ÷ wallet-specific measured rate, with the site's own benchmark examples. RAR3 — the cheat sheet now lists 12500 (RAR3-hp), 23700 (RAR3-p uncompressed), 23800 (RAR3-p compressed) and 13000 (RAR5), letting rar2john's output decide. ZIP — no more ".zip → 13600" mapping; PKZIP/ZipCrypto modes 17200/17210/17220/17225/17230 are listed with "let the extracted hash decide" (cheat sheet + encrypted-file guide, including the previously missing 17230). Terra Station and Stargazer — the cheat sheet no longer presents hashcat -m 29600/-m 25500 as directly runnable; both rows now state that extraction to the hash format comes first and link the extraction guide. Also added a one-line warning about 2john filename: prefixes in the cheat sheet fine-print (EN + NL).
 Corrected: KeePass rows no longer send every .kdbx to hashcat mode 13400 — 13400 covers only the supported AES-KDF KeePass formats; KDBX4 may use Argon2 and needs a KDBX4-compatible route, so identify the database version/KDF first (encrypted-file guide, cheat sheet, hashcat walkthrough mode table; EN + NL). MetaMask: mode 26620 is removed from the current stable "copy, adapt, run" references — current stable hashcat v7.0.0 has 26600, 26610 and 31900 but no 26620 (that mode appears only in later releases dated after 14 August 2026); the cheat sheet, convert page, master list, encryption timeline and encryption explainer now say 26620 is only in newer/development builds and to use the modes the installed version supports (EN + NL).
 Corrected: the encrypted-file guide no longer presents mode 22100 as a catch-all BitLocker route — hashcat 22100 accepts only user-password-protected VMK hashes (hash types 0/1). The row now splits BitLocker with a user-password protector (22100, bitlocker2john / bitlocker2hashcat.py) from TPM / TPM+PIN / startup-key protection (not the same offline route; TPM-protected VMKs cannot be converted) and the 48-digit recovery password (not an ordinary mode-22100 search; recovery-key brute force is treated as infeasible by the official extractor). VeraCrypt/TrueCrypt: the combined row with "29411–29483 (XTS) · truecrypt2john" is split — the current VeraCrypt hashcat route is 29411–29483 via veracrypt2hashcat.py (legacy 13711–13783 only if deliberate), the current TrueCrypt route is 29311–29343 via truecrypt2hashcat.py (legacy 6211–6243); the misleading "XTS" label is gone (EN + NL).
 Corrected: the cheat sheet no longer lists "Hive for OS X / Android / Web" as one btcrecover wallet-password route — btcrecover's wallet-password support covers Hive for OS X; Hive Android/iOS/Web are documented under seed recovery instead (EN + NL). LastPass: the cheat sheet no longer says "own export" for mode 6800 — the CSV account export contains no hash; the local XML/SQLite vault cache via lastpass2hashcat.py is the artifact (EN + NL). Ethereum keystore: the master list and encryption timeline no longer hardcode "scrypt N=262,144 / PBKDF2 262,144" as universal — the parameters are stored in each file's kdfparams; geth commonly uses scrypt N=262,144 but lighter/non-default configurations exist, so read the actual file before estimating recovery speed (EN + NL).
 Corrected: the encrypted-file guide and cheat sheet no longer route every macOS FileVault case through mode 16700 — older FileVault 2 / CoreStorage volumes use 16700 + fvde2john, while FileVault on APFS (macOS 10.13+) is a separate route (hashcat 18300, APFS), and on Apple silicon / T2 Macs the Secure Enclave key architecture applies, so identify the exact configuration first (EN + NL). The LUKS rows were already corrected in an earlier round — the old "no official mode / treat as unrecoverable" claim is gone — and now explicitly name luks2hashcat.py and mode 34100 for supported LUKS2 Argon2 configurations, splitting LUKS1 (29511–29543) from LUKS2 (EN + NL).
 Corrected: SLIP39 is no longer lumped under the BIP39 KDF row — BIP39 passphrases use PBKDF2-HMAC-SHA512 (2,048 iterations), while SLIP39 passphrases are a separate btcrecover recovery mode (--slip39) with their own Feistel + PBKDF2-HMAC-SHA256 construction, an iteration exponent stored in the material and a required share quorum (master list + cheat sheet, EN + NL). Electrum: the master list, cheat sheet and guide now flag 2FA / TrustedCoin wallets as a special case — current btcrecover documentation excludes 2FA wallets from its standard Electrum password-recovery support, so identify the wallet type before the generic route (EN + NL). Bitwarden: the cheat sheet now splits PBKDF2-configured vaults (mode 23400, bitwarden2john) from Argon2id-configured vaults, which do not use the generic 23400 route — identify the KDF first (EN + NL).
 Corrected: the wallet identifier no longer treats every modern phone wallet as a simple "12/24-word phrase → password irrelevant" case — it now says to identify the wallet model first. Trust Wallet SWIFT wallets use a passkey tied to your Apple/Google environment instead of a 12-word phrase; Coinbase Smart Wallet / Base wallet is passkey-based (a recovery phrase exists only if you set one); Phantom wallets created with Google or Apple recover via that account plus your PIN, with the phrase only exportable while you still have access. Updated on the identifier page (app-name list + seed-based definition), the identifier widget verdict, the file-finder Trust Wallet rows and the Phantom glossary entry (EN + NL).
 Corrected: the file-finder and the Blockchain.com FAQ no longer say there is no way to get the wallet file without the password — for some legacy Blockchain.com wallets the encrypted wallet payload can be retrieved during a login attempt (even with a wrong password) if you still have the Wallet ID and can pass the required email/2FA checks; version-dependent, not guaranteed for the current account flow (EN + NL). Coinomi: the guide and file-finder no longer describe Coinomi as Android-only — desktop installations keep .wallet files in the Coinomi data directory (e.g. %localappdata%\Coinomi\Coinomi\wallets) that btcrecover can read directly, so the recovery path now separates desktop from Android app storage. And the "vault file = crackable" claim now starts with a decision point: password-protected wallets can be attacked from the file, but biometrics, password + biometrics or no-password setups may additionally depend on device-keystore material — keep the device intact until that is ruled out (guide, FAQ visible + JSON-LD, EN + NL). Dutch: pre-existing slot drift on the Coinomi page repaired (fine-print, steps heading, 25th-word paragraph, common-mistakes list, next-step and sources sections were showing wrong fragments).
 Corrected: the file-finder no longer says the Yoroi recovery phrase is 24 words — wallets created directly in Yoroi use a 15-word recovery phrase; Yoroi can also restore compatible 24-word Cardano wallets created elsewhere (such as some Daedalus wallets). The master list already had this right; the find-file row now matches it (EN + NL).
 Corrected: the encryption timeline no longer collapses all MetaMask vaults into one "2016–present · 10,000 iterations · fast per guess" row. It now separates the legacy extension layout (10,000 fixed, hashcat 26600), newer extension vaults (iteration count stored in vault metadata — read the actual keyMetadata/KDF parameters instead of assuming a hard default; dynamic-count modes 26610/26620), and the MetaMask Mobile vault (separate format, hashcat 31900). The dedicated MetaMask guide, glossary PBKDF2 definition and the benchmark/calculator fine-print no longer present 900,000 as a hard universal default — they say to read the stored count, with 600,000 and 900,000 both documented (EN + NL).
 Corrected: the wallet.dat-family guide no longer uses "does the client ask for a password at startup?" as an encryption test — an encrypted Bitcoin Core wallet can load and display information while locked, so the correct check is getwalletinfo (unlocked_until, 0 = locked) on a safe working copy with a matching client version. The wrong startup-test step on the Bitcoin-family forks guide (EN + NL) is replaced; the wallet.dat FAQ and troubleshooting page already had the correct framing. KeePass: the manager guide, cheat sheet and search checklist no longer describe KeePass 1 as .kdbx — KeePass 1 databases are .kdb, KeePass 2 are .kdbx — and the extraction step now says to identify the database version first (EN + NL). BIP38: the wallet identifier no longer tells people with only a photo to "delete the photo" right after transcribing — the original must be preserved until the 6P… string is independently verified (ideally successfully decrypted); only a cloud-synced copy is removed, after a verified offline backup exists (EN + NL).
 Corrected: MetaMask, Blockchain.com and Armory pages no longer treat a seed phrase as proof that everything restores. MetaMask: the guide now says the SRP restores only accounts derived from that phrase — imported private-key/JSON accounts, hardware-wallet accounts, additional SRPs and some newer login-based setups may need separate recovery material, and every expected address must be verified before deleting the vault (guide, JSON-LD, FAQ, find-file page and identifier verdict; EN + NL). Blockchain.com: the 12-word phrase restores only the addresses derived from it — imported addresses are not backed up by the Recovery Phrase, so verify every expected address and balance before discarding anything (guide intro, answer box, generation list, common mistakes, FAQ, verdict, without-file page; EN + NL). Armory: the identifier no longer calls the paper backup a "12-word seed" — Armory's paper backup is its own Root Key / chain-code format — and the site no longer claims the current maintained btcrecover fork supports Armory: older Armory-specific tooling existed, so it is a legacy specialist workflow (identifier row, glossary, master list + FAQ; EN + NL).
 Corrected: the BIP39 passphrase backup rule no longer says "if one is lost, the other still unlocks the wallet" — a different passphrase (including an empty one) derives a different wallet, so both the seed and the passphrase are required to restore the same passphrase-protected wallet. The section keeps the separate-storage security advice while stating honestly that losing either may mean permanent loss of access (EN + NL).
 Corrected: the Monero guide no longer calls pre-2017 binary-format .keys wallets a "practical dead end" — John the Ripper's jumbo build added legacy Monero support (wallets that predate the JSON format), so the guide now says to run monero2john.py on the actual file first and treat extraction failure as format-/version-specific rather than assuming the file is unsupported (EN + NL).
 Corrected: the old-phone guide no longer routes Exodus Mobile through the desktop seed.seco / hashcat 28200 path — the table now separates Exodus Desktop (seed.seco → exodus2hashcat → 28200) from Exodus Mobile (app vault, no seed.seco assumption; the mobile-specific recovery path via the 12-word secret key / passkey) (EN + NL).
 Corrected: the password-manager guide no longer says to "point hashcat at the keychain files directly" for 1Password — for agilekeychain (6600) and cloudkeychain (8200), hashcat's own guidance points to 1password2john.py first; 31800 is a separate local mobilekeychain format (1Password 8). Updated in the visible guide, the mode table and the JSON-LD (EN + NL).
 Corrected: the Blockchain.com guide no longer treats the legacy blockchain.info mnemonic (6–25+ words) as a modern seed. That mnemonic is a password-recovery mechanism: a tool that supports the legacy format uses it to reveal the wallet password from the time the phrase was created — if the password was changed later, only that earlier password comes back. It does not regenerate keys and does not restore the wallet like a 12-word BIP39 Recovery Phrase. Updated on the guide (intro, answer box, generation list, common mistakes, FAQ — visible + JSON-LD, EN + NL); the "recovery without the wallet file" page already had the correct framing and was verified.
 Corrected: the Exodus guide no longer claims "GPUs barely help / tens to low hundreds of guesses per second" for hashcat mode 28200. Published benchmarks on high-end cards report roughly 5,000–10,000 guesses/sec (RTX 3090 Ti ~5,229/s; RTX 6000 Ada ~10,187/s). The guide now explains that scrypt makes each guess more expensive than simple hash formats, that mode 28200 has a working GPU path reaching thousands of guesses per second on modern GPUs, and that speed varies by hardware — benchmark your own machine (EN + NL). The Ethereum-keystore, BIP38 and VeraCrypt rows were left unchanged: those are different scrypt parameters where the "GPU barely helps" note is accurate.
 Fixed: site-wide Dutch nav and footer misalignment — the "By file format"/"By wallet / app" headings were rendering as list items (and vice versa) on every page. Root cause: the translation rebuild's difflib paired similar texts from different sections (nav vs footer) and shifted every following slot by one. The rebuild now uses positional pairing when the EN and NL structures match (they always do — NL is generated from the EN templates), and inner_to_text escapes literal asterisks inside code spans so values like *2john.py, UTC--*.json and $ethereum$p*… no longer mangle on the way back into HTML. All 60 NL translation files re-synced; 0 shifted slots, 0 markup corruption.
 Fixed: pre-existing content drift on 13 Dutch pages — the wallet guides (wallet.dat, Electrum, MultiBit, Coinomi, BIP38, brain wallet, forks), Ethereum keystore, "how to find your wallet file", reported-services, search checklist, strength calculator and the hashcat walkthrough's structured data had heading texts in paragraph slots and fragments in list items. All restored to match the English structure 1:1.
 Corrected: the encryption timeline no longer tells people to read seed_version from the wallet JSON to pick the Electrum hashcat mode — electrum2john.py detects the format itself (for fully encrypted 2.8+ wallets it processes the encrypted container, base64 BIE1, not the JSON), and the mode follows the generated $electrum$N prefix (1/2/3 → 16600, 4 → 21700, 5 → 21800). The same prefix-based guidance now appears on the Electrum guide FAQ, the extraction guide and the cheat sheet, with the two-layer note (internally encrypted seed + optional ECIES whole-file encryption since 2.8).
 Corrected: a leftover claim in the hashcat walkthrough's structured data said you can "pass Ethereum keystore JSON files directly" to hashcat — that now points to the ethereum2john.py conversion step (hashcat does not read the raw JSON).
 Corrected: the Ethereum keystore → hashcat workflow now runs through ethereum2john.py — hashcat does not read the raw UTC JSON; the script produces the $ethereum$p*…/$ethereum$s*… line for modes 15600/15700 (and the $ethereum$w*… line for the pre-sale format, mode 16300). Updated on the extraction guide, cheat sheet, hashcat walkthrough, encryption explainer, glossary, Ethereum guide, online-cracking page and the services FAQ.
 Corrected: every hashcat command on the site now uses rules/best66.rule — the current hashcat rules file, renamed from best64.rule — with a compatibility note for older installs.
 Corrected: the site no longer claims extracted hashes contain "no private keys" — an extract is not normally a plaintext private key, but it can contain sensitive encrypted wallet material, so it is treated as sensitive as the wallet file (extraction guide, encryption explainer, online-cracking page, services FAQ).
 Removed: the domain-check tool on the reported-services page — the searchable list is now the only check.
 Removed: the "Cite this page" box from non-reference pages — it now appears only on the wallet guides, tool walkthroughs and reference pages where a citation genuinely makes sense.
 Fixed: alignment and spacing of the correction line and the "helpful" card on every page; callout, title, table and KDF-diagram layouts on tablet and mobile.
 Fixed: dark-mode readability — guide navigation, table labels, inline code, verdict badges and checklist chips now use light text on dark surfaces.
 Expanded: the "never lose access" prevention guide now covers the wallet-file rule and the seed passphrase (13th/25th word) — not just the seed.
 Corrected: the "never lose access" guide no longer claims you must back up all three layers — which layers you need depends on the wallet; a multisig note was added.
 Corrected: the Dutch translation slots realigned site-wide — step numbers and FAQ summaries were being applied to the wrong elements on some pages.
 Corrected: MetaMask is now described version-aware — legacy vaults use 10,000 PBKDF2 iterations, newer vaults store their own KDF parameters (900,000 default) and need hashcat modes 26610/26620. Updated on the MetaMask guide, master list, homepage, cheat sheet, calculator, glossary and FAQ.
 Corrected: imToken is no longer described as part of the "MetaMask family" — it uses a modified Ethereum keystore (identity.json) and follows the Ethereum keystore guide.
 Corrected: the Blockchain.com guide now separates the three generations clearly: modern 12-word BIP39 seeds, legacy blockchain.info mnemonic phrases of 6–25+ words, and the wallet.aes.json v0/v2/v3 export formats.
 Corrected: Monero seed types are now explicit across the site — 25-word legacy, 16-word Polyseed, 13-word MyMonero.
 Corrected: "random 12+ characters = impossible" is reworded to an entropy-based framing (roughly 80+ bits of entropy) on the master list, FAQ and feasibility guide.
 Corrected: "proof of ownership" wording site-wide — a wallet address helps identify a case and verify results, but an address alone never proves ownership.
 Rewritten: the "should you pay a recovery service?" guide now separates three material levels — seed phrase/private keys (never share, under any contract), the full encrypted wallet file (sensitive, only under a written offline process), and the password-verification extract / hash line (designed to be shareable for cloud-GPU testing). Paying for GPU capacity is covered honestly; "restore from seed" is explicitly distinguished as wallet restoration, not password recovery.
 Reduced: "honest"-wording across the site — from 573 visible uses to a keep-list of "honest odds" and "honest limits" (26 remaining in English, 21 in Dutch). The tone now states facts directly instead of asserting honesty.
 Corrected: the About page now says technical claims are checked against primary sources, instead of claiming the site is "technically correct information".
 Reframed: the lost-crypto statistics page and homepage card now distinguish "lost Bitcoin" from "forgotten passwords" in title, meta and headline — there is no reliable global figure for forgotten passwords alone, and the page says so.
 Corrected: the "why online crackers can't work" page was too absolute — it claimed remote cracking was impossible while the extract/cloud-GPU route was described elsewhere. It now explains the consistent hierarchy: never your wallet file, never your seed; a password-verification extract (hash line) can legitimately leave you for remote compute. Title, meta, nav label and FAQ updated in both languages.
 Corrected: the recovery-service page's red flags and checklist no longer treat an extracted hash line as an automatic scam signal — they now match the three material levels (seed never, full file sensitive, extract suitable for cloud-GPU work).
 Corrected: the MetaMask guide now shows the mode per vault generation (26600 legacy, 26610 for newer dynamic-iteration vaults, 26620 in recent/development hashcat builds — not every stable release has it), instead of one command for everything.
 Corrected: the hashcat guide no longer claims it handles "every major wallet format" — it supports a wide range of common wallet-password formats.
 Corrected: the About page no longer calls the site "technically correct information" — it now states that technical claims aim to be based on primary sources and that corrections are documented.
 Corrected: "Most wallet passwords are recoverable" on the DIY page is now "Many" — the homepage's defensible framing, applied consistently.
 Corrected: homepage entropy claims now use "80+ bits of entropy" instead of "16 characters", and the changelog's own "last reviewed" date was set to 14 August.
 Corrected: Armory is no longer listed as IMPOSSIBLE in the master list — btcrecover documents an Armory password-recovery path (roughly 15k–200k candidates per 0.2–3 hours), so it is "crackable offline, very slow, clues essential"; the glossary and FAQ now say the same.
 Corrected: the KeePass table no longer maps Argon2 to hashcat mode 13400 — 13400 covers KeePass 1 and KeePass 2 with AES-KDF (KDBX ≤ 3); KDBX 4 (Argon2) is a different hash, so the page now says to identify the database version/KDF first.
 Corrected: the BIP39 passphrase guide no longer claims "no match = a passphrase was used" — a mismatch can also mean a different derivation path or wallet type, so the page now says to verify wallet type and derivation settings first. The "never stored anywhere" claim is softened to "not part of the mnemonic".
 Corrected: the Geth Windows path on the file-finder is now %LOCALAPPDATA%\Ethereum\keystore (per go-ethereum docs), not %APPDATA%.
 Corrected: the old-phone guide now says ADB backups "may work" — inclusion depends on the app's backup configuration (allowBackup/backup rules) and Android version — and that an encrypted iPhone backup may restore app data, but wallet secrets depend on how the app stores them (some keychain classes are device-bound).
 Corrected: the file-finder no longer calls MetaMask "a seed problem, not a file problem" — it is a browser-vault case: with the seed, restore; without it but with the encrypted vault, offline password recovery may be possible.
 Corrected: the FAQ no longer says a seed phrase recreates the wallet "on any device" — it can usually be restored in a compatible wallet that supports the same recovery standard and derivation scheme.
 Corrected: the Dutch FAQ JSON-LD was rebuilt from the visible Dutch FAQ items on 22 pages (English answers and an orphan English question removed) — question names and answers now match the visible content 1:1 in both languages.
 Corrected: the Bitcoin Core wallet.dat pages now reflect that 0.21 introduced SQLite-backed descriptor wallets as experimental — legacy BDB wallets remained common, and descriptor wallets only became the default for new wallets in Bitcoin Core 23.0.
 Corrected: the Electrum timeline years now match the releases — 2.0–2.7 (2015–early 2017) and 2.8+ (2017–present), since 2.8 shipped in March 2017.
 Corrected: the encryption table no longer summarizes Electrum 1.x–4.x as one scheme — it now splits legacy 1.x–2.7 (double-SHA-256 family, hashcat 16600 by salt type) from 2.8+ (ECIES/BIE1 keystore, PBKDF2-SHA512 + ECC, hashcat 21700/21800 by salt type).
 Corrected: the extraction guide no longer claims every *2john output works in both John and hashcat — Ethereum keystores are the explicit exception: ethereum2john.py converts the UTC JSON to the $ethereum$p*…/$ethereum$s*… line that both hashcat (15600/15700) and John consume.
 Corrected: the Monero guide now distinguishes "you still know the password" (opening the old wallet in a modern client may migrate it) from a forgotten password (not a workaround — preserve the files, treat pre-2017 binary wallets as a legacy-support problem).
 Corrected: the Electrum seed-restore bullet now notes that if old funds do not appear, check wallet type, seed type and Electrum's gap limit before assuming the seed or password is wrong.
 Corrected: the BIP38 guide no longer claims a printed public address proves ownership (it helps identify funds and verify results only), and it now advises an exact offline transcription of the 6P string instead of a cloud-synced photo — the BIP38 string contains everything needed to rebuild the private key except the passphrase.
 Corrected: the Blockchain.com guide now mentions the legacy exception that the wallet file may still be retrievable with the Wallet ID plus account/2FA checks (btcrecover's download-blockchain-wallet.py), hedged as an exception rather than a guarantee.
 Corrected: the Blockchain.com v0 row no longer says "a strong password is crackable in days" — it is extremely weak by wallet standards, so human-patterned passwords can be reachable, but a genuinely random strong password is still not realistically brute-forceable.
 Corrected: the Blockchain.com second-password explanation now says the path is not parallel — in many workflows you must first recover or know the main password before attacking the second-password hash.
 Corrected: MultiBit no longer claims btcrecover "reads all three variants directly" — the Classic .key backup is btcrecover's direct/data-extract path, the Classic .wallet uses hashcat 27700 or the John/multibit2john route, and HD uses a btcrecover extract/direct workflow with hashcat 22700 also applying (cheat sheet + guide + FAQ).
 Corrected: Bitcoin-family file locations now show both legacy %APPDATA% and current %LOCALAPPDATA% defaults, with wallets in the datadir's wallets/ folder or directly in the datadir on older/single-wallet setups (file finder, identifier and fork pages).
 Corrected: the "how long to crack" page no longer claims blind brute force over 10 full-alphabet characters takes "weeks" — at wallet.dat GPU rates that is on the order of a hundred million years, so it is already unrealistic for wallet formats; smart attacks only work when memory clues collapse the search space.
 Corrected: the btcrecover install guide now uses a virtual environment instead of suggesting --break-system-packages as a routine fix — that flag bypasses Python's protection for externally managed environments and is now only mentioned as a last resort in a disposable VM/container (with exact commands for macOS/Linux and Windows).
 Corrected: the encrypted-file page now lists the separate RAR modes — RAR3-hp 12500, RAR3-p compressed 23800, RAR3-p uncompressed 23700, RAR5 13000 — with the note that the right mode depends on what rar2john produces.
 Corrected: the Exodus guide now separates desktop from mobile — seed.seco and hashcat 28200 apply to Exodus Desktop; mobile's documented recovery path for a forgotten passcode/device unlock is the official 12-word phrase or passkey restore, not the same file attack.
 Corrected: the first-24-hours page no longer says "wallets wipe after repeated failures" broadly — that applies to hardware wallets and self-wiping devices; for wallet files, make a forensic copy and test offline against the copy.
 Corrected: the troubleshooting page now says to open only a duplicate copy in an isolated matching client version and keep the original untouched and backed up before any migration, repair or client launch.
 Corrected: the old-passwords page no longer claims a search resolves "more cases than all cracking tools combined" — it is now phrased as faster and safer in many real cases.
 Corrected: the lost-Bitcoin statistics page now notes that the High Court dismissed James Howells's claim in January 2025, effectively ending that legal route.
 Corrected: the Coinomi guide no longer says the 24-word phrase restores "on any BIP39 wallet" — it now says the wallet can usually be restored in Coinomi or another compatible BIP39 wallet, provided the same coin, account, passphrase setting and derivation path are supported.
 Corrected: the Ethereum keystore guide no longer claims "almost every Ethereum wallet" can produce or open a keystore JSON — it now names the tools that do (geth, MyEtherWallet, MyCrypto, some legacy wallets) and warns that modern wallets often use seed phrases, browser vaults or hardware-wallet flows instead.
 Corrected: the benchmark/calculator tables no longer present BIP39 and Electrum passphrases as "KDF + ECC" — they now read as PBKDF2-HMAC-SHA512 with the iteration count, and note that candidates are verified by deriving target addresses (BIP39) or keys (Electrum ECIES/BIE1).
 Corrected: the password-vs-seed-phrase page no longer lumps PIN and passphrase together as "solvable" — a forgotten PIN is usually bypassed by restoring on a new device, while a forgotten extra passphrase still has to be remembered or reconstructed (the seed alone may open a different wallet).
 Corrected: the annual restore-test on the never-lose-access page now separates software-wallet backups (test in an isolated/offline environment) from hardware-wallet backups (use the manufacturer's on-device recovery check or dry-run, or a spare/wiped compatible hardware wallet) — it explicitly warns not to enter a hardware-wallet seed into a software wallet on an ordinary computer merely to test the backup.
 Corrected: the 1Password table is no longer presented as "8200 = newer format" — it now lists 6600 (agilekeychain, legacy), 8200 (cloudkeychain, legacy/later) and 31800 (mobilekeychain, 1Password 8), and notes that modern accounts also use a Secret Key alongside the account password.
 Corrected: the Bitwarden entry no longer implies every modern data.json simply maps to hashcat mode 23400 — it now says to determine the account's KDF first, that mode 23400 and the standard bitwarden2hashcat workflow cover the format they were designed for, and not to assume an Argon2id-configured vault follows the same route.
 Corrected: the Ethereum keystore guide no longer presents 262,144 as a spec-mandated PBKDF2 default — keystore files are self-describing, geth commonly uses scrypt N=262,144, and for PBKDF2 the file's own c value applies (Web3 Secret Storage prescribes no universal count).
 Corrected: the John the Ripper guide no longer tells Debian/Ubuntu users to run "sudo apt install john" as the jumbo build — that package is the core build without wallet formats or *2john.py scripts; the guide now points to Openwall's official jumbo releases/source builds and verifies with "john --list=formats" and "ls run/*2john.py".
 Corrected: the John restore command is now "john --restore=wallet1" (Openwall's documented syntax), and the hashcat resume command is now "hashcat --session wallet1 --restore" instead of the invalid "hashcat --restore wallet1".
 Corrected: John the Ripper is no longer described as architecturally CPU-only — jumbo runs on CPUs and, for supported formats, can also use OpenCL/GPU acceleration; for many wallet workflows CPU remains the practical path.
 Corrected: the benchmark methodology no longer claims "three runs with the spread shown is a measurement" while publishing single values — it now advises repeating tests on your own hardware to estimate variance, and the page's "every number is a real run" claim now distinguishes tabulated measurements from labelled estimates (the MetaMask 90× figure is explicitly an extrapolation).
 Corrected: the hybrid-attack command on the cheat sheet now uses hashcat's documented argument order for -a 7 — mask first, then the dictionary (hashcat -m 11300 -a 7 wallet.hash '?u?l' words.txt).
 Corrected: Yoroi is no longer listed under the "same command for every one" btcrecover block — it now points to BTCRecover's dedicated --yoroi-master-password workflow after extracting the encrypted master-password value from the wallet data.
 Corrected: the "no wallet file" page now separates current Blockchain.com wallets (12-word Recovery Phrase) from legacy pre-2016 Blockchain.info wallets (recovery mnemonic with fewer or more than 12 words, which may reveal the wallet password from the time the phrase was created).
 Corrected: the encrypted-documents table now splits TrueCrypt (6211–6243 legacy / 29311–29343 current), VeraCrypt (13711–13783 legacy / 29411–29483 current) and LUKS (14600 legacy v1 / 29511–29543 newer) with their correct current extractors (truecrypt2hashcat.py / veracrypt2hashcat.py / luks2hashcat.py).
 Corrected: the custodial-reset table no longer claims self-custody 2FA is always "the same no-reset situation" — recovery depends on the wallet architecture, and some self-custody 2FA wallets such as Electrum 2FA can be restored from the wallet seed without the second factor.
 Corrected: the calculator page's password-space definition is now mathematically correct — character-set size raised to the password length (not length × character set).
 Corrected: the encryption page no longer claims "6 or fewer characters, even random, is usually crackable within days" — feasibility depends on the candidate space and the wallet's per-guess cost; memory-hard formats like BIP38 make even short random passwords expensive to exhaust.
 Corrected: the fork-wallet page now scopes its claims to Bitcoin Core-derived fork clients (Litecoin Core, Dogecoin Core, Core-codebase Bitcoin Cash node wallets, Dash Core) — non-Core wallets such as Electron Cash use different wallet formats.
 Corrected: the "Token length exception" entry no longer blames long wordlist candidates — the real cause is a hash line that does not match the token structure expected by the selected mode (wrong mode, malformed hash, truncation, extra fields, prefixes or separators).
 Corrected: the troubleshooting page no longer claims memory-hard modes are CPU-bound — they can be memory-limited and may perform better on CPU for some parameter sets, but hashcat can run parts of scrypt on the GPU; check mode/GPU support and device memory instead of dismissing 0 H/s.
 Corrected: the master list no longer says the "24-word phrase" is Yoroi's faster path — wallets created directly in Yoroi use a 15-word recovery phrase; Yoroi can also restore compatible 24-word Cardano wallets created elsewhere.
 Corrected: the identifier page now notes that traditional MetaMask wallets are SRP-based, while wallets created with Google, Apple or Telegram login use a different recovery model in which the password can also be required.
 Corrected: the MetaMask guide now states explicitly that you can copy or export the extension's vault data (the app does not need to be open or logged in) and use that copied data offline with metamask2hashcat.py or btcrecover's extract-metamask-vaults.py.
 Corrected: Keplr is no longer classified as universally supported by keplr2john.py — the legacy extension format is, while Keplr v2/current formats should not be assumed compatible until the vault format is identified (openwall/john issue #5481).
 Corrected: Dogechain.info is no longer lumped into the bitcoinj scrypt group with Litecoin/Dogecoin Android wallets — it is listed as its own workflow (wallet.aes.json / extract-dogechain-privkey.py).
 Corrected: the Bitcoin Wallet Android/BlackBerry entry no longer presents a fixed "4-digit PIN" — the numeric spending PIN is a small search space when its approximate length is known, and the length varies (btcrecover searches 1–6 digits).
 Corrected: the encrypted-file page no longer maps all .zip files to hashcat 13600 — WinZip AES is 13600, while PKZIP/ZipCrypto uses 17200/17210/17220/17225 depending on the extracted hash.
 Corrected: the glossary no longer presents Phantom as universally a 12-word seed-based wallet — traditional Phantom wallets use a 12-word recovery phrase, while Google/Apple account-based Phantom wallets with a PIN follow a different recovery model.
 Corrected: the password-vs-seed-phrase table no longer lumps BIP38 into the plain private-key row — a BIP38 string is a passphrase-protected private key (6P…) recoverable by testing candidate passphrases offline, now listed as its own row.
 Corrected: the protect-your-files rule no longer says "never enter your seed phrase into an app, ever" — it now distinguishes the official software-wallet restore flow from websites/chats/unknown tools, and says hardware-wallet seeds go only into the device itself or the manufacturer's approved on-device recovery flow.
 Corrected: the password-vs-seed-phrase page no longer presents "seed phrase = 12–24 words" as universal — BIP39 seeds are usually 12–24 words, but families such as Monero (25-word legacy / 16-word Polyseed) differ; the page now says to identify the wallet family before judging by word count.
 Corrected: the PIN/device-code row is split into hardware-wallet PIN/phone passcode (a local device lock, usually not a cracking case) and wallet-app spending PIN (app-level, may be recoverable for supported formats such as Bitcoin Wallet for Android/BlackBerry via btcrecover's numeric PIN search).
 Corrected: the btcrecover wildcard example no longer says %1,6a means "one to six letters" — it is one to six lowercase ASCII letters, with %ia noted for positions that could be lower- or uppercase; the wildcard legend now lists %a/%A/%ia correctly.
 Corrected: the wallet.dat FAQ no longer says "opens without asking for a password = never encrypted" — an encrypted Bitcoin Core wallet can load and display information while locked, with the passphrase required only for private-key operations; check the wallet's lock/encryption state instead. The same correction was applied to the troubleshooting entry that repeated the claim.
 Corrected: the password-vs-seed-phrase page no longer says legitimate password recovery "never needs your seed phrase" without exception — wallet-file recovery does not need it, but BIP39/SLIP39 extra-passphrase recovery tests candidates locally using the seed/mnemonic or required shares; those still never go into a website, form, email, chat or unknown tool.
 Corrected: the BIP39 passphrase benchmark no longer shows a GPU rate — GPU acceleration exists for BIP39 seed recovery, but not for passphrase recovery in the documented btcrecover workflow, so the CPU rate is the one to use (benchmarks table + calculator + calculator widget notes).
 Corrected: the calculator's GPU column now shows the real measured GPU rates for BIP38 (43/s, slower than CPU 72/s) and Electrum 2.8+ (4,300/s, slower than CPU 29,670/s) instead of copying the CPU rate into the GPU cell, with notes explaining the GPU path is slower for those formats.
 Corrected: the encrypted-file page no longer says modern LUKS2 has "no official mode — treat as unrecoverable" — current hashcat versions support some LUKS2 Argon2 configurations (e.g. mode 34100, argon2id + SHA-256 + AES), while other variants may still be unsupported or impractical; identify the exact KDF/hash/cipher parameters first.
 Corrected: the Electrum guide no longer says to restore a fork seed in "any fresh Electrum install" — restore in the matching Electrum-family wallet for that coin (Electrum for Bitcoin, Electron Cash for Bitcoin Cash, Electrum-LTC for Litecoin, etc.), and do not assume a fork seed belongs in ordinary Bitcoin Electrum.
 Corrected: the Blockchain.com guide no longer calls v3 "genuinely slow" while its own table shows v3 (5,450/s) faster than v2 (2,770/s) — it now says v0 is extremely fast, v2/v3 are much slower than v0 but still weak versus modern formats, and v3 is faster than v2 in the shown benchmark.
 Corrected: the MultiBit page now gives the official end-of-support date — both MultiBit Classic and MultiBit HD were discontinued, with support and maintenance ending on 26 July 2017 (previously listed as 2016 / "around 2017").
 Corrected: the central what-to-do decision tree no longer says "a wallet that opens without asking for a password was never encrypted" — an encrypted wallet can load and show public data while locked, so check the wallet's encryption/lock state instead (same correction as the wallet.dat FAQ).
 13 August 2026
 New: live search and filter in the glossary — type a term and the matching definitions stay; the counter shows how many of the 30 terms match.
 New: KDF flow diagram on how wallet encryption works — password → key derivation → encryption key → encrypted file.
 New: candidate count and time estimate in the offline token list builder (per wallet format and hardware).
 New: "When you only remember part of it" section in the password hint list guide — the four partial-memory patterns with btcrecover and hashcat syntax.
 Expanded: FAQ from 11 to 15 questions, including "no wallet file?", "do I need a GPU?" and "is it legal?" — in English and Dutch.
 New pages: anti-scam guide (should you pay a recovery service?), the reported-services list, how scammers find you, when it is not a password problem, the offline recovery toolkit, and the offline file detector.
 Corrections: MetaMask speed claim aligned with the measured benchmarks; Monero KDF naming unified across guides and glossary; Office hashcat modes corrected on the encrypted-file page; the Blockchain.com "email reset" claim removed — the wallet password cannot be reset by the provider, only the account.
 Corrections (Dutch site): the Dutch FAQ, token builder and hint-list pages caught up with the English versions; the translation pipeline now regenerates the Dutch LLM export after translating, so the Dutch version can no longer ship the English intermediate state.
 Corrections (diagnosis quiz): answering "I don't know where the wallet file is" now stops the quiz immediately with the find-the-file verdict and a seed-phrase check — instead of continuing with questions that only matter once the file exists.
 10 August 2026
 Full site audit: every page checked for structure, internal links, JSON-LD validity, search-index completeness and thin content.
 Rich schema strengthened site-wide: Organization, Person, WebSite, speakable answer boxes and FAQPage schema on every matching page.
 Mobile tables restacked with column labels so every table reads top-to-bottom on a phone; navigation rebuilt (light theme, clean dropdowns, works on all breakpoints); dark mode added.
 Core Web Vitals: layout shift reduced to zero via a font-loading fix; reading-progress bar and print stylesheet added so guides print cleanly.
 New walkthroughs and guides: btcrecover, hashcat and John the Ripper step-by-step pages, the per-wallet guides (Monero, MetaMask, old phones), and the "no wallet file" answer.
 6–9 August 2026
 Site launched: the diagnosis quiz, the nine-step recovery path, per-wallet guides, the master list of wallets, benchmarks, calculators and the offline-first tool set.
 All "last reviewed" dates are shown per page; technical claims carry sources from official repositories and documentation.
 Subscribe to updates via Atom feed — or bookmark this page; corrections are logged the same way as additions.
 This page lists user-visible changes. The full verification log (every correction and why) lives in the project documentation; contact us if you spot anything that should be here.
# Every guide in order — diagnose, search, rebuild the password, run the tool.
URL: https://forgotwalletpassword.com/guides

Crypto Wallet Password Recovery Guides — the Complete Index
 Skip to content
 The complete index
 Wallet password recovery guides
 Every guide on this site in one place, in the order that works: first understand exactly what you lost, then search for it, rebuild the password from memory, pick the right tool and run it. Everything is free, runs offline on your own machine, and is written in plain English. Use this page as the numbered path through the guides — the homepage is the visual index, and the master list is the wallet-by-wallet verdict.
 By Robbert Bink · Updated 13 August 2026
 The core path
 Understand your problem — in order
 Start with 01 if you’re not sure what you lost. Each step links to the next; you can enter anywhere, but the order is the journey.
 01
 What to do first
 The diagnosis flow in reading form — see where each branch leads, then jump to the right guide.
 Read the flow →
 02
 What did you lose?
 Password, seed phrase, PIN or passphrase — four different problems with four different answers.
 Start here →
 03
 Exchange & custodial wallets
 Forgot your exchange password? That’s a reset, not a recovery case — KYC, email and 2FA paths.
 Just reset it →
 04
 The first 24 hours
 Your action plan in order — what to protect, what to note down, and what never to do.
 Start the action plan →
 05
 Where old passwords hide
 Password managers, browsers, notes apps, old emails, device backups — most are found, not cracked.
 Search the trails →
 06
 The ultimate search checklist
 68 places a forgotten password or seed can hide — paper, devices, backups, old accounts — tick by tick.
 Work the checklist →
 07
 How your memory made it
 Human passwords follow habits: dates, names, substitutions, keyboard patterns. Rebuild yours the way your brain built it.
 Rebuild the pattern →
 08
 Is wallet password recovery possible?
 Wallet formats, encryption, GPU speeds — and the line between “hard but doable” and “mathematically impossible”.
 Read the feasibility →
 09
 Protect your wallet files
 Five moves that decide whether your case stays recoverable — before you touch anything, install anything, or pay anyone.
 Secure the evidence →
 Recovery guides
 The situations around the core path
 Seed passphrases, encrypted files, password managers, finding the file — and the real exceptions when there is no file at all.
 Seed phrase passphrase
 The 25th/13th word — a password on top of your seed, and one of the most recoverable types there is.
 The 25th word explained →
 Wallet password in an encrypted file
 The wallet password locked inside a password-protected ZIP, Office file or PDF — recover the document.
 Recover the document →
 Password manager recovery
 Your wallet password may sit inside KeePass, LastPass, Bitwarden or 1Password — recover the manager first.
 Open the manager guide →
 How to find your wallet file
 Exact default paths for wallet.dat, Electrum, keystores and vaults on Windows, macOS and Linux.
 Locate the file →
 Wallet file on an old phone
 The vault only exists in phone app storage? Extraction comes before the crack — ADB, iTunes, browser vaults.
 Get the vault out →
 Recovery without the wallet file
 No file, no seed, no backup? The answer and the real exceptions that still work.
 Read the exceptions →
 Tools & walkthroughs
 Pick a tool and run it yourself
 The candidate list decides the case; the tool runs the test. Choose the right one, then follow the full walkthrough.
 Choose the right tool
 btcrecover, hashcat and John the Ripper compared side by side — which one fits your wallet and your clues.
 Pick your tool →
 Why online “crackers” are risky
 The technical answer — every check runs against the file on your machine, so all real tools run offline.
 Read why →
 How wallet encryption works
 Key derivation, iteration counts, GPU speeds — the cryptography that decides whether your password can ever be cracked.
 Understand the math →
 Convert a wallet to a hash line
 The extraction step for hashcat: bitcoin2john, electrum2john and friends — exact commands and modes.
 Extract the hash →
 btcrecover step by step
 Install, token list, run, result — reads wallet.dat, Electrum, MultiBit and most Bitcoin-era wallets directly.
 Start btcrecover →
 hashcat step by step
 Modes, masks, wordlists and GPU speed — for wallet.dat, keystores, Electrum, MetaMask and more.
 Start hashcat →
 John the Ripper step by step
 The specialist walkthrough — Monero .keys, keystores and the other formats only JtR reads.
 Start John the Ripper →
 Build a password hint list
 Turn everything you remember into the candidate list that decides recovery, with a practice demo and an offline builder.
 Build your list →
 Command cheat sheet
 Every wallet format, one command — extract, mode, run, in a single quick-reference table.
 Open the cheat sheet →
 Troubleshooting
 “No hashes loaded”, token length exceptions, wallets that won’t load, GPU not used — errors, causes and fixes.
 Fix your error →
 By wallet
 Find your wallet, get its verdict
 The wallet-specific pages live in two hubs: identify the file first, or jump straight to the master list of verdicts.
 Identify your wallet file
 The identifier widget — match your file by name, extension or app and land on the right guide.
 Identify the file →
 The master list of wallets
 Every major wallet with a verdict: reset, crackable offline, or impossible — filterable and searchable.
 See your verdict →
 The full sets by file format and wallet / app live on the home page, next to the reference library.
# The full hashcat walkthrough — modes, masks, wordlists.
URL: https://forgotwalletpassword.com/hashcat-step-by-step

Recover a Wallet Password with hashcat — Step by Step
 Skip to content
 Step-by-step guide · hashcat · GPU-accelerated, free
 How to run hashcat yourself — the complete walkthrough.
 hashcat is the fastest general-purpose password cracker, and it supports a wide range of common wallet-password formats. The price of that speed: your wallet must first be converted to a one-line hash, and you must know your mode. This is the exact path, with the official mode list and honest limits.
 By Robbert Bink · ~6 min read · Published 7 August 2026 · Last reviewed: 14 August 2026
 The headline
 hashcat is the fastest general-purpose password cracker, and it handles the crypto wallet formats — once your wallet file is converted into the small “hash line” it works with. It shines when you know the shape of the password (a mask) or want to grind a wordlist at GPU speed. Same rule: no clues, no recovery.
 hashcat or btcrecover?
 If you want the simplest path for a wallet file, btcrecover reads wallets directly and its token lists are built for exactly this problem. Choose hashcat when you want masks (you remember the shape: “capital, five lowercase, two digits”), huge wordlists with rules, or the sheer speed of GPU cracking. Both are free; many people end up using both. This page assumes you’ve already read the password hint list guide — the method for building the wordlists and masks hashcat uses.
 The walkthrough — six steps
 1
 Protect the file (same rules as always)
 Work on a read-only copy, offline or on a clean machine, downloads only from official sources. The protection rules, plus the printable offline toolkit that keeps every step on paper.
 2
 Install hashcat
 Download the official binaries from hashcat.net (Windows, Linux, macOS). No installer — unzip and run. Check it:
 hashcat --version
 On macOS, brew install hashcat works too. A modern NVIDIA or AMD GPU makes a real difference; CPU-only is still fine for small token-list style runs on fast formats.
 3
 Get your wallet into a hash line
 hashcat works on a one-line “hash” extracted from your wallet — it never touches the whole file. How you get that line depends on the format:
 Wallet formatHow to get the hash line
 Ethereum keystore (UTC--…json)Needs a conversion step — ethereum2john.py reads the UTC JSON and produces the $ethereum$p*…/$ethereum$s*… line for mode 15600 (PBKDF2) or 15700 (scrypt); remove any filename: prefix. The Ethereum pre-sale format uses the same script for mode 16300.
 BIP38 paper key (6P…)No hashcat mode. The encrypted string itself is the target — btcrecover handles it directly with --bip38-enc-privkey.
 wallet.dat (Bitcoin/Litecoin/Dogecoin/BCH family)Needs a conversion step — bitcoin2john.py (John the Ripper’s run/ folder) produces the $bitcoin$… line mode 11300 needs. (btcrecover’s own extract-bitcoincore-mkey.py outputs a bc: line for btcrecover --data-extract, not for hashcat.)
 ElectrumNeeds a conversion step — electrum2john.py yields the $electrum$… line; the salt type inside the hash picks the mode (16600 for v1/2.x, 21700/21800 for 2.8+).
 Blockchain.com (wallet.aes.json)Modes 12700 / 15200 target the export — blockchain2john.py produces the line. Very early legacy V0 wallets use a separate algorithm — current hashcat includes mode 34700 for those; identify the version first. (btcrecover’s extract-blockchain-main-data.py is for its own --data-extract path.)
 MetaMask (extension/mobile vault)Point metamask2hashcat.py at the vault data — extension vaults may use 26600, 26610, 26620 or 26630 depending on the extracted hash/layout; mobile uses 31900. Use the extractor output and your installed Hashcat version to select the supported mode.
 MultiBit (Classic .key / .wallet, HD)Extract with multibit2john.py — the salt type in the hash picks mode 22500 (.key), 27700 (.wallet) or 22700 (HD).
 Exodus Desktop (seed.seco)exodus2hashcat.py converts the file to the line mode 28200 needs.
 Bisq (.wallet)bisq2hashcat.py converts the wallet file to the line mode 29800 needs.
 Note: if the conversion step feels like a project of its own, that’s the strongest argument for btcrecover instead — it does the extraction internally and reads these wallets directly. The hashcat path earns its keep when you have a specific mask or wordlist attack in mind. For the full extraction guide — where each script lives, exact commands, and how to verify the line before running — see Convert a wallet to a hashcat hash.
 4
 Pick your mode
 Every format has a number. These are hashcat’s modes — the official modes from its example-hashes list. Newer layout variants (for example MetaMask 26620/26630) may depend on your installed hashcat version, so verify the mode with the extractor output:
 ModeTarget
 11300Bitcoin / Litecoin wallet.dat
 12700Blockchain.com wallet — legacy My Wallet format (identify first; very early V0 uses 34700)
 15200Blockchain.com wallet V2/V3
 15600Ethereum keystore — PBKDF2-HMAC-SHA256
 15700Ethereum keystore — scrypt
 16300Ethereum pre-sale wallet
 16600Electrum wallet (salt types 1–3 — v1/2.x)
 18800Blockchain.com wallet — second password
 34700Blockchain.com / My Wallet — very early legacy V0 format (separate algorithm; identify before using 12700)
 21700Electrum wallet (salt type 4 — 2.8+ wallets)
 21800Electrum wallet (salt type 5 — newer wallets)
 22500MultiBit Classic .key (MD5)
 22700MultiBit HD (scrypt)
 25500Stargazer Stellar wallet (XLM)
 26600MetaMask vault (classic extension format)
 26610MetaMask vault — short hash format (newer dynamic-iteration vaults; needs the current extractor)
 26620MetaMask vault — newer layout with dynamic iteration counts (current/development hashcat; check the installed version)
 26630MetaMask vault — newer layout with dynamic iteration counts (current/development hashcat; check the installed version)
 27700MultiBit Classic .wallet (scrypt)
 28200Exodus Desktop wallet (scrypt)
 29600Terra Station wallet
 29800Bisq .wallet (scrypt)
 31900MetaMask Mobile wallet
 13400 (AES-KDF, KDBX ≤ 3); 34300 / 34301 (KDBX 4)KeePass 1/2 (password manager) — identify the version and KDF first: KDBX 4 may use Argon2 (34300) or AES-KDF (34301)
 6800LastPass (password manager)
 6600 / 82001Password (agilekeychain / cloudkeychain)
 Why the password-manager rows matter: most wallet passwords were stored somewhere, and a password manager is the most common place. If your wallet password sat in KeePass, LastPass or 1Password, recovering the manager recovers the wallet password — the full manager recovery guide. The same flow also cracks a protected document holding the wallet password: 7-Zip 11600, WinZip 13600, RAR 12500/23700/23800/13000 (mode depends on what rar2john produces), MS Office 9400–9820, PDF 10400–10700 — the encrypted-file guide has the full walkthrough.
 5
 Build the attack: mask or wordlist
 Mask attack — when you remember the shape. You remember “a capital letter, five lowercase, two digits”:
 hashcat -m 11300 -a 3 wallet.hash '?u?l?l?l?l?l?d?d'
 Mask characters: ?l lowercase · ?u uppercase · ?d digit · ?s symbol · ?a anything. Wordlist attack — a list of candidate words plus rules that mangle them (append years, digits, symbols):
 hashcat -m 11300 -a 0 wallet.hash words.txt -r rules/best66.rule
 best66.rule is the current hashcat rules file — it was renamed from best64.rule in recent versions, so if the file is missing on your install, check which hashcat version you have and use the rules file that ships with it.
 The words.txt file is your password hint list — every name, date, word and pattern you actually used. The hint-list guide includes a practice demo and a downloadable offline builder that formats the same fragments as a ready words.txt. That file is where the case is won or lost, not in the GPU.
 Hybrid attack — when one part is a word and the rest is a shape. Combine the wordlist and a mask in one run: -a 6 appends the mask to every word (“name + two digits”), -a 7 prepends it (“two letters + name”).
 hashcat -m 11300 -a 6 wallet.hash words.txt '?d?d'
 hashcat -m 11300 -a 7 wallet.hash words.txt '?u?l'
 Same candidate list as the two separate attacks — but one run covers the mixed cases a pure mask or wordlist misses.
 Three speed and workflow tips. -O enables optimized kernels where the mode supports them — often the single biggest speed-up. -w 3 pushes the workload profile to the max (the default is 2) when you want full speed and don’t mind the machine being busy. And when you know the character set but not the exact length, let hashcat walk the lengths for you: hashcat -m 11300 -a 3 wallet.hash '?d' -i --increment-min 4 --increment-max 8 tries 4 to 8 digits.
 Two more attack shapes. -a 1 combines two wordlists — every word from list one with every word from list two (hashcat -m 11300 -a 1 wallet.hash words1.txt words2.txt), ideal for “word + word” passwords. And preview any attack before committing to it: hashcat -a 3 '?d?d?d' --stdout | head prints the candidates your mask would generate.
 6
 Run it, read the result, know when to stop
 hashcat shows a live status screen (speed, progress, time). When it cracks, the password is written to the potfile and shown on screen — re-read any time with --show. Long runs deserve a named session so a reboot or a closed window doesn’t waste the work: start with --session wallet1, pause with Ctrl+C, and resume with hashcat --session wallet1 --restore. If the ETA is weeks, your list or mask is wrong, or the case isn’t viable — check the math, then widen the search or accept the verdict.
 Never upload your wallet file to a public checker or unknown website
 The entire point of hashcat and btcrecover is that the search runs on your hardware, offline. Never upload your wallet file to an online “unlocker”, public checker or unknown website — legitimate recovery runs locally, on a copy, or through a controlled written process with an extract.
 Both tools are free — tip the people who build them if they help you.
 btcrecover is volunteer-maintained open source; its own README publishes the donation addresses below, and we repeat them here. For hashcat, the project lists its own donation options on hashcat.net. This site is not affiliated with either project.
 btcrecover — current maintainer
 37N7B7sdHahCXTcMJgEnHz7YmiR4bEqCrS
 Bitcoin (BCH, LTC and ETH addresses also on the official README).
 btcrecover — original developer (Gurnec)
 3Au8ZodNHPei7MQiSVAWb7NB2yqsb48GW4
 The creator, who maintained the tool until 2017.
 Password found — now what?
 A hashcat success means the correct password was found and the wallet opens — getting the funds out safely is the next step. Do these in order:
 1
 Verify before you move anything. Open the wallet with the recovered password and confirm it loads with the expected addresses and balance before moving funds. (A wrong variant opening a different, empty wallet is a seed-passphrase phenomenon, not a verified encrypted-wallet password — see the passphrase guide.)
 2
 Store the password safely. The moment it works, save it in a password manager and keep one written fallback — then never reuse it for another wallet. That is the whole storage rule.
 3
 Note the balance first. Write down the balance and addresses before transferring, so you can spot problems immediately.
 4
 Move the funds to a fresh wallet. Old wallet software is discontinued and often unsafe to keep using — and importing old keys into modern software does not make them fresh. Create a new wallet with a new seed, back it up and verify it, then send/sweep the funds to its addresses.
 5
 Use only official software. The moment you have access is also the moment you are most careless — download wallets only from official sites, never from search ads or links in messages.
 Now that the wallet is open, make sure this never happens twice — never losing access stops round two.
 Frequently asked questions
 Do I need a GPU for hashcat?
 Not strictly — hashcat also runs on CPU, which is fine for fast formats and small searches. But for mask and wordlist attacks at scale, a modern NVIDIA or AMD GPU is what makes the real speed difference.
 Which hashcat mode is right for my wallet?
 The mode is set by the wallet format: 11300 for wallet.dat, 15600/15700 for Ethereum keystores, 26600 for MetaMask, 16600/21700/21800 for Electrum, 22500/22700/27700 for MultiBit, 28200 for Exodus and 29800 for Bisq. The mode table above lists them all.
 Why does hashcat need a hash line when btcrecover doesn’t?
 hashcat is a general-purpose cracker: it tests one-line hashes, not wallet files. btcrecover is wallet-specific and converts the file internally, which is why it is usually the simpler first choice.
 How long will a hashcat run take?
 Time equals candidates divided by guesses per second. The mode table and the benchmarks page show realistic speeds per format, and the password strength calculator turns what you remember into a time estimate.
Sources & references
 hashcat — example hashes (wallet formats & modes)
 3rdIteration/btcrecover — maintained fork (source code)
 Cite this page
 APA: Bink, R. (2026). How to run hashcat yourself — the complete walkthrough. ForgotWalletPassword.com. https://forgotwalletpassword.com/hashcat-step-by-step
 Markdown: [How to run hashcat yourself — the complete walkthrough.](https://forgotwalletpassword.com/hashcat-step-by-step)
 Do this first
 Build a password hint list
 The method behind every good mask and wordlist — turn memory into candidates.
 Build your list →
 The other tool
 btcrecover step by step
 Reads wallet files directly and builds token lists — the simplest start for most cases.
 Read the btcrecover guide →
 Understand the format
 How wallet encryption works
 KDFs, iterations and speed — why wallet.dat cracks a million times faster than scrypt.
 Read the mechanics →
 The hidden link
 Password manager recovery
 KeePass, LastPass and 1Password master passwords are crackable — and they often hold the wallet password.
 Read the manager guide →
 The third tool
 John the Ripper step by step
 The CPU-based option — Monero .keys files and wordlists/rules are its home turf.
 Read the John guide →
 The bigger picture
 Is recovery possible?
 Speeds only matter with the right verdict — the feasibility math.
 See the verdict →
# “How long to crack it?” is a math question — here's the math.
URL: https://forgotwalletpassword.com/how-long-to-crack-wallet-password

How Long Does It Take to Crack a Wallet Password?
 Skip to content
 Technical guide · real numbers, math
 “How long to crack it?” is a math question — here’s the math.
 Cracking time = password search space ÷ guesses per second. Both halves are knowable: the search space comes from the password’s length and randomness, the speed comes from the wallet’s encryption settings and the hardware. This page shows the realistic numbers for every major wallet type.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 The headline
 A 6–8 character human-chosen password can often be cracked in hours to days. A random 12+ character password from a full printable alphabet (~95 chars) is effectively impossible — no GPU farm, no tool, no service changes that. The interesting cases are in between, and that’s where memory clues (patterns, years, substitutions) do the real work.
 The two numbers that decide everything
 1 · The search space — how many passwords a cracker must try. For a password of length n drawn from an alphabet of size a (26 lowercase letters, 62 letters+digits, 95 printable characters…), it’s roughly aⁿ. Every extra character multiplies the work by the alphabet size. Randomness matters just as much: a patterned password (“Test2008!”) sits inside a much smaller space than a random one of the same length.
 2 · The guesses-per-second rate — set by the wallet’s key derivation settings. A low-round wallet.dat (reference ~68k iterations) allows thousands of guesses per second on one GPU; a high-round one (~267k) only hundreds to low thousands; a modern Ethereum scrypt keystore allows only around a hundred on the reference CPU. The full parameter table lives in when recovery is possible.
 Realistic cracking times (order of magnitude)
 Assumptions: a single high-end consumer GPU (RTX 4090-class) for the GPU rows, and the site’s measured reference rates for the slow formats. The two tables separate two very different situations: blind brute force (random password, full search space, no shortcuts) and a smart attack (wordlist + rules + masks built from your habits). Times are planning estimates, not benchmarks.
 Blind brute force — the full search space, no shortcuts
 Passwordwallet.dat (modern, GPU)Ethereum scrypt keystore (CPU)BIP38 key (CPU/GPU)
 6 lowercase, random (e.g. bfqxwm) — 26⁶ ≈ 309M candidateshours (low-round) to about a day (high-round)weeks (~37 days)weeks–months (~50–83 days)
 8 chars, letters+digits, random — 62⁸ ≈ 2.2×10¹⁴ candidatescenturies–millenniaforeverforever
 12+ random chars from a full printable alphabet (~95)foreverforeverforever
 16+ random chars from a full printable alphabet (~95)Beyond every computer on Earth, combined
 Smart attack — strong memory clues collapse the space
 Passwordwallet.dat (modern)Ethereum scrypt keystoreBIP38 key
 6 lowercase with strong clues (you know the word; small candidate list)minutes–hourshours–dayshours–days
 8 chars, letters+digits, patterned (e.g. name + year)hoursdays–weeksdays–weeks
 10–12 chars, human pattern with clueshours–days with good tokensweeks–monthsweeks–months
 Why scrypt rows are so much slower: the memory-hard KDF forces ~262,000 iterations (the geth/Web3 standard is N=2¹⁸; the suite’s reference test uses N=2¹⁷) plus large memory per guess, so the measured reference run on the 9950X CPU is around a hundred per second instead of thousands to tens of thousands on a wallet.dat. That’s why Ethereum keystores are among the harder common formats. Numbers are order-of-magnitude for planning; exact speeds vary with GPU, driver and attack type.
 The measured numbers (not estimates)
 Order-of-magnitude tables are fine for planning, but the open-source recovery community publishes actual measurements. The table below is taken from the official btcrecover benchmark suite (Ryzen 9 9950X CPU, RTX 5090 GPU, 2026 measurements) — these are real guesses-per-second figures, reproducible by anyone who runs the benchmark tool themselves:
 TargetKey derivationGuesses/sec (CPU)Guesses/sec (GPU)
 wallet.dat (low-round reference, ~68k iterations)iterated SHA-512 (EVP_BytesToKey)47211,950
 wallet.dat (high-round reference, ~267k iterations)iterated SHA-512 (EVP_BytesToKey)1223,210
 Ethereum keystore (scrypt)scrypt N=2¹⁸ (geth standard) · reference test N=2¹⁷96— (memory-hard)
 BIP38 private keyscrypt N=2¹⁴ r=8 p=87243 (OpenCL; CPU measured faster at 72)
 MetaMask vaultPBKDF2-SHA256 10k5,1605,590
 Electrum 2.8+ passphrasePBKDF2-SHA512 1k + ECC29,670— (CPU fastest)
 BIP39 passphrasePBKDF2-SHA512 2k + ECC15,25019,950
 Now translate those rates into consequences: a high-round wallet.dat (~267k, ~122 guesses/sec) is checked roughly 4× slower than a low-round one (~68k, ~472) — and an Ethereum scrypt keystore at ~96 guesses/sec is roughly 1.3× slower than that high-round row (and ~5× slower than the ~472/s low-round CPU run). Two passwords of identical length behind different rounds counts sit in completely different recovery universes. You can model your own case interactively with the password strength calculator, which runs these same measured rates.
 Why “smart” attacks beat brute force by millions
 Blind brute force over 10 characters of a full alphabet is ~10¹⁹ tries — already unrealistic for wallet formats: at the site’s own wallet.dat GPU rate of ~11,950 guesses/sec that is on the order of a hundred million years, not weeks. Smart attacks only work when memory clues collapse the search space far below full brute force. A token attack built from your memory changes the game: if you know the password was a name + year + symbol, a btcrecover token list collapses the space to plausible candidates — but the runtime is always candidate count ÷ your wallet’s measured rate. A billion candidates still means roughly 121 days at ~96 guesses/sec (Ethereum scrypt), ~161 days at ~72/s (BIP38), ~95 days at ~122/s (high-round wallet.dat on CPU) or ~23 hours even at ~11,950/s (low-round wallet.dat on GPU); only exceptional fast formats such as MultiBit Classic .key genuinely cover billions in minutes to hours. This is why reconstructing your habits is worth more than buying GPUs. See offline recovery tools for how token lists and masks work.
 Everyday examples people actually hit
 “I always use my dog’s name + my birth year” (e.g. Luna1993). With that clue, this is crackable within hours to days on any format — the token list is tiny.
 “I generated it in a password manager, 16 chars, no idea”. Not crackable. Full stop.
 “Some mix I made up in 2021, I remember it had my initials”. Recoverable with memory work plus a token attack — the clue shrinks the space by orders of magnitude.
 An old wallet.dat with a low rounds count (the ~68k reference wallet). The same passwords crack about 4× faster than the ~267k row above, because each guess is 4× cheaper. Low-round old wallets are the classic success story.
 The “instant recovery” lie
 No one cracks a strong wallet password “instantly” or “for a fee up front”. Cracking is hours to years of GPU time, or it’s impossible — there is no middle where a stranger does it in minutes for $50.
 What this means for your case
 Estimate your own space first. How long is the password, and how much do you remember about its construction? The diagnosis quiz gives a first verdict.
 Check your wallet’s era and format. An old wallet.dat cracks far faster than a modern keystore. Identify your wallet file, then read its encryption settings.
 Gather clues before buying anything. Token lists from your own memory beat hardware money. Rebuild the pattern.
 If you still need more GPU time, rent it. High-end cards go for roughly $0.20–$0.50/hour on cloud GPU marketplaces — far cheaper than buying one for a single case. Costs and the upload-safety rules are in the renting guide.
 If the math says no, trust the math. A random 16-character password is unreachable for anyone — no tool, no hardware and no helper changes that.
 Sources & references
 hashcat — example hashes (wallet formats & modes)
 Bitcoin Wiki — wallet encryption
 The full framework
 When recovery is possible
 The feasibility line for every format — with the hashcat modes and parameters.
 Read the framework →
 Put it to work
 Choose the right tool
 btcrecover and hashcat: token lists, masks and realistic expectations — safely.
 Understand the tools →
 The real leverage
 How your memory made it
 Patterns, layouts and habits — the raw material for the token lists that beat brute force.
 Rebuild your pattern →
# You didn’t lose the password. Your brain just filed it away.
URL: https://forgotwalletpassword.com/how-password-memory-works

How To Reconstruct A Forgotten Wallet Password (Methods)
 Skip to content
 Guide 07
 You didn’t lose the password. Your brain just filed it away.
 Almost nobody creates a truly random wallet password. Human passwords are built from habits — names, dates, substitutions, keyboard patterns. Reconstruct the habit and you reconstruct the password.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 13 August 2026
 Short answer
 Most human-chosen wallet passwords can be reconstructed from memory — but not by staring at a blank screen. You rebuild them the way they were built: base word + number + symbol + a personal rule. If you remember fragments or patterns, structured recall beats brute force by millions of years of computing time.
 The reason password-cracking works at all is that human passwords are not random. They are assembled from a surprisingly small library of personal ingredients. Once you accept that, the problem changes from “I’ll never remember” to “which ingredients did I use?”
 The anatomy of a human password
 Nearly every human-chosen password follows the same skeleton, in some order:
 A base word — a name, a place, a pet, a hobby, a word in your native language.
 A number — a year, a birthday, an age, a house number, a lucky number, or 1/123/007.
 A symbol — usually one of a small set: ! @ # $ . *.
 A capitalisation rule — first letter, every word (camelCase), or the letter the site forced you to capitalise.
 Substitutions — leetspeak: 3 for e, @ for a, 0 for o, $ for s, ! for i or 1.
 That is it. The universe of “personal password ingredients” is tiny compared to the universe of all possible strings — which is exactly why recovery with even one clue is realistic, and why a genuinely random password is not.
 Ask yourself the right questions
 Memory is associative. Instead of “what was the password?”, ask questions that let your brain answer sideways:
 Who & what
 Who was important to you then? What pet, child, partner, city, car, sports club or band was central to your life in that year? Which word did you use for other accounts at that time?
 When
 When was the wallet created? Year, season, age, job, city you lived in. The number in the password is often the year of a milestone: graduation, marriage, a child’s birth, buying a house.
 Keyboard layouts and physical habits
 Your fingers remember what your conscious mind forgot. Try:
 Typing it “blind” — put your hands in position and let your fingers trace the old rhythm. Muscle memory is a real, documented recall channel.
 Patterns — many passwords are keyboard shapes: qwerty, asdf, 1qaz2wsx, diagonal or zig-zag runs. If the base feels like a “shape”, name the shape.
 Adjacent keys — if your memory says o but the password “feels” one key to the right, try the shift: sites that demanded “an uppercase letter” forced thousands of people to write Password1! with a capital P.
 Old keyboard layouts — if you switched between AZERTY/QWERTY or a phone keyboard since, the password may now type differently. Try both interpretations of every character.
 The password evolution trick
 People rarely invent a new pattern for each account — they mutate one master template: Name!2020 becomes Name!2021, name2020!, Name2020$. Write down every password you can remember using today, then generate the year-shifted, order-shifted and substitution variants of each. This single step recovers a large share of forgotten wallet passwords.
 Build your candidate list
 Now turn recall into a candidate list — a plain text file of every string that could plausibly be the password. This is the raw material for everything that follows:
 1
 Free-write, then filterSpend 20 minutes writing everything: names, dates, words, numbers, symbols, old passwords. No judgement. Then underline the ones that “feel” right.
 2
 Generate the variantsFor each candidate base, write the 20–50 obvious mutations: with/without capitals, with each symbol, with each year, symbols at the start vs end.
 3
 Test the shortlist by handTry the top 30–50 candidates directly in the wallet app (carefully — see the note below about repeated attempts).
 4
 Keep the full listSave everything in your password journal. If the shortlist fails, this list becomes the token file for offline recovery tools — the next guide explains how.
 A warning about guessing in the app
 Some wallets lock you out or wipe after a number of failed attempts. Never hammer the real wallet with thousands of guesses. Test your shortlist in a copy of the wallet file, not the original — read the file-protection guide first.
 When memory is not enough
 If your password was generated by a password manager — 16+ random characters — no amount of memory work will reproduce it. That is not a failure of your method; it is a different problem, and it is why searching every stored copy comes before memory work in this guide series. And if only a few characters are missing, or you have fragments, that is still a solvable case — the clue set you just built is exactly what the tools need to run a targeted offline search.
 Next in the series
 Once you have a candidate list, the real question becomes: how fast can each wallet type be tested? That decides whether your case is a weekend project or weeks of GPU time — see is recovery technically possible? And before you run any tool, make sure your wallet files are safe: protect your wallet files.
 Next guide · 04
 Is recovery technically possible?
 Wallet formats, encryption strength and feasibility — how fast each type can be tested.
 Read the feasibility →
 Previous guide · 02
 Where old passwords hide
 The 30-minute sweep that finds most “forgotten” passwords before any memory work.
 Search the trails →
 Quick answers
 Frequently asked questions
 “How long does cracking take?” “Can a lost seed phrase be recovered?” — straight answers.
 Open the FAQ →
 The bigger picture
 Which wallet passwords can be recovered?
 Take the memory work to the table — every wallet, one verdict.
 See the master list →
# Why some wallet passwords can be cracked and others can't.
URL: https://forgotwalletpassword.com/how-to-check-wallet-encryption

How Wallet Encryption Works — KDFs, Iterations & Speeds
 Skip to content
 Technical guide · cryptography in plain terms
 Why some wallet passwords can be cracked and others can’t.
 Every encrypted wallet does the same thing: turn your password into a key (with a key-derivation function, or KDF), then encrypt your private keys with that key. The KDF and its parameters decide how fast a computer can try passwords — and therefore whether your case is recoverable at all.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 The one sentence that explains everything
 Recovery is a race between your password’s “search space” (length × randomness × pattern) and the cracking speed the wallet’s KDF settings allow. Weak KDF + weak password = recoverable. Strong KDF + random password = impossible, for anyone, including the biggest service in the world.
 The key-derivation players: PBKDF2, scrypt, Argon2 and SHA-512
 Almost every wallet uses one of these key-derivation approaches:
 PBKDF2 — repeatedly hashes the password with a salt. Costs are controlled by an iteration count (for Ethereum keystores the exact count is stored in the file’s kdfparams.c). Simple, but runs fast on GPUs.
 Repeated SHA-512 (wallet.dat) — Bitcoin Core’s own scheme, modelled on OpenSSL’s EVP_BytesToKey: the password and salt are hashed with SHA-512 over and over, with a rounds count chosen when the wallet was encrypted. The original baseline was ~25,000 rounds; btcrecover’s reference wallets measure ~68k to ~267k rounds. It also runs fast on GPUs.
 scrypt — memory-hard: it also forces a large block of memory, which makes GPUs and ASICs dramatically less efficient. BIP38 and Ethereum keystores use scrypt.
 Argon2 — the modern memory-hard KDF, used by newer password managers (KeePass 2 can use it) and some wallets. It is designed to be hostile to GPUs and ASICs; a strong Argon2-protected password is effectively unrecoverable by brute force.
 All the parameters below are the real defaults of each format. You can verify a wallet file’s own parameters by reading its header — the wallet identifier shows how.
 Your passworde.g. Markus2019!
 →
 Key derivation (KDF)PBKDF2 · scrypt · iterated SHA-512
 →
 Encryption key128–256 bits
 →
 Encrypted wallet filewallet.dat · keystore · vault
 Encryption: the KDF turns the password into the key that locks the file. Recovery: each candidate password goes through the same KDF and is checked against the locked file — so a wrong password always produces a key that doesn’t fit.
 Version differences change the KDF
 The same wallet name can hide very different encryption depending on the version — this is why “which version” matters before “which tool”:
 WalletVersion / eraKey derivationWhat it means for recovery
 Bitcoin Core wallet.datLegacy BDB vs SQLite-backed descriptor wallets — 0.21 introduced descriptor/SQLite; legacy BDB wallets remained commonSame iterated SHA-512; rounds are machine-tuned at encryption timeOld files often have fewer rounds — but only because the encrypting machine was slower, not because of the format.
 Electrum1.x–2.7 vs 2.8+Double SHA-256 (old) vs PBKDF2-HMAC-SHA512 1,024 iterations + ECIES/BIE1 key check (2.8+)Older files can test dramatically faster; the hash salt type picks the hashcat mode (16600 vs 21700/21800).
 MultiBit Classic.key backup vs .wallet file3×MD5 (.key) vs scrypt N=16,384 (.wallet)The .key backup is ~1,000× faster per guess — the single biggest version trap in legacy recovery.
 Ethereum keystore v3scrypt vs PBKDF2 variantscrypt (commonly N=262,144 in geth) or PBKDF2-HMAC-SHA256 (iteration count stored in kdfparams.c)Both are slow; the JSON header names the KDF (mode 15600 vs 15700) — read the actual parameters before estimating speed.
 MetaMaskextension vs mobilePBKDF2-SHA256 10,000 (classic); dynamic iterations in newer vaultsDifferent vault layout and hashcat modes (26600 vs 31900; newer vaults 26610, with 26620 only in newer/development builds) — the guide covers both.
 Version claims above are verified against the wallet sources and the benchmark suite; see the master list for the per-wallet database.
 What each wallet format actually does
 FormatCipherKey derivationCost parameters
 wallet.dat
 AES-256-CBC
 iterated SHA-512 (EVP_BytesToKey)
 dynamic — reference wallets measure 67,908–267,488 rounds; original baseline ~25,000
 Electrum 1.x–2.7
 Legacy keystore
 double-SHA-256 family (weaker)
 fast per guess — hashcat 16600 depending on salt type
 Electrum 2.8+
 Encrypted keystore / ECIES-BIE1
 PBKDF2-HMAC-SHA512 + ECC
 measured at 1,024 iterations + ECC — hashcat 21700/21800 depending on salt type
 Ethereum keystore JSON
 AES-128-CTR
 scrypt or PBKDF2-HMAC-SHA256
 scrypt N=262,144 (geth common) · PBKDF2 c stored in kdfparams
 BIP38 private keys
 AES-256 (per BIP38 spec)
 scrypt
 N=16,384 r=8 p=8
 Numbers matter: a low-round wallet.dat (~68k rounds, typical of old machines) runs about 4× faster per guess than a high-round one (~267k) — the count is machine-tuned, not a BDB-vs-SQLite rule. A BIP38 key (scrypt, heavy memory) is far slower per guess than a wallet with GPU-friendly key stretching — a single modern CPU checks only tens of BIP38 guesses per second, versus hundreds to low thousands of wallet.dat guesses.
 What “crack speed” really means (measured)
 These are measured figures from the btcrecover benchmark suite (Ryzen 9 9950X CPU, RTX 5090 GPU, 2026) — actual guesses per second on reference hardware, not marketing numbers:
 TargetGuesses/sec (CPU)Guesses/sec (GPU)Consequence
 wallet.dat, low-round (~68k)47211,950the classic success story — fast to search with clues
 wallet.dat, high-round (~267k)1223,210~4× slower per guess at 4× the rounds
 Ethereum keystore (scrypt)96—memory-hard: GPU barely helps
 BIP38 (scrypt 16k)72—memory-hard: GPU barely helps
 MetaMask vault5,1605,590fast per guess — but see the MetaMask guide
 Low-round wallet.dat rows are extrapolated from the 67,908-iteration measurement and marked as estimates; all other rows are published measurements. Want your own case modelled? Use the interactive strength calculator, which runs these same rates.
 Reading the verdict from these numbers
 8 characters of real randomness (say, a password-manager style string): effectively impossible for anyone, regardless of KDF.
 8–12 characters you chose yourself (with a word, a date, a pattern): in principle recoverable if you can reconstruct the pattern — this is where memory reconstruction becomes the whole game.
 Short passwords are not automatically easy to brute-force. Feasibility depends on both the candidate space and the wallet’s per-guess cost — memory-hard formats such as BIP38 can make even short random passwords expensive to exhaust.
 A PIN (4–8 digits): trivially fast to brute-force if the encrypted file is in your hands — which is why hardware wallets wipe after a few wrong tries instead.
 The full framework — including honest limits — is on when recovery is possible.
 What the tools actually crack: the hash line
 Cracking tools don’t attack the wallet file itself — they work on a small hash line extracted from it. That one line carries three things: the salt, the KDF parameters (which algorithm and how many iterations), and a verification value that only matches when the password is right. A wallet.dat hash line looks like $bitcoin$96$…; an Ethereum keystore is converted with ethereum2john.py, which produces the $ethereum$p*…/$ethereum$s*… hash line.
 Two things follow from this. First, the hash line is not the wallet: it is not normally a plaintext private key, but for some formats it contains sensitive encrypted wallet material — treat it as sensitive as the wallet file itself. That is why extraction scripts like bitcoin2john.py or wallet2hashcat.py should run on a copy, and why recovery always happens offline. Second, the line’s format decides your tool: hashcat needs the converted line plus a mode number (11300, 12700, 15600…), John uses the *2john scripts, and btcrecover reads most wallets directly and does the extraction internally.
 What this means for your case
 Do not delete the wallet file. Its KDF parameters and salt are the only reason cracking is possible at all.
 Gather memory clues, not guesses. A wordlist built from your patterns and habits beats blind brute force by orders of magnitude.
 Use offline tools on a copy. See offline recovery tools for btcrecover and hashcat — and why you should never upload the file to a public checker or unknown website.
 If the math says no, believe the math. A random 16-character password on a modern keystore is beyond every computer on Earth combined. No tool can change that.
 Sources & references
 Bitcoin Wiki — wallet encryption
 hashcat — example hashes (wallet formats & modes)
 The verdict framework
 When recovery is possible
 Feasible vs impossible — and the in-between cases, with hashcat modes.
 Judge your case →
 Putting this to work
 Choose the right tool
 btcrecover and hashcat explained: token lists, masks, GPU cracking — safely.
 Understand the tools →
 The human factor
 How your memory made it
 The passwords we choose follow patterns — and patterns are crackable.
 Reconstruct your pattern →
 The bigger picture
 Which wallet passwords can be recovered?
 The encryption reference meets the verdicts — every wallet in one table.
 See the master list →
# Find the file that holds your keys — before you do anything else.
URL: https://forgotwalletpassword.com/how-to-find-wallet-file

How to Find Your Wallet File — Windows, macOS, Linux
 Skip to content
 Technical guide · file locations
 Find the file that holds your keys — before you do anything else.
 Recovery always starts with the file. If the wallet file still exists on some disk, recovery is a technical problem that can be worked. If it does not exist, no amount of password guessing helps. This page shows exactly where every major wallet stores its data — on Windows, macOS and Linux.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Find the file that holds your keys before you do anything else: wallet.dat for Bitcoin Core, a UTC--*.json keystore for Ethereum, the vault in your browser profile for MetaMask, and app-data folders for Electrum and Coinomi. The exact path per wallet and operating system is below.
 Once found, copy the file read-only and work on the copy — see protect your wallet files before touching the original. If the file is gone everywhere, the real exceptions are covered in recovery without the wallet file.
 Bitcoin Core (wallet.dat)
 The classic Bitcoin wallet stores everything in a single wallet.dat file inside the Bitcoin data directory:
 OSDefault location
 WindowsC:\Users\<you>\AppData\Roaming\Bitcoin\wallets\wallet.dat (legacy) · C:\Users\<you>\AppData\Local\Bitcoin\wallets\wallet.dat (current default) — older/single-wallet setups keep wallet.dat directly in the data directory
 macOS~/Library/Application Support/Bitcoin/wallets/wallet.dat
 Linux~/.bitcoin/wallets/wallet.dat
 In older versions the file sat directly in the data directory (no wallets subfolder). Note the ~ means your user folder — on macOS, ~/Library is hidden by default (press Cmd+Shift+. in Finder or use Go → Go to Folder). A custom -datadir or -wallet flag moves it — check shortcuts and startup scripts. More in the wallet.dat guide.
 Electrum
 Electrum stores one wallet file per wallet, usually called default_wallet:
 OSDefault location
 WindowsC:\Users\<you>\AppData\Roaming\Electrum\wallets
 macOS~/Library/Application Support/Electrum/wallets
 Linux~/.electrum/wallets
 See Electrum wallet guide for the file format and what is recoverable.
 Ethereum keystores (geth, MEW, MyCrypto, MetaMask vaults)
 Ethereum “keystore” wallets are JSON files named like UTC--2026-01-15T12-34-56.789Z--<address>:
 WhereDefault location
 geth (all OS)~/Library/Ethereum/keystore · %LOCALAPPDATA%\Ethereum\keystore (current geth; legacy installs: %APPDATA%\Ethereum\keystore) · ~/.ethereum/keystore — search both Windows locations before concluding none exists
 MetaMask vaultExtension local storage: chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn → localstorage leveldb files
 imToken / ETH clonesThe same UTC--*.json keystore format if you exported one; the mobile vault itself lives in app storage
 MyCrypto / MEW exportWherever you saved the downloaded JSON file
 MetaMask is special: its encrypted vault lives inside the browser extension’s Local Storage (LevelDB), not as a JSON file you can see — so it is not an Ethereum-keystore-JSON case. With the seed phrase, restore the accounts derived from it (imported private-key/JSON accounts need their own backups); without it but with the encrypted vault still in the browser profile, offline password recovery may be possible. For real keystore JSON files, see Ethereum keystore guide.
 Other wallets
 WalletWhat to look for
 Bitcoin Cash / Litecoin / Dogecoin (Core forks)wallet.dat in the app-specific data folder (e.g. ~/.litecoin, ~/.dogecoin)
 ArmoryAn .wallet file in ~/Library/Application Support/Armory or %APPDATA%\Armory
 Bitcoin Knotswallet.dat, same layout as Bitcoin Core
 MultiBitClassic .key backup files; HD wallets keep .wallet + .wallet.aes in ~/.multibit-hd/<wallet-id> or %APPDATA%\MultiBitHD\<wallet-id> — MultiBit guide
 Exodus (desktop)seed.seco in the Exodus data folder — %APPDATA%\Exodus\ (Windows) or ~/Library/Application Support/Exodus/ (macOS) — Exodus guide
 MoneroThe <walletname>.keys file in ~/Monero/wallets/ (macOS/Linux) or Documents\Monero\wallets (Windows); older builds used ~/.bitmonero/wallets/ — Monero guide
 Blockchain.com (formerly blockchain.info)Self-custody — the crackable file is the wallet.aes.json export you downloaded yourself: check downloads folders, old email attachments and cloud storage from the era you used the wallet. For some legacy wallets, the encrypted wallet payload can also be retrieved during a login attempt without the correct password, provided you still have the Wallet ID and can satisfy any required email/2FA checks — version-dependent, not guaranteed for the current account flow. The old in-browser export only ran while you were logged in, and Blockchain.com cannot reset the password either (the sign-up email only retrieves your wallet identifier). No file? Only the 12-word recovery phrase replaces the password — recovery without the wallet file · Blockchain.com guide
 CoinomiThe scrypt vault lives in Android app storage (com.coinomi.wallet) or, on desktop, as .wallet files in the Coinomi data directory (e.g. %localappdata%\Coinomi\Coinomi\wallets) — the realistic source is a device backup or the desktop data folder: get the wallet file off an old phone — Coinomi guide
 Keplr (Cosmos)LevelDB vault in the browser extension’s local storage — back up the extension profile; keplr2john.py applies to the legacy Keplr extension format, while current/v2 vaults use a changed format — identify the version before assuming compatibility — master list
 Cardano (legacy Daedalus)secret.key from 2017–2019 Daedalus wallets — cardano2john.py extracts it — master list
 Bisqbisq.wallet — bisq2hashcat.py, hashcat mode 29800 — master list
 Stargazer (Stellar)Encrypted vault file — hashcat mode 25500 — master list
 Terra StationEncrypted wallet JSON from the desktop/mobile app — master list
 Electron-Cash (BCH)Same layout as Electrum — the wallets folder under ~/.electrum-cash/ (Linux/macOS) or the Electron-Cash folder under %APPDATA% (Windows) — master list
 MultiDoge (DOGE)A single multidoge.key file in ~/.multidoge/ (Linux/macOS) or %APPDATA%\MultiDoge\ (Windows) — master list
 mSIGNA (CoinVault)Wallet database in the mSIGNA data folder — btcrecover reads the keychain directly — master list
 Hive (macOS / Android / Web)bitcoinj-family wallet file in the Hive data folder (macOS: ~/Library/Application Support/Hive/) — master list
 Bitcoin Wallet (Android/BlackBerry) · KnC · LTC/DOGE AndroidEncrypted backup files you exported from the app (names like bitcoin-wallet-backup-…) — the spending PIN is the key — master list
 BitherThe encrypted wallet / backup file (desktop or Android export) — master list
 block.ioNo local wallet file — the wallet lives server-side; recovery targets the account “Secret PIN” — master list
 btc.com (Blocktrail)The PDF backup sheet you saved from the account — the password decrypts it — master list
 Yoroi (Cardano)Wallet data in browser-extension storage or the desktop app — extract with btcrecover; for wallets created directly in Yoroi, look for the 15-word recovery phrase first (Yoroi can also restore compatible 24-word Cardano wallets created elsewhere, such as some Daedalus wallets) — master list
 Toast WalletWallet data in the desktop/mobile app folder — passphrase via btcrecover — master list
 imTokenModified Ethereum keystore + identity.json in app storage — usually needs phone extraction: get the file off an old phone — master list
 BitSharesWallet database from the BitShares client — extract with bitshares2john.py — master list
 TezosWallet data / key file — the exact file depends on the client. Important: tezos2john.py is the ICO/fundraiser route (15-word mnemonic, fundraiser email and tz1 address), not a generic extractor for Tezos client key files — master list
 Ethereum pre-sale (2014)The presale JSON (or PDF) you saved in 2014 — hashcat mode 16300 — master list
 Trust WalletNo wallet file — seed-based, except Trust Wallet SWIFT wallets, which use a passkey tied to your Apple/Google environment instead of a 12-word phrase. The optional cloud backup (iCloud / Google Drive) is an encrypted copy of the phrase with a password you set; if you forgot that password, there is no standard public crack tool for the backup — restoring from the phrase is the real path
 Paper wallets / BIP38 / brain walletsNo file — the key is the printed text (or a photo/scan of it), or a passphrase you must recall
 Do not recognise your wallet? Use the which wallet file do you have? identifier — it walks you from clues to a shortlist of formats.
 Your wallet was on a phone
 Many wallet vaults only ever lived in a phone’s app storage — MetaMask mobile, Coinomi, imToken, Keplr, old Android wallets. If the phone still powers on, the vault may still be on it; if it doesn’t, the source is a backup. The full extraction walkthrough — ADB backups, encrypted iTunes/Finder backups, browser-extension vaults and the dead ends — is covered in get your wallet file off an old phone.
 The headline in one line: phone app storage is the one place you can’t just browse — but a backup is usually the answer. No vault and no backup: there is nothing to attack.
 Coinomi and Trust Wallet — the two most common phone-wallet questions
 These two come up constantly, and the answer is different for each:
 Coinomi. The app password locks a scrypt vault — in Android app storage (com.coinomi.wallet) on phones, or as .wallet files in the Coinomi data directory on desktop. On Android it is not a file you can browse, so the realistic source is a device backup (ADB or full-device); on desktop, check the Coinomi data folder. Either way the vault is then cracked like any other wallet file. Coinomi guide · get the file off an old phone
 Trust Wallet. Traditional wallets are seed-based, so there is no wallet file — the phrase is the real path, and the app password stops mattering once you restore it. Trust Wallet SWIFT wallets are different: they use a passkey tied to your Apple/Google environment instead of a 12-word phrase, so identify the wallet model first. The one exception on the traditional path: the optional cloud backup (iCloud on iOS, Google Drive on Android) stores an encrypted copy of the phrase behind a password you set. If you forgot that password, there is no standard public crack tool for Trust Wallet’s backup format — treat it as a remember-the-password case, not a cracking case. seed phrase passphrase · rebuild the password from memory
How to search beyond the default folders
 Search by file name — wallet.dat, default_wallet, *.json, UTC--*, *.wallet, *.aes.json.
 Search by content — strings like encrypted_key, ciphertext, BIP38, or the JSON key "crypto" that marks Ethereum keystores.
 Check old backups — external drives, NAS shares, phone backups, Time Machine, Windows File History, cloud storage. The file from years ago is still valid.
 Check deleted-but-recoverable space — if the file was deleted, undelete tools or a specialist may still pull it back from the disk, as long as it was not overwritten. Do not keep using the drive.
 Recovered files need verification — copy them somewhere safe first, then verify with the original software before you rely on them.
 If you find a file but do not know what kind it is, the how wallet encryption works page shows how to read its format markers — and the glossary explains the terms you will see.
 Next steps
 Found a file? Read how wallet encryption works, then judge feasibility on when recovery is possible.
 Nothing found? Run where old passwords hide for non-file trails, and consider whether the wallet was seed-based — then the seed, or the passphrase on top of it, matters more than any file.
 Still unsure? The wallet identifier and first 24 hours plan keep you on track.
 Sources & references
 Bitcoin Wiki — data directory
 Electrum — official wallet
 Not sure what you have?
 Which wallet file do you have?
 Identify your wallet from its name, extension and contents — with a path to the right guide.
 Identify your wallet →
 Before you touch anything
 Protect your wallet files
 The five steps that keep your only copy safe while you work on recovery.
 Read the five steps →
 What’s inside the file
 How wallet encryption works
 KDFs, iteration counts and why they decide whether your password can be cracked.
 Understand the format →
 The bigger picture
 Which wallet passwords can be recovered?
 Once you find the file, find its verdict — every wallet in one table.
 See the master list →
# The full John the Ripper walkthrough — Monero .keys, keystores, wordlists.
URL: https://forgotwalletpassword.com/john-the-ripper-step-by-step

John the Ripper Step by Step — Crypto Wallet Recovery
 Skip to content
 Step-by-step guide · John the Ripper · free
 How to run John the Ripper yourself — the complete walkthrough.
 John the Ripper is the classic open-source password cracker — the tool that has been teaching people how cracking works since the 1990s. It runs on CPUs and, for supported Jumbo formats, can also use OpenCL/GPU acceleration; for many wallet-specific workflows CPU remains the practical path. It comes with a huge collection of extraction scripts and is genuinely useful for a few wallet formats. This page tells you exactly when it makes sense — and when it doesn’t.
 By Robbert Bink · ~6 min read · Published 8 August 2026 · Last reviewed: 15 August 2026
 The headline
 John the Ripper (the “jumbo” build) supports cryptocurrency wallets, and it is the most practical tool for Monero .keys files. For wallet.dat, Electrum and most keystores, btcrecover or hashcat are the better first choice — John is slower per guess. Where it genuinely shines: the formats the other tools don’t touch, and as the clearest way to learn wordlists and rules.
 When does John the Ripper make sense?
 Short version — pick John for exactly these cases:
 Monero (.keys file). The monero2john.py script extracts a crackable hash, and John’s Monero format is the documented specialist path. No other mainstream tool handles it out of the box — the dedicated Monero guide covers file locations, speeds and the seed-first route.
 Learning the craft. John’s wordlist + rules model is the simplest way to understand how password cracking actually works before you touch GPU tools.
 Non-wallet encrypted files you also own — SSH keys, GnuPG keys, ZIP and PDF files. If your wallet password is stored behind another password, John can open that door.
 And when to skip it: wallet.dat, Electrum and BIP38 are better served by btcrecover’s token lists (it reads those files directly), and pure GPU speed for masks belongs to hashcat. John is the specialist and the teacher, not the default workhorse. If you’re not sure which tool fits, start with the tool comparison.
 The walkthrough — six steps
 1
 Protect the file (same rules as always)
 Work on a read-only copy, offline or on a clean machine, downloads only from official sources. The protection rules, plus the printable offline toolkit that keeps every step on paper.
 2
 Install the jumbo build
 You want the community “jumbo” edition — the core release alone does not include the wallet formats or the extraction scripts. Get it from the official source: Openwall’s prebuilt jumbo releases or a source build. Note that Debian/Ubuntu’s john package is the core build and does not include the wallet formats or the *2john.py scripts, so sudo apt install john is not enough for this guide:
 # macOS (Homebrew)
brew install john-jumbo
 On Windows, download the official prebuilt jumbo archive from Openwall and run john.exe from the run folder. Verify the install — and that you have the jumbo formats and the *2john.py scripts — with:
 john --version
john --list=formats | grep -i -E "monero|ethereum|bitcoin|electrum"
ls run/*2john.py
 If Monero and the wallet formats appear and the scripts are present, you have the right build. Only the official downloads — never a random “John the Ripper cracker” binary from a tutorial site.
 3
 Convert your wallet to a hash line
 John works on a one-line “hash” extracted from your wallet — never the whole file. The *2john.py scripts live in the same run folder as John and do that extraction for you:
 Wallet formatExtraction scriptNotes
 Monero (.keys)monero2john.pyJohn’s best-known wallet format — works on the modern .keys file. The seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — restores the wallet without the password, so only bother if you lost the seed too. Full Monero guide →
 Ethereum keystore (UTC--…json)ethereum2john.pySupports both PBKDF2 and scrypt keystores; the script picks the right parameters from the JSON.
 wallet.dat family (Bitcoin Core, forks)bitcoin2john.pyWorks, but btcrecover’s token lists are usually the better weapon for these — see below.
 Electrumelectrum2john.pySame story — supported, but btcrecover reads Electrum files directly with fewer moving parts.
 MultiBit (Classic .key / .wallet, HD)multibit2john.pyExtracts all MultiBit variants. The Classic .key format is extremely fast to test; btcrecover and hashcat also read it directly.
 Coinomi (scrypt vault)coinomi2john.pyOutputs the same $multibit$ hash format — btcrecover reads the vault directly and is the usual first choice.
 Blockchain.com (.aes.json)blockchain2john.pySupported, but the hashcat modes (12700 / 15200 / 18800) and btcrecover both cover this wallet too.
 Keplr (Cosmos extension vault)keplr2john.pyExtracts the password-encrypted vault from the browser extension’s LevelDB storage for the legacy extension format. Keplr v2/current vaults use a changed format — identify the version before assuming this script works.
 Cardano (legacy Daedalus secret.key)cardano2john.pyFor 2017–2019 Daedalus wallets. Modern Cardano wallets restore from the seed phrase instead — this password only protects the legacy key file.
 BitShares (light-client wallet database)bitshares2john.pyReads the wallet database used by the BitShares 2 light client and wallet.bitshares.org.
 Tezos ICO / fundraiser (15-word mnemonic, fundraiser email, tz1 address)tezos2john.pyThe ICO/fundraiser password route — not a generic extractor for password-protected Tezos client key files.
 For a Monero .keys file:
 python monero2john.py wallet.keys > monero.hash
 Then take a look — the line starts with $monero$…, which tells John which format to use. Most *2john.py scripts also accept multiple files at once, so you can extract several candidates in one go.
 4
 Pick the attack: wordlist, mask or incremental
 Wordlist with rules — your password hint list plus John’s built-in rule sets that mangle every word (append years, digits, symbols, case flips). The hint-list guide includes a practice demo and a downloadable offline builder that outputs words.txt directly:
 john --wordlist=words.txt --rules=All monero.hash
 Mask — when you remember the shape of the password (“capital letter, five lowercase, two digits”):
 john --mask='?u?l?l?l?l?l?d?d' monero.hash
 John uses the same mask characters as hashcat: ?l lowercase · ?u uppercase · ?d digit · ?s symbol · ?a anything. Incremental — for short, purely random-looking passwords with no clues at all; John’s built-in character-frequency model tries likely patterns first:
 john --incremental monero.hash
 The wordlist is where the case is won or lost — build it from memory, not from a generic list.
 5
 Run it and watch the status
 John auto-detects the format from the hash prefix and shows a live status screen — guesses per second, progress and time. You can pause with Ctrl+C and resume later with john --restore. To force a specific format (rarely needed, but useful when a line is ambiguous):
 john --format=monero monero.hash
 Check the full list of supported formats any time with john --list=formats.
 Two tips for long runs. Use more of your CPU with john --fork=4 monero.hash — the work splits across four cores (raise the number up to your core count). And name the session so pause and resume are clean: start with john --session=wallet1 --wordlist=words.txt --rules=All monero.hash, stop any time with Ctrl+C, and resume exactly where you left off with john --restore=wallet1.
 One more attack shape. John’s masks accept the wordlist as a placeholder: john --mask='?w?d?d' --wordlist=words.txt monero.hash tries every word followed by two digits — the hybrid you’d otherwise build with two separate runs.
 6
 Read the result — and know when to stop
 Cracked passwords go to John’s potfile (stored per user, typically ~/.john/john.pot). Re-read them any time:
 john --show monero.hash
 If the status screen shows an unworkable pace and no crack after a reasonable run, the real answer is that your candidates are wrong or the case isn’t viable — check the math before investing weeks. Widening a list built from real memory beats letting a GPU run blind.
 Never upload your wallet file to a public checker or unknown website
 The entire point of John, hashcat and btcrecover is that the search runs on your hardware, offline. Never upload your wallet file to an online “unlocker”, public checker or unknown website — legitimate recovery runs locally, on a copy, or through a controlled written process with an extract.
 Password found — now what?
 A John the Ripper success means the hash cracked and the wallet opens — the work isn’t done until the funds are safe. Do these in order:
 1
 Verify before you move anything. Open the wallet with the recovered password and confirm it loads with the expected addresses and balance before moving funds. (A wrong variant opening a different, empty wallet is a seed-passphrase phenomenon, not a verified encrypted-wallet password — see the passphrase guide.)
 2
 Store the password safely. The moment it works, save it in a password manager and keep one written fallback — then never reuse it for another wallet. That is the whole storage rule.
 3
 Note the balance first. Write down the balance and addresses before transferring, so you can spot problems immediately.
 4
 Move the funds to a fresh wallet. Old wallet software is discontinued and often unsafe to keep using — and importing old keys into modern software does not make them fresh. Create a new wallet with a new seed, back it up and verify it, then send/sweep the funds to its addresses.
 5
 Use only official software. The moment you have access is also the moment you are most careless — download wallets only from official sites, never from search ads or links in messages.
 Once the wallet is open, make sure this never happens twice — never losing access prevents round two.
 Frequently asked questions
 Does John the Ripper support Monero wallets?
 Yes — the jumbo build with monero2john.py is the documented path for Monero .keys files. hashcat has no Monero mode, which is why John is the specialist tool here.
 Which build of John do I need?
 The community “jumbo” edition from openwall.com/john. A distro package only works if it is a genuine jumbo build that ships the wallet formats and the *2john extraction scripts — Debian/Ubuntu’s john package is core-only and not enough for this guide.
 Is John the Ripper faster than hashcat?
 Usually slower per guess for wallet formats, where CPU remains the practical path — John jumbo can also use OpenCL/GPU acceleration for supported formats. It earns its place for formats the other tools don’t support — Monero .keys, Cardano, Keplr, BitShares, Tezos — and as the clearest way to learn wordlists and rules.
 Where does John store cracked passwords?
 In the potfile, by default ~/.john/john.pot. Re-read any cracked hash at any time with: john --show monero.hash
Sources & references
 John the Ripper — official site (downloads, jumbo builds, documentation)
 openwall/john — source code & *2john extraction scripts (run directory)
 Cite this page
 APA: Bink, R. (2026). How to run John the Ripper yourself — the complete walkthrough. ForgotWalletPassword.com. https://forgotwalletpassword.com/john-the-ripper-step-by-step
 Markdown: [How to run John the Ripper yourself — the complete walkthrough.](https://forgotwalletpassword.com/john-the-ripper-step-by-step)
 Not sure this is your tool?
 Choose the right tool
 btcrecover vs hashcat vs John — the comparison, and when each one earns its keep.
 Compare the tools →
 The other tool
 btcrecover step by step
 Reads wallet.dat, Electrum and more directly with token lists — the simplest start for most cases.
 Read the btcrecover guide →
 The fast path
 hashcat step by step
 GPU speed, masks and wordlists — the full walkthrough with the official wallet modes.
 Read the hashcat guide →
 Do this first
 Build a password hint list
 Every wordlist John runs is only as good as the candidates you feed it — build them from memory.
 Build your list →
# MetaMask vault vs seed phrase — what actually unlocks the wallet.
URL: https://forgotwalletpassword.com/metamask-wallet-password-recovery

Forgot Your MetaMask Password? Vault vs Seed Phrase
 Skip to content
 Wallet guide · MetaMask · browser extension
 Forgot your MetaMask password? The seed restores — the vault can be cracked.
 MetaMask is the most common browser wallet in the world, and its password question is usually a misunderstanding: the password only locks the vault on your device. How you recover depends on how the wallet was created. If it was created from a 12-word Secret Recovery Phrase, the phrase restores the accounts derived from it without the old password — and if the phrase is gone, the encrypted vault can be cracked offline. If it was created by signing in with Google, Apple or Telegram, the phrase is protected by the social account and your MetaMask password together, so recovery runs through that social-login flow — not the same simple vault crack. This page explains both paths plainly.
 By Robbert Bink · ~4 min read · Published 8 August 2026 · Last reviewed: 14 August 2026
 The headline
 First ask: how was this MetaMask wallet created? If it was created from a 12-word Secret Recovery Phrase, the phrase restores the accounts derived from it without the old local password — and if the phrase is gone, the encrypted vault in your browser profile can be cracked offline (PBKDF2 — legacy vaults use 10,000 iterations, newer vaults store their own count in the vault — read it, 600,000 and 900,000 are both documented — hashcat modes 26600/26610/26620), but only if the password is human-chosen and you have clues. If it was created by signing in with Google, Apple or Telegram, the Secret Recovery Phrase is protected by the social account and your MetaMask password together: recovery runs through the social-login flow, so do not assume the same local-vault crack applies. Either way, do not delete the existing vault yet: imported private-key/JSON accounts, hardware-wallet accounts, and additional SRPs may require separate recovery material. Verify every expected address before deleting or overwriting the original vault.
 First: how was this MetaMask wallet created?
 MetaMask now has two different wallet architectures, and the answer changes the recovery flow:
 Created from a Secret Recovery Phrase — the classic flow. The phrase restores the accounts derived from it anywhere; if the phrase is gone, the local encrypted vault is the offline crack target described below.
 Created by signing in with Google, Apple or Telegram — a newer flow. Your Secret Recovery Phrase is protected by the social account and your MetaMask password together. Access and recovery run through that social-login path, so “forgot password” is not automatically a local-vault crack. Follow MetaMask’s official social-login recovery documentation, and keep searching for any SRP backup — without the SRP and without social-login access, this is a different, harder situation.
 First, the almost-always-answer: the seed phrase
 MetaMask’s password never touches the blockchain. It encrypts a local file called the vault, which holds your Secret Recovery Phrase and imported keys. Reset the password or delete the extension — the funds are still on-chain, and the phrase restores the accounts derived from it anywhere. Imported accounts (private key, JSON, hardware) are not restored by the phrase — keep their private keys or the old vault until every expected address is verified. So before anything technical:
 Search for the 12-word Secret Recovery Phrase: paper backups, notes apps, password managers, old emails, screenshots, and cloud backups (see the 68-place checklist).
 If you find it, install MetaMask fresh, choose “import wallet”, enter the phrase, and set a new password. Then verify that every expected address is present — including imported accounts — before removing the old vault.
 The phrase is the real asset. Anyone with it controls the wallet, so never share it with anyone.
 If the phrase is gone — SRP-created wallets: the vault
 This route applies to wallets created from a Secret Recovery Phrase. If the wallet was created with Google/Apple/Telegram, follow the social-login recovery flow above before treating a local vault as your target.
 The vault is encrypted with PBKDF2-HMAC-SHA256 + AES-GCM. Legacy vaults fixed the KDF at 10,000 iterations; newer vaults store their own parameters in the vault data — read the actual count rather than assuming one default (values such as 600,000 and 900,000 are both documented). Fewer iterations means faster guessing — the legacy vault is among the fastest wallet formats to test, while newer vaults are often 10–90× slower per guess depending on the stored count. Three ways to approach it, in order:
 1
 Find the vault on your device
 In Chrome/Edge, the vault lives in Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn (that is MetaMask’s extension ID); in Firefox, in the extension’s indexedDB storage. You can copy or export that vault data directly — the MetaMask app does not need to be open or logged in — and the copied folder is exactly what the offline tools (metamask2hashcat.py / btcrecover’s extract-metamask-vaults.py) crack. Back up the folder before touching anything — the protection rules apply here too.
 2
 Test candidates with the official vault-decryptor
 MetaMask’s own tool (vault-decryptor) runs entirely in your browser, locally — you paste the vault data and a candidate password, and it returns the phrase if the password is right. It is the fastest test of a remembered password. Only use it offline, never upload vault data to a random site.
 3
 Run a real search with hashcat
 Convert the vault to a hash line (the community metamask2hashcat.py script does this — it reads the KDF parameters from the vault) and run the matching mode with your hint list or masks:
 hashcat -m 26600 vault.hash words.txt -r rules/best66.rule # legacy 10k vaultshashcat -m 26610 vault.hash words.txt -r rules/best66.rule # newer dynamic-iteration vaults (26620 in recent hashcat builds)
 At the legacy 10,000 iterations, a modern GPU tests roughly 5,600 candidates per second (the measured rate on an RTX 5090). A newer vault at a high stored count (900,000 is documented, but read the actual value from the vault) runs roughly 90× slower — the same tools, with a hashcat version that supports the newer vault layout, and a far longer wait. Either way, human-chosen passwords with fragments or a known pattern are realistic, but the candidate list still decides the case. The hashcat walkthrough covers the full command flow.
 The honest limits
 A random, 16+ character password is effectively unreachable — no tool, no service and no “hacker” changes that. Check the math before investing weeks.
 The iteration count is not a single number anymore. Legacy vaults used 10,000 PBKDF2 iterations; newer vaults store their own parameters in the vault data — read the actual count (600,000 and 900,000 are both documented), which can be roughly 10–90× slower per guess. Extraction tools like metamask2hashcat.py read the parameters for you, and hashcat handles the formats with modes 26600 (legacy), 26610 (newer extension vaults; 26620 in recent/development builds) and 31900 (mobile).
 Never paste vault data into an online “unlocker”. The legitimate tools run locally, on your own machine, on a copy.
 The vault is as sensitive as the seed phrase
 Whoever decrypts the vault controls the wallet. Run extraction and cracking tools offline, on your own machine, on a copy of the vault — and never share the vault data, the hash line, or the seed phrase with anyone who contacts you.
 Frequently asked questions
 Can a MetaMask password be recovered?
 The answer depends on how the wallet was created. If it was created from a 12-word Secret Recovery Phrase, you can restore the accounts derived from that phrase without the old password; keep the existing vault until you have verified every expected address (imported private-key/JSON or hardware-wallet accounts and additional SRPs need separate recovery material). Without the phrase, the encrypted vault file from an SRP-created wallet can be attacked offline: it uses PBKDF2-HMAC-SHA256 plus AES-GCM; legacy vaults use 10,000 iterations, newer vaults store the count in the vault — read the actual count from the vault data (values such as 600,000 and 900,000 are both documented). If the wallet was created by signing in with Google, Apple or Telegram, the phrase is protected by the social account and MetaMask password together — recovery runs through MetaMask’s social-login flow, not a simple local-vault crack.
 Which hashcat mode cracks the MetaMask vault?
 Mode 26600 for the classic browser-extension vault, and 31900 for the MetaMask Mobile vault. Newer extension vaults with dynamic iteration counts need the current extraction + a hashcat version that supports the vault layout (short format 26610, or 26620 in recent/development hashcat builds — not every stable release has it). The vault is extracted with the metamask2hashcat.py helper from the btcrecover project, which covers both old and new vault layouts. If the vault only exists in phone app storage, getting it out comes first: wallet file on an old phone.
 Where is the MetaMask vault stored?
 In the browser extension’s own storage on the device where MetaMask was used — the extension’s vault data under the extension ID in the browser profile. No vault file on the original device means there is no local password to attack.
Sources & references
 MetaMask — official vault-decryptor (client-side tool)
 hashcat — example hashes (mode 26600, MetaMask)
 Cite this page
 APA: Bink, R. (2026). Forgot your MetaMask password? The seed restores — the vault can be cracked. ForgotWalletPassword.com. https://forgotwalletpassword.com/metamask-wallet-password-recovery
 Markdown: [Forgot your MetaMask password? The seed restores — the vault can be cracked.](https://forgotwalletpassword.com/metamask-wallet-password-recovery)
 Understand the difference
 Password vs seed phrase
 Why the app password is only a lock on the device — and the phrase is the actual key.
 Read the difference →
 One step deeper
 Seed phrase passphrase
 MetaMask-style wallets can add a hidden 25th word on top of the phrase — and that one IS a password.
 Read the passphrase guide →
 Do this first
 The 68-place search checklist
 Most “forgotten” MetaMask passwords are actually saved somewhere — the seed or the password.
 Work the checklist →
 The master list
 Which wallets can be recovered?
 Every major wallet with a verdict — reset, crackable offline, or impossible.
 See your verdict →
# Monero has two doors: the seed restores the wallet, the .keys file is the John the Ripper path.
URL: https://forgotwalletpassword.com/monero-wallet-password-recovery

Monero Wallet Password Recovery — the .keys File, Straight
 Skip to content
 Wallet guide · Monero
 Monero wallet password recovery
 Monero has several doors. The seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — restores the wallet without the password at all; that is usually the real fix. Separately backed-up private keys plus your primary address restore a spend-capable wallet the same way. When none of that material exists, the .keys file is the password-recovery path: convert it with monero2john and run John the Ripper. This page covers all three plainly, including why there is no GPU shortcut.
 By Robbert Bink · ~8 min read · Published 10 August 2026 · Last reviewed: 14 August 2026
 The headline
 Monero password recovery starts with what you still have, not the cracker. With the seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — you restore it in the official Monero wallet (or a compatible wallet that supports the same seed scheme and derivation settings) and set a new password, no cracking. With the primary address plus the private spend and view keys backed up separately, Monero’s official “restore from keys” route rebuilds a spend-capable wallet the same way — no mnemonic and no original .keys file needed. Only when neither exists is the .keys file the recovery target: monero2john converts it, John the Ripper tests it. No hashcat mode, CPU-only — realistic for human passwords with clues.
 Three routes, one verdict
 Monero wallets were designed so that the password is not the only way in:
 You have the seed — 25-word legacy, 16-word Polyseed, or 13-word MyMonero. Restore the wallet in any official Monero wallet, set a new password, done. The old password stops mattering the moment the wallet is recreated from the seed. If the seed was written down with an optional passphrase and you forgot it, you have a password problem after all — but Monero’s passphrase is a seed offset: the mnemonic and the offset together derive a different wallet. That is Monero-specific mechanics, not the BIP39 “25th word” in the general passphrase guide — see the official restore-from-seed guide.
 You have the primary address and the private spend and view keys backed up separately. Monero officially supports restoring a spend-capable wallet from those three pieces alone — no mnemonic and no original .keys file (“restore from keys”). The old password plays no role; you simply set a new one after the restore.
 You only have the .keys file. The private keys still exist, encrypted by your password. This is a genuine password-recovery case: convert the file with monero2john and test candidates with John the Ripper.
 You have none of those. No seed, no separately backed-up keys, and no .keys file means no password recovery is possible — see recovery without the wallet file for the rare exceptions that still exist elsewhere.
 A Monero note about the “passphrase”
 Monero’s optional passphrase is not the BIP39 “25th word”. Monero calls it a seed offset: the mnemonic and the seed offset are used together to derive a new Monero wallet and seed. Restoring the same wallet therefore requires the exact mnemonic and the exact seed offset — a different offset (or none) derives a different wallet. The general passphrase guide explains the BIP39-style mechanics; for Monero, follow the official restore-from-seed guide and the wallet RPC’s seed_offset parameter. The algorithm and candidate speeds are not the same as the BIP39 case.
 What the .keys file actually is
 A Monero wallet on disk is several files, and only one matters for password recovery:
 FileRoleUseful for recovery?
 <walletname>.keysPassword-encrypted keys and wallet settings — the file monero2john readsYes — this is the recovery target
 <walletname> (no extension)Encrypted wallet cache (transaction history and wallet data)No — monero2john reads the .keys file; the cache is encrypted but not the recovery target
 <walletname>.address.txtPublic address for sharingNo — public by design
 <walletname>.cache / .old_cacheDerived cache file (not part of the standard documented wallet pair — that is <walletname> + <walletname>.keys)No — not a recovery target
 The password is never stored anywhere and no company can reset it. Instead, the wallet derives an encryption key from your password with Monero’s CryptoNight slow hash (a memory-hard KDF built to resist exactly the tools used for wallet.dat), and the private keys are stored encrypted — in newer wallets with ChaCha20, in older ones with ChaCha8. That design is why this case is slower than almost every other wallet on this site.
 Where Monero stores your wallet
 Default wallet folders, per platform:
 Windows: C:\Users\<you>\Documents\Monero\wallets\<walletname>\<walletname>.keys
 Linux: ~/Monero/wallets/<walletname>/ — older command-line builds used ~/.bitmonero/wallets/
 macOS: ~/Monero/wallets/<walletname>/ — older builds used ~/.bitmonero/wallets/
 Backups: cloud drives, USB sticks and old machines — the file may be named anything, but it always ends in .keys
 The .keys file name matches the wallet name you chose, so searching for *.keys — or for fragments of a name you remember — is the fastest find. If the wallet is on a phone or an old computer that no longer boots, the extraction step comes first: get the wallet file off an old phone or check how to find your wallet file.
 Step 1 · Protect the file
 Copy the wallet folder (at minimum the .keys file) to a read-only backup before touching anything — never work on the original, never upload it to a public checker or unknown website, and never type the seed or password into a website. The .keys file is as sensitive as the wallet itself. → Protect your wallet files
 Step 2 · Convert with monero2john
 John the Ripper’s jumbo build ships monero2john.py in its run folder. Convert your .keys file to a hash line:
 python monero2john.py wallet.keys > monero.hash
 The resulting line starts with $monero$. Do not write the file off by age: John the Ripper’s jumbo build added support for legacy Monero wallets that predate the JSON format, so run monero2john.py on the actual file first — including older binary-format wallets. If extraction fails, the case becomes format- and version-specific rather than a blanket dead end. If you still know the password, opening the old wallet in a modern Monero client may migrate it to the current format. If the password is forgotten, that migration is not a workaround — preserve the original files and identify the exact wallet version instead of assuming it is unsupported.
 Step 3 · Run John the Ripper
 Start with a wordlist plus rules — the standard approach for human-made passwords:
 john --wordlist=words.txt --rules=All monero.hash
 If you remember the shape of the password, use a mask instead; if it resembles a base word plus digits or symbols, add that pattern:
 john --mask='?u?l?l?l?l?l?d?d' monero.hash
 Re-read any cracked hash any time with john --show monero.hash. For the full install, extraction and attack workflow — including the status screen and what each switch does — follow the John the Ripper walkthrough.
 Why there is no hashcat mode
 Admittedly frustrating: hashcat has no Monero wallet mode, and none is in the maintained mode list. The reason is the KDF. CryptoNight is memory-hard — designed so that GPUs and ASICs cannot run it orders of magnitude faster than a CPU. John the Ripper implements the format and runs it on CPU; that is the documented, maintained path. Anyone selling you “GPU-accelerated Monero cracking” is describing a different coin or a different wallet family, not a Monero .keys file.
 Speed reality — read this before you start
 Monero sits at the slow end of every speed table on this site. The CryptoNight KDF makes each candidate check a memory-hard operation, CPU-bound, an order of magnitude or more below the wallet.dat family — and far below what a GPU hashcat run achieves on Ethereum keystores. The consequence: this route only makes sense with a human-made password and genuine clues. “Just run a wordlist” on a long random password will not finish. If you have fragments, patterns or habits to reconstruct, the hint-list method is what turns them into candidates — and the benchmarks page shows where Monero fits among the other formats.
 What you need before you start
 The .keys file (copy, not the original)
 Your best password clues — fragments, base words, patterns, dates
 John the Ripper jumbo from the official Openwall download — a distro package only if it is a real jumbo build with the wallet formats (Debian/Ubuntu’s john is core-only)
 Realistic expectations: seed and private-key restore first, cracking second, GPU shortcuts never
 Your wallet’s verdict is in the master list, the one-line commands in the cheat sheet, and the full workflow in the JtR walkthrough.
 Frequently asked questions
 Can I recover a forgotten Monero wallet password?
 Three routes. With the seed — 25-word legacy, 16-word Polyseed, 13-word MyMonero — you restore it in the official Monero wallet (or a compatible wallet that supports the same seed scheme and derivation settings) and set a new password, no cracking needed. With the primary address plus the private spend and view keys backed up separately, Monero’s official “restore from keys” route rebuilds a spend-capable wallet the same way. Without either, the .keys file is the password-recovery target: monero2john converts it to a hash that John the Ripper can test. It is CPU-bound and slow, so it is realistic only for human-made passwords with clues.
 Does hashcat have a Monero wallet mode?
 No. Monero’s key derivation uses CryptoNight, a memory-hard slow hash designed to resist GPUs and ASICs, and the maintained tools only run it on CPU through John the Ripper. There is no hashcat mode for Monero .keys files.
 Which file do I need for Monero password recovery?
 The .keys file (for example walletname.keys). It is the Monero file that contains the password-encrypted keys and wallet settings. The other files — the encrypted wallet cache (the extensionless walletname file), .address.txt and derived cache files — do not help with password recovery (monero2john reads the .keys file).
 Cite this page
 APA: Bink, R. (2026). Monero wallet password recovery. ForgotWalletPassword.com. https://forgotwalletpassword.com/monero-wallet-password-recovery
 Markdown: [Monero wallet password recovery](https://forgotwalletpassword.com/monero-wallet-password-recovery)
 The full workflow
 John the Ripper step by step
 Install the jumbo build, extract the hash, then run wordlists, masks and rules — with the status screen explained.
 Start the walkthrough →
 One-glance verdict
 The master list
 Every wallet on one page — where Monero sits, and what is realistic for each format.
 Check the list →
 The seed-first route
 Seed phrase passphrase
 If an optional passphrase sits on top of your seed, that is a password problem — for Monero it works as a seed offset, not a BIP39 25th word.
 Read the passphrase guide →
 The one-line commands
 Command cheat sheet
 monero2john → John, with the exact commands for every wallet on the site.
 Open the cheat sheet →
# MultiBit Classic is one of the fastest wallet formats to crack.
URL: https://forgotwalletpassword.com/multibit-wallet-password-recovery

Forgot Your MultiBit Password? Classic vs HD Explained
 Skip to content
 Format guide · legacy wallets · MultiBit
 MultiBit Classic is one of the fastest wallet formats to crack.
 MultiBit was one of the most popular Bitcoin wallets of the early 2010s, and its files still sit on old hard drives everywhere. There are two very different products: Classic, with an encryption that’s essentially theatre, and HD, with genuinely strong scrypt. Knowing which one you have changes everything.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 MultiBit Classic’s .key backup files are encrypted with just 3 MD5 iterations — exceptionally weak by modern standards, checked at up to ~1.8 million guesses per second on one CPU. The main .wallet file uses scrypt and is roughly a thousand times slower; MultiBit HD uses scrypt too. A Classic .key backup is one of the most recoverable cases that exist.
 Which wallets use this format?
 The MultiBit wallet file exists in two editions, and only MultiBit software produces them:
 MultiBit Classic — *.key key backups use a triple-MD5 scheme (exceptionally fast to crack); the main *.wallet file uses scrypt like HD
 MultiBit HD — a mbhd.wallet.aes scrypt-based keystore with a 12–24-word backup phrase (a much harder, different story)
 Both are discontinued; support and maintenance ended on 26 July 2017. The files still sit on old hard drives everywhere, which is exactly why this guide exists.
Classic vs HD: two completely different wallets
 MultiBit ClassicMultiBit HD
 File*.wallet + *.key backups — ~/.multibit / %APPDATA%\MultiBitmbhd.wallet.aes — ~/.multibit-hd / %APPDATA%\MultiBitHD
 Key derivation.key backup: 3× MD5 · .wallet: scrypt N=16384, r=8, p=1scrypt N=16384, r=8, p=1
 Measured speed~464,000 – 1,810,000 guesses/sec for the .key backup (CPU); ~510/sec for the .wallet file~123 – 510 guesses/sec (CPU)
 DiscontinuedJuly 2017July 2017
 Speeds are published btcrecover measurements (i7-10700K / Ryzen 9 9950X, 2026): btcrecover.readthedocs.io/Benchmarks. The gap between the .key backup and the scrypt-based files — roughly three to four orders of magnitude — is what a real key-derivation function buys you.
 Which file do you have? The three MultiBit formats
 MultiBit left behind three different file types, and they are not interchangeable. The file name and location tell you which one you have:
 *.wallet — MultiBit Classic, the main wallet fileFiles like default.wallet or mywallet.wallet in ~/.multibit (macOS/Linux) or %APPDATA%\MultiBit (Windows). Encrypted with the bitcoinj scrypt scheme — far slower per guess than the .key backup. If you have a .key backup for this wallet, use it.
 *.key — MultiBit Classic, private-key backupTimestamped files like walletname-20140407200743.key in the key-backup folder next to your wallet. Encrypted with the 3×MD5 scheme — exceptionally fast to test. This is the file btcrecover works with most reliably — if you have one, use it.
 mbhd.wallet.aes — MultiBit HDThe encrypted HD wallet, stored per wallet in ~/.multibit-hd/<wallet-id> or %APPDATA%\MultiBitHD\<wallet-id>. Protected by scrypt (N=16384, r=8, p=1) — a completely different, much harder recovery story. The 12–24-word backup phrase restores it without the password.
 You do not need the MultiBit app to read any of these — they are plain data files. btcrecover reads the Classic .key backups and the HD .wallet.aes directly, and can also run against the Classic .wallet file itself — but the .key backup is strongly preferred because it is much faster. hashcat mode 27700 or the multibit2john extractor are alternative routes for the .wallet. This page covers the password angle; for the complete MultiBit walkthrough — version identification, HD seed recovery, export and migration — see the dedicated guide at multibit.online.
 What the 3×MD5 .key backup means for you
 MD5 is not designed for password storage; hashing it three times changes almost nothing. The practical translation:
 a 6-character lowercase password: found in minutes, even random;
 an 8-character letters+digits password: hours to days;
 a 10-character patterned password (a word, a date, your habits): very reachable with a memory-driven token list;
 a random 12+ character password: still hard — MD5 being fast doesn’t shrink the search space, it just makes every guess cheap.
 If this is your situation, the expectation is unusually good. The 68-place search checklist may even find the password before any cracking starts.
 Getting the file out of a dead app
 MultiBit’s software is abandoned and its websites are long gone, but the files are plain data — you don’t need the app to recover:
 1
 Locate the .wallet, .key or mbhd.wallet.aes file (paths above; the OS-wide methods in how to find your wallet file help).
 2
 Copy it somewhere safe — never work on the original. (The copy rules.)
 3
 Prefer the key-backup files if you have them (MultiBit Classic): btcrecover reads the key-backup folder (e.g. %appdata%\MultiBit\multibit-data\key-backup) more reliably than the main .wallet file. For MultiBit HD, point it at mbhd.wallet.aes.
 4
 Feed the copy to btcrecover — the .key backup is its native MultiBit Classic input (btcrecover can also read the .wallet file directly, but .key is far faster; hashcat mode 27700 or the JtR multibit format are alternatives) — with token lists built from your memory.
 5
 On success, the private keys are yours again — sweep them into a modern wallet you control.
 The full tool workflow — token lists, masks, and the all-important safe usage rules — is on offline recovery tools.
 HD: a note
 If your wallet is MultiBit HD (scrypt), the easy wins are gone. The same feasibility framework as every other scrypt wallet applies: an old patterned password with good memory clues is still recoverable; a random password is not, for anyone. Run the calculator before you decide how far to go.
 Next step
 Identify which MultiBit you have (file location is usually enough — see the three formats above), secure the file, then either work the checklist or go straight to the tools — btcrecover handles both Classic and HD.
 Frequently asked questions
 How fast is MultiBit Classic to crack?
 Extremely fast for the .key backup: the 3×MD5 derivation is checked around a million times per second on one CPU, which is why Classic is one of the fastest common encrypted wallet formats to test. The .wallet and HD formats use scrypt and are far slower.
 Which file do I need for a MultiBit recovery?
 The key-backup folder’s .key file for Classic (the fast path), the .wallet file for Classic, or the mbhd.wallet.aes file for MultiBit HD. The three formats use completely different encryption, so identify the file before you start.
 Which tools read MultiBit files?
 The Classic .key backup is btcrecover’s fastest direct/data-extract path; btcrecover can also read the Classic .wallet file directly, though it is much slower — hashcat 27700 or the John/multibit2john route are alternatives that require extraction first; MultiBit HD (mbhd.wallet.aes) uses a btcrecover extract/direct workflow depending on setup, with hashcat 22700 also applying.
Sources & references
 btcrecover — performance benchmarks
 btcrecover — password recovery quick start (MultiBit Classic .key backups, HD mbhd.wallet.aes)
 Cite this page
 APA: Bink, R. (2026). MultiBit Classic is one of the fastest wallet formats to crack. ForgotWalletPassword.com. https://forgotwalletpassword.com/multibit-wallet-password-recovery
 Markdown: [MultiBit Classic is one of the fastest wallet formats to crack.](https://forgotwalletpassword.com/multibit-wallet-password-recovery)
 The tools
 Choose the right tool
 btcrecover supports MultiBit Classic and HD out of the box — token lists and masks explained.
 See the tools →
 Search first
 The ultimate search checklist
 68 places a forgotten password hides — old notebooks, email drafts, password managers.
 Work the checklist →
 Rebuild the password
 How your memory made it
 Patterns, keyboard layouts, habits — the clues that make a Classic wallet fall in days.
 Reconstruct it →
 Overview
 Which wallet passwords can be recovered?
 MultiBit’s verdict — and every other wallet — in one table.
 See the master list →
# The locked-out feeling is a one-time lesson. Learn it once, fix it forever.
URL: https://forgotwalletpassword.com/never-lose-access

How To Never Lose Access To Your Crypto Again — Prevention
 Skip to content
 Resource · prevention
 The locked-out feeling is a one-time lesson. Learn it once, fix it forever.
 Every person locked out believes it “can’t happen to me” — until it does. What keeps you in depends on your wallet: a seed, a seed plus a passphrase, or a wallet file with its password. Back up the layers that apply to you, test once a year, and the locked-out feeling is over.
 By Robbert Bink · ~7 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Access comes back through the layers your wallet actually uses — the seed phrase, a passphrase on top of it, or the encrypted wallet file with its password. Back up the layers that apply to you: the seed on paper or metal in two physical places, the files as read-only copies on offline storage, and every password or passphrase in a password manager plus your journal. Once a year, prove your own combination works with a restore test.
 The master backup rule
 Wallets on this site split into a few backup models: seed/key-based wallets (the phrase — plus the passphrase if you added one), encrypted-file wallets (wallet.dat, keystores, vaults), private-key/paper cases (BIP38, brain wallets) and hardware wallets (seed held by the device). So the number-one rule depends on what your wallet actually is:
 Write the seed on paper — two copies, two different physical locations (home + a safe, a trusted relative, a bank box).
 Or use a metal backup (stamped steel/copper) for fire and flood protection — paper burns; your access should not.
 Never store the seed only digitally — not in a screenshot, not in a notes app, not in the cloud, not in an email to yourself. Digital copies are how seeds get stolen, not how they get saved.
 If you must have a digital copy, put it in an encrypted file whose password lives in your password manager — and treat that file as a third, emergency-only backup.
 Related reading: what the seed actually is, and the passphrase on top of it — a password that can lock the derived addresses.
 The wallet-file rule
 The seed restores the wallet, but the encrypted wallet file is what offline recovery actually runs against — wallet.dat, an Ethereum keystore JSON, an Electrum file, seed.seco, a .keys backup. If you still have the file, the password stays testable offline — a recovery path that exists even when the seed is gone, as long as the password was human-chosen or you have clues. So the files get the same treatment as the seed:
 Copy the file read-only to two offline places — an external drive and a USB stick kept with your paper backup. Mark both copies read-only so no app can migrate or rewrite them.
 Keep the original format untouched — never let a newer wallet version “upgrade” or migrate your only copy; a migrated file can use different encryption that no longer matches your clues.
 Back up old exports too — .aes.json exports, MultiBit .key backups, keystore JSONs from apps you no longer use. Old formats stay recoverable; the app that made them may not.
 Log what each file is — wallet name, file type, version, and which password unlocks it. A file without its password is a half backup; a password without its file is a dead end.
 Protect your wallet files covers the exact five moves; this is the same rule from the prevention side. Not sure which files exist? Find your wallet file first.
 Multisig wallets: access depends on the required number of keys (for example 2-of-3), so there is no single seed to protect. Back up each participating key or seed according to its role, and keep the list of who holds the other keys current — a multisig wallet is only as recoverable as the combination you can still assemble.
 The password rule
 Wallet passwords — the ones that unlock encrypted files like wallet.dat or an Ethereum keystore — should be generated and stored by a password manager, never invented in your head:
 Random 16+ characters in a manager are impossible to recover if lost — but you will not lose them, because the manager remembers them. (See the feasibility arithmetic to understand why this trade-off is the right one.)
 Export and back up your manager’s vault the same way you back up the seed: two places, tested.
 Write down which manager you use and its master password location in your password journal. The single biggest “forgotten password” failure is forgetting which manager held it — the search guide exists for exactly this.
 Note which password belongs to which wallet or file — and whether you added a passphrase to the seed. The “one more thing you added” is the easiest thing to forget later.
 And the moment you recover a forgotten one — on this site or anywhere else — put it in the manager before you do anything else. That single step is what makes the recovery the last time.
 The passphrase rule — the 13th/25th word
 Some wallets let you add a passphrase on top of the seed — the “25th word” (or “13th word” on a 12-word seed). It is not part of the seed. It is a password you chose, and it changes which addresses the seed derives.
 Why this is the most dangerous “extra password”
 Enter the seed without the passphrase and you get a different, usually empty wallet. The seed alone is not the backup — the seed plus the passphrase is. Forgetting the passphrase is a password problem, not a seed problem: it is recoverable only when it was human-chosen and you still have clues.
 Store the passphrase in your password manager — it is a password, not a seed, so a manager is exactly where it belongs.
 Write it in your password journal too, with a note of which wallet it belongs to. “I probably used a passphrase” is one of the most common dead ends we see.
 Test it in the annual restore — restore with the seed plus the passphrase and confirm you land on the same address.
 The full mechanics — and when a forgotten passphrase is recoverable — are on the seed phrase passphrase guide.
 Hardware wallets and PINs
 Hardware wallets (Ledger, Trezor, Coldcard, …) are excellent prevention — but only if you understand their two layers:
 The PIN is temporary and is never the backup — but failed-PIN behavior is model-specific: devices may wipe, lock or permanently brick after their configured attempt limit (some, like Coldcard, can brick). Where the model allows, you restore from the seed.
 The seed phrase from the device’s setup card is the real backup. Store it per the master rule above — ideally before you need it.
 Write down the model and firmware setup date in your journal; it helps if you ever need to reconstruct what you set up.
 If you set a passphrase on the device (a hidden wallet), that passphrase is a second key — store it per the passphrase rule above, or the seed alone opens an empty wallet.
 The restore test (once a year)
 1
 Pick a safe momentWhen you can be offline and undisturbed. This is a test, not a repair.
 2
 Restore the layers you rely onSoftware-wallet backup: test in an appropriate isolated/offline environment. Hardware-wallet backup: use the manufacturer’s on-device recovery check or dry-run feature where available, or a spare/wiped compatible hardware wallet — do not enter a hardware-wallet seed into a software wallet or an ordinary computer merely to test the backup. Add your passphrase if you use one, and separately open a copy of the wallet file with its password. Each layer you rely on must land you on the address you expect.
 3
 Confirm, then wipe the test walletDelete the test wallet afterward. You proved the backup works without leaving a live copy around.
 4
 Update your journalNote the date and any changes (new devices, new wallets). Prevention is a habit, not a one-off.
 An emergency plan for the people you trust
 The most common permanent loss is not theft — it is a person dying or incapacitated with no one able to reach the funds. A simple sealed envelope with your seed, kept with a trusted person or lawyer, plus copies of your encrypted wallet files and a note listing which wallets, managers and passphrases you use, turns a tragedy into a solvable administrative task. Weigh this against the added attack surface — and never write down which bank or exchange the seed connects to on the same paper. Do not put every access component in one place: consider splitting information across secure locations and documenting where to find help, without storing seed phrases, passphrases and wallet-file access instructions together unless you fully understand the risk.
 What most people actually do wrong
 Photos of seeds in the cloud. Seeds emailed “for safekeeping”. A single paper copy in a drawer that floods. The only copy of your wallet file on the device that just died. A passphrase kept only in your head — so the seed now opens an empty wallet. Reusing one password everywhere, so one leak unlocks the vault. “I’ll remember it” instead of a password manager. Every one of these is a lockout waiting to occur — and every one is fixable in an afternoon.
 Already locked out? Different page.
 If you are reading this after losing access, skip the prevention — go to the first 24 hours and protect your wallet files immediately. Then come back and build the backups once you are back in.
 The basics
 What did you lose?
 Password, seed, PIN or passphrase — know the four layers before you secure them.
 Understand the layers →
 The 13th/25th word
 Seed phrase passphrase
 A password on top of the seed — and why forgetting it opens an empty wallet.
 Read the passphrase guide →
 If it already happened
 The first 24 hours
 The ordered action plan when the password is already gone.
 Follow the plan →
 The file rule
 Protect your wallet files
 The five moves that keep the files — and your recovery path — alive.
 Protect the files →
# The tools that crack wallet passwords — explained honestly.
URL: https://forgotwalletpassword.com/offline-recovery-tools

Offline Password Recovery Tools — btcrecover, hashcat, JtR
 Skip to content
 Technical guide · btcrecover · hashcat · John the Ripper
 The tools that crack wallet passwords — explained plainly.
 btcrecover, hashcat and John the Ripper are free, open-source tools that grind through password candidates offline — with honest limits, and never by uploading your file.
 New here? The complete route from a forgotten password to a recovered one: how to recover a wallet password yourself.
 By Robbert Bink · ~8 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 The headline
 These tools only work when your password lives in a searchable space — a pattern you can reconstruct, a wordlist you can build, a mask you can write. For a truly random password they are pointless. The tools are also never “upload your file and get results in a minute” services — real recovery runs offline, on your own machine.
 The three tools, in one sentence each
 btcrecover — purpose-built for Bitcoin-style wallets (wallet.dat, Electrum, and many more). Its superpower is token lists: you give it pieces (“name”, “year”, “symbol”) and rules, and it composes millions of likely passwords from them.
 hashcat — the general-purpose GPU cracker. Handles many common crypto-wallet formats too (via the modes below), plus masks, rules and dictionary attacks at enormous speed.
 John the Ripper — the classic open-source password cracker with excellent wordlist-mangling rules. Many wallet formats are CPU-oriented here, while some have GPU/OpenCL support depending on the format and the Jumbo build. Very accessible; a good first tool to learn on. Its full walkthrough covers the Monero .keys file, where John is the specialist tool — usually a CPU-style route, not a normal hashcat GPU workflow.
 Which tool should you use?
 Short version: start with btcrecover — it reads wallet files directly (including brain-wallet passphrases), and its token lists are the most effective approach for human-made passwords. Switch to hashcat when you remember the shape of the password (masks) or want dictionary + rule attacks at maximum GPU speed — the one extra step is converting your wallet to a hash line. Reach for John the Ripper when the wallet is a Monero .keys file, or when you want the clearest way to learn wordlists and rules on CPU. Whichever tool you pick, the candidate list decides the case — the hint-list guide includes a practice demo and a downloadable offline builder for all three tools. When a tool misbehaves, the troubleshooting index has the fixes, and the benchmarks page shows whether your speed is normal. And if someone offers to run this online for you? It cannot work that way.
 btcrecoverhashcatJohn the Ripper
 Best atWallet files directly + token lists built from what you rememberRaw GPU speed, masks, rules and dictionary attacksWordlists + rules with strong Jumbo format coverage; CPU-oriented for most wallet formats, Monero .keys specialist
 Wallet filesReads wallet.dat, Electrum, Blockchain.com, keystores, BIP38, MultiBit and brain wallets directly — no conversionNeeds the wallet converted to a one-line hash first via the *2john / *2hashcat extractors — see the extraction guideExtracts via *2john scripts — Monero .keys is its home turf; wallet.dat, Electrum and keystores also work
 When to pick itMost wallet cases — you remember pieces of the password and want them combined automaticallyYou remember the shape (mask), or want wordlists + rules at maximum speedMonero .keys files (a CPU-style route), or the clearest way to learn wordlists and rules
 When not toOnly when you are chasing an exact mask with no fragments — hashcat’s masks are simpler for thatWhen you have no clues at all — speed cannot replace informationWhen you need raw GPU speed (hashcat) or btcrecover’s direct wallet reading and token lists
 All three are free and run offline. Follow the walkthrough for the tool you chose: btcrecover step by step, hashcat step by step, or John the Ripper step by step (Monero & keystores).
 Hashcat modes for crypto wallets
 ModeTarget
 11300Bitcoin / Litecoin wallet.dat
 12700Blockchain.com wallet — legacy My Wallet format (identify first; very early V0 uses 34700)
 15200Blockchain.com wallet V2/V3
 15600Ethereum wallet — PBKDF2-HMAC-SHA256
 15700Ethereum wallet — scrypt
 16300Ethereum pre-sale wallet (2014)
 16600Electrum wallet (salt types 1–3 — v1/2.x)
 18800Blockchain.com wallet — second password
 34700Blockchain.com / My Wallet — very early legacy V0 format (separate algorithm; identify before using 12700)
 21700Electrum wallet (salt type 4 — 2.8+ wallets)
 21800Electrum wallet (salt type 5 — newer wallets)
 22500MultiBit Classic .key (MD5)
 22700MultiBit HD (scrypt)
 25500Stargazer Stellar wallet (XLM)
 26600MetaMask vault (classic extension format)
 26610 / 26620 / 26630MetaMask vault — newer extension layouts (dynamic iteration counts; current/development hashcat — check the installed version)
 27700MultiBit Classic .wallet (scrypt)
 28200Exodus Desktop wallet (scrypt)
 29600Terra Station wallet
 29800Bisq .wallet (scrypt)
 31900MetaMask Mobile wallet
 These numbers come from the official hashcat example hashes list — they are the standard, publicly documented modes. They matter because they tell you exactly which format your file is and what its attack profile looks like (see how wallet encryption works).
 The three attack strategies
 1
 Token list (btcrecover’s speciality)You supply fragments — names, dates, numbers, symbols you remember using — plus rules for how you combine them. The tool builds candidates like Name2020!, Name2021!, Name@2020… This is overwhelmingly the most effective approach for human-made passwords. Build your tokens with how your memory made it.
 2
 Mask attack (hashcat)When you remember the shape of the password — e.g. a capital letter, then 4 lowercase, then 2 digits — a mask like ?u?l?l?l?l?d?d limits the search to exactly that shape, shrinking the work by orders of magnitude.
 3
 Dictionary + rules (hashcat & John the Ripper)Feed a wordlist of likely words and let rules append digits, symbols, years, and case variations. Weak against truly random passwords; effective for the patterned ones.
 Realistic expectations (speeds and time)
 On a modern GPU, order-of-magnitude rates reach up to ~12,000 guesses per second on a low-round wallet.dat; a high-round one (the reference wallet measures ~267k iterations) runs in the low hundreds per second on CPU but can reach several thousand per second on GPU depending on the wallet parameters and tool path; a scrypt keystore sits around a hundred. That single factor decides whether “let the tool run overnight” is a plan or a fantasy. The feasibility guide walks through exactly this math.
 Never upload your wallet file to a public checker or unknown website
 Legitimate cracking runs offline on your own machine. Never upload your wallet file or enter your seed phrase into a public checker or unknown website — a file you upload to an unknown site is no longer under your control. A trusted written remote process works from an extracted hash line (see below), not from the wallet file.
 Need more power? Rent a GPU, don’t buy one
 If the math says “weeks on my own machine”, the first answer is a better clue set — but a real search sometimes genuinely needs GPU time. Renting is the standard solution: cloud GPU providers charge by the hour, and a high-end card costs far less to rent for a week than to buy.
 Rough cost picture. High-end consumer cards (RTX 4090-class) rent for roughly $0.20–$0.50/hour on GPU marketplaces like Vast.ai, Lambda and RunPod. A week of continuous search adds up fast — so check the feasibility math before renting anything.
 Estimate first. Run a short timed test or hashcat’s benchmark on the rented card before committing to a long run — the speed table in how long to crack shows what each format can actually do per hour.
 Upload only the hash line — never the wallet file. A rented machine is shared infrastructure, so your wallet file, keystore and seed stay offline on your own machine; only the extracted one-line hash (wallet2john, bitcoin2john or the hashcat-format line) and the candidate list ever leave it. Remote-compute safety is format- and extractor-dependent: some extracts are minimized for cloud testing, while others — such as Ethereum keystore extracts from ethereum2john.py — contain sensitive encrypted wallet material and the tool itself warns against sharing them. An untrusted rented machine may also learn the recovered plaintext password. So know exactly what your extract contains before sending it; when in doubt, keep it local — the warning above applies the same on rented hardware.
 Treat the rented machine as untrusted. Use a fresh SSH key, install nothing personal on it, keep it isolated from your wallet machine, and delete the hash and candidate files before you terminate the instance the moment the search ends.
 Safety checklist if you try it yourself
 Work on a copy. Never run tools on your only copy of the wallet file.
 Stay offline or air-gapped. Tools don’t need the internet; an infected tool or a malicious “helpful” script does. Use a clean machine.
 Download from official repositories only (btcrecover’s GitHub, hashcat.net, Openwall for John). Third-party “crackers” and tutorials shipping binaries are a classic malware vector.
 Start small. Validate your token list on a test password first so you know your setup works.
 Watch the clock. If the math says weeks, the real answer is to let the feasibility numbers decide and go back to the search checklist — a fresh clue beats more GPU time, and the wallet files stay safe meanwhile.
 Next steps
 Want to judge your case first? Is recovery technically possible?
 Need the clues to feed a token list? How your memory made it.
 Protecting the file while you work? Protect your wallet files.
 Ready to actually run them? The step-by-step guides
 This page explains the concepts. When you’re ready to run the tools, the walkthroughs below take you command by command — with the exact token syntax, the mode numbers and the honest limits.
 Tool #1
 btcrecover step by step
 Install, build a token list, run the recovery, read the result — with verified commands.
 Start the walkthrough →
 Tool #2
 hashcat step by step
 Convert your wallet to a hash line, pick the mode, attack with masks and wordlists.
 Start the walkthrough →
 Tool #3
 John the Ripper step by step
 The classic cracker with strong Jumbo format coverage — the path for Monero .keys files (a CPU-style route) and the clearest way to learn rules and wordlists.
 Start the walkthrough →
 The real key
 Build a password hint list
 Turn what you remember into the candidates all three tools test — the method behind it all.
 Build your list →
 Sources & references
 3rdIteration/btcrecover — maintained fork (source code)
 hashcat — example hashes (wallet formats & modes)
 Before you invest time
 When recovery is possible
 The feasibility framework: password space vs cracking speed, with honest limits.
 Judge your case →
 Feed the tools
 How your memory made it
 Keyboard layouts, capital letters, symbols and patterns — the raw material for token lists.
 Reconstruct your pattern →
 The bigger picture
 Which wallet passwords can be recovered?
 Every tool meets its wallet — the full table with verdict, encryption and mode.
 See the master list →
# Why online wallet password “crackers” can’t work — the honest technical answer.
URL: https://forgotwalletpassword.com/online-wallet-password-recovery

Online Wallet Password “Crackers” — Why They’re Risky
 Skip to content
 Tools · expectations
 Why online wallet password “crackers” are a risk
 Uploading your wallet file to a public checker or unknown website is never a recovery method — the file is the thing the password protects, and handing it over to a stranger is handing over the wallet. The legitimate version of remote work exists, but it uses a different material: a password-verification extract (hash line) — sensitive recovery data that should only go to a recipient you trust under a clear written process. A controlled professional engagement may also work with the encrypted file itself, but never through public uploads. This page explains the difference, what online services actually do, and why your own machine stays the safest default.
 By Robbert Bink · ~6 min read · Published 10 August 2026 · Last reviewed: 15 August 2026
 The headline
 Never upload your wallet file to a public checker or unknown website — and your seed must never leave you. The safe version of remote work uses a password-verification extract (hash line), which can contain sensitive encrypted wallet material — treat it as sensitive recovery data. A website offering “online cracking” that wants your file or seed is a theft risk; one that works from an extract is doing real remote compute. A written, trusted recovery engagement may also use the encrypted file under a controlled workflow. Local/offline stays the safest default.
 Why the wallet file itself can’t be remote
 When you set a wallet password, the wallet software derives an encryption key from that password and stores your private keys encrypted inside the wallet file. There is no server holding a copy of your password or a hash of it — unlike a website login, there is nothing “out there” to test against.
 The only verifier is the wallet file itself. To check whether a candidate password is right, a tool must run the wallet’s key-derivation on that candidate and see whether it decrypts the file. A remote service cannot run that check against the file — and the moment you upload the file, you have handed over the thing the password protects.
 That is why the site explains tools that run on your machine, and why the extract step matters: the extract reduces the wallet to the verification data — KDF parameters plus an encrypted check value — so the check can run anywhere without the wallet ever leaving you. → How wallet encryption works
 What an “online wallet password cracker” actually does
 Services that claim online recovery fall into a few categories, none of which change the math:
 File collectors. They ask you to upload the wallet file, seed or password guesses — then the data is theirs. A wallet file or seed is enough to attempt theft the moment your password is weak enough to guess anyway.
 Wrappers. The “service” downloads btcrecover or hashcat onto your machine and runs it locally. You can install those tools directly from their official sources — a wrapper adds a trust risk and nothing else.
 Fake progress. A page that asks for the wallet file or a few “hints” and then shows a progress bar. Nothing is being tested; the bar is theater until the payoff request arrives.
 Paid brute-force generators. They sell you “10 billion passwords per second” for your case. Speed without information changes nothing — see the math on how long cracking takes.
 The cloud-GPU nuance: hashes, not wallets
 If your own hardware is too slow, rented GPU time is sometimes raised as an option. The real version of that idea has one hard rule: convert the wallet to a hash line first, and send only that — never the wallet file, never the seed.
 A converted hash line (for example the output of bitcoin2john or wallet2hashcat, or the .aes.json / keystore extraction) contains the verification data for a password check. It is not normally a plaintext private key, but it can include sensitive encrypted wallet material — for some formats, possession of the extract together with the recovered password may be enough to expose wallet secrets, so treat every extract as sensitive recovery data. The extraction guide shows the exact commands. Even then, a third party handling your recovery data is a trust decision — the safest machine is always your own, and everything on this site is designed to run there.
 The one real “online” exception: account resets
 Two situations genuinely resolve without cracking, because they are not self-custody password cases:
 Custodial exchanges hold the keys and can reset your login after identity verification — an account reset, not password recovery. → Exchange & custodial wallets
 Blockchain.com can mail your wallet identifier to the email you signed up with — useful for logging in or finding your backup, but not a password reset: the self-custody wallet password is only replaced by restoring the 12-word recovery phrase. → Recovery without the wallet file
 Everything else — every self-custody wallet password — runs on your own machine, or on an extracted hash line with a service you trust under a clear written process; a controlled professional engagement may also work with the encrypted file. The wallet file itself should never leave you through public uploads.
 What actually works instead
 The real workflow is fully offline, free and open-source:
 Protect the file. Copy the wallet file and keep the original untouched. → Protect your wallet files
 Build your clue list. Fragments, base words, patterns, dates — the candidate list decides the case. → Build a password hint list
 Run the right tool. Choose the right tool — btcrecover reads most wallet files directly, hashcat takes the extracted hash line at GPU speed, John the Ripper handles the formats the others don’t (Monero .keys among them).
 That is the complete route, and none of it involves uploading your wallet file.
 Safety rules
 Never upload a wallet file, backup, seed or password guess to a public checker, unknown website, Telegram helper or Discord user — no legitimate tool or guide ever needs that. The safest route for remote work is a password-verification extract (hash line), and only to a recipient you trust under a clear written process; a controlled professional engagement may also use the encrypted file. If a page asks for your file “to check it,” that is the check itself — leave. → Protect your wallet files
 Frequently asked questions
 Can I crack a wallet password online?
 Not by uploading your wallet file — and never with your seed. The safe remote route exists: a password-verification extract (hash line) — sensitive recovery data, but never the wallet file or seed — can be sent to a cloud GPU or a trusted service. A website that asks for the wallet file or the seed is a theft risk; local/offline stays the safest default.
 Is it safe to send a wallet hash to a cloud GPU service?
 Only the converted hash line — verification data that can include sensitive encrypted wallet material, and never the wallet file or seed. Your own machine is always safer: any third party handling recovery data is a trust decision, and the rule on this site is to keep every file offline.
 My wallet password is locked and the wallet is online — can the provider reset it?
 Only for custodial wallets, and that is a reset, not cracking: an exchange can reset your login after identity verification. Blockchain.com's self-custody wallet is not reset by email — the sign-up email only retrieves the wallet identifier. For self-custody wallet files, no company has a copy of your password or a reset button.
 The tools that do work
 Choose the right tool
 btcrecover, hashcat and John the Ripper compared side by side — which one fits your case, and why all three run offline.
 Compare the tools →
 The extraction step
 Convert a wallet to a hash line
 Exact commands to turn wallet files into verification-only hash lines — the only data that could ever leave your machine.
 Read the extraction guide →
 The math
 Is wallet password recovery possible?
 Which formats are realistic, which are not, and why speed without information never changes the answer.
 Check the feasibility guide →
 The account-level exceptions
 Recovery without the wallet file
 The answer, plus the real exceptions — seed phrase, custodial accounts and brain wallets.
 Read the exceptions →
# Build a password hint list — the method that decides recovery.
URL: https://forgotwalletpassword.com/password-hint-list

Build a Password Hint List for Crypto Wallet Recovery
 Skip to content
 Method guide · the real key to wallet password recovery
 Your memory is the password list. Build it on purpose.
 Tools like btcrecover and hashcat only test what you give them. The difference between a 20-minute recovery and a wasted week is the list you build from your own memory — this page is the method, in the exact formats both tools need.
 By Robbert Bink · ~6 min read · Published 7 August 2026 · Last reviewed: 14 August 2026
 The headline
 The tool is stupid. Your list is everything. A good password hint list — every name, year, number, symbol and pattern you actually used — is what turns “let the GPU run overnight” into a 20-minute recovery. This page is the method for building that list, in both formats the tools eat: btcrecover token files and hashcat wordlists/masks.
 Want to see how a token list is built? Try the demo.
 The builder below is a practice demo with example data — jump straight to it. For your real fragments, download the offline builder: a single file that works without internet, so nothing ever leaves your machine.
 Step 0 — dump everything before you filter anything
 Your memory of the password is a reconstruction, and reconstructions need raw material. Work the 68-place search checklist first and write down every candidate password you find — old emails, notebooks, browser autofill, password managers, app backups, notes files. Then walk where old passwords hide and how your memory made the password to surface the patterns you don’t notice yourself using. Only then do you start building the list below.
 Step 1 — extract the pieces
 Go through your memory and write down, in four buckets:
 Words: names (yours, partner’s, kids’, pets’), nicknames, cities, the wallet’s own name, the exchange you bought through, words from a hobby or job.
 Numbers: years that mattered (birth year, the year you bought the crypto, the current year then), day-month patterns, house numbers, phone fragments.
 Symbols and habits: did every password end in !? Did you use @ for “a”? A 1 for an i? The punctuation habits are the most personal — and the most powerful clues.
 The shape: “capital first, then lowercase, then two digits at the end”. Even if you can’t recall the content, the shape is a hashcat mask.
 Also list every old password you’ve used anywhere — most people reuse or transform them. That’s a separate hunt: where old passwords hide.
 When you only remember part of it
 Most forgotten passwords aren’t a total blank — they’re a handful of fragments with gaps. The gap is the search space, and the trick is to write down exactly what you’re sure of before you try to fill anything in. Four patterns cover almost every partial memory:
 A remembered fragment with an unknown middle: you know it starts with Markus and ends with a year, but the middle could be anything. In btcrecover: Markus%1,6a2019 (one to six lowercase ASCII letters — use %ia if the unknown positions could be lower- or uppercase; tokens on one line are alternatives, so keep the fixed parts inside the same token without spaces). Preview the candidates that are actually generated first: python btcrecover.py --listpass --tokenlist tokens.txt. In hashcat: a mask like Markus?a?a?a?a?a?a?d?d?d?d.
 Fixed length, mixed content: “ten characters, a capital somewhere”. Use a mask with a wildcard for the capital position — or list a few positions: ?u?l?l?l?l?l?l?l?l?d and ?l?l?l?l?u?l?l?l?l?d.
 Numbers you’re sure about: a year or amount you remember is a strong anchor. Put it in a token line of its own (2019), or in a mask position (?d?d?d?d only if you’re sure it was four digits — otherwise give the mask four separate runs).
 A remembered ending: “it ended in !23”. Anchor the end with btcrecover’s $: %1,4a!23$ (no space — a space would make it an alternative, not a fixed suffix), or in hashcat fix the last mask positions: ?a?a?s?d?d. Preview the candidates that are actually generated first: python btcrecover.py --listpass --tokenlist tokens.txt.
 The honest limit: every unknown position multiplies the search. Three unknown letters at ~26 options each is ~17,600 candidates (seconds); three unknown symbols at ~30 options each is ~27,000; a whole unknown 10-character segment at ~95 options per character is roughly 10¹⁹ — beyond any list. If more than a few characters are fully unknown, focus on recovering more memory (see how your memory made it) instead of widening the mask.
 Put each pattern you remember into its own token line — Step 2 shows the syntax, and the btcrecover walkthrough has the full wildcard reference.
 Step 2 — build the btcrecover token file (tokens.txt)
 Each line of the file is a group of alternatives; btcrecover assembles one piece from each line into every password guess. The syntax that matters:
 # comment lines start with #
# one token per line · space-separated tokens on a line = alternatives
# + before a line = that piece must appear in every guess
# ^ = only at the start · $ = only at the end
# wildcards: %d digit · %1,3d 1–3 digits · %a lowercase letter · %A uppercase letter · %ia lower or uppercase · %[abc] chars · %y any symbol
Markus markus MARKUS # name, three spellings
2019 2020 2018 # year, three candidates
%0,1y # maybe one symbol at the end
 The most useful wildcards: %d (one digit), %1,3d (one to three digits), %a (one lowercase letter), %[chars] (one of the listed characters), %y (any one symbol), %0,1y (zero or one symbol). Full details and more wildcards are in the btcrecover walkthrough. Always check your list before a long run:
 python btcrecover.py --listpass --tokenlist tokens.txt
 Try the token list builder — demo with example data
 This is a practice version: type anything (or load the example below) and watch how the generator combines pieces into a ready-to-run tokens.txt. Everything lands on one line, so each entry is tried as a complete password — the same rule as the example above. For your real fragments, use the offline builder instead.
 Privacy: this demo runs entirely in your browser — no server, no network request, nothing stored. Close the tab and your fragments are gone. What to enter — and what not to ↓
 Base words — one per line (or space-separated)
 Numbers & years — comma-separated
 Symbols
 Capitalise first letter
 All caps
 Substitutions (a→@, e→3, o→0, s→$, i→!)
 Append year / number
 Prepend year / number
 Append a symbol
 Prepend a symbol
 Try separators ( _ . - )
 2-digit year variants
 Output for:
 btcrecover
 hashcat
 John the Ripper
 The same fragments produce different files: btcrecover wants a token list; hashcat and John the Ripper want a flat wordlist (one candidate per line). Pick your tool and the builder formats the output for it.
 What you should and shouldn’t enter: fragments and variations of your password are fine — the generator only combines them into candidates on your own machine. Never paste your full password, and never a seed phrase — those are worth more than any clue list, and no tool on this site ever needs them. The generated file is your candidate list: keep it offline with your wallet files and never upload it to a public checker or unknown website.
 The offline builder — for your real fragments
 Download token-builder.html — a single file that works completely without internet. Save it, double-click it on your own computer, and build your real tokens.txt there. Nothing you type on this website needs to be real.
 Step 3 — build the hashcat wordlist and mask
 Wordlist: put every word, name and number from step 1 into a plain file, one per line — that’s words.txt. Then let rules do the mangling (append years, digits, symbols, case swaps):
 hashcat -m 11300 -a 0 wallet.hash words.txt -r rules/best66.rule
 Mask: when you remember the shape instead of the content. Mask characters: ?l lowercase, ?u uppercase, ?d digit, ?s symbol, ?a anything. “Capital, five lowercase, two digits”:
 hashcat -m 11300 -a 3 wallet.hash '?u?l?l?l?l?l?d?d'
 Full details in the hashcat walkthrough. Before spending GPU time, verify what your wordlist + rules actually generate — hashcat prints the candidate stream with --stdout.
 Step 4 — the password-manager angle (check this before anything runs)
 Wallet passwords are rarely only in your head — most were saved somewhere. If the password manager you used back then is itself locked, recovering the manager recovers the wallet password. These formats are crackable with the same tools:
 Managerhashcat modeNote
 KeePass 1/213400 (AES-KDF, KDBX ≤ 3); 34300 / 34301 (KDBX 4)Identify the version and KDF first: KDBX 4 may be AES-KDF or Argon2 (hashcat 34300/34301); a keyfile makes it much harder.
 LastPass6800Needs your account’s hash — exportable before you lose access.
 1Password6600 / 8200agilekeychain / cloudkeychain vaults.
 Same rules apply: a human-chosen master password with clues is recoverable; a randomly generated one is not. And the search-first rule always wins — check old exports and backups of the manager before cracking it. Where stored passwords hide.
 Step 5 — run small, then widen
 Start tiny. The most-likely 100 combinations first — many cases end here in minutes.
 Watch the ETA. The tool tells you the timeline. If it says weeks, read how long to crack a password? and decide whether the case even makes sense.
 Iterate. Each “exhausted” run teaches you: a year was wrong, a spelling differs, a symbol sits elsewhere. Widen one dimension at a time — that’s how recoveries actually succeed.
 Know the line. If the math says impossible, no tool changes it. Treat that verdict as final: spend the effort on better clues or a complete backup, not on more GPU time.
 Ready to run? The full command-level walkthroughs: btcrecover step by step · hashcat step by step. Both tools are free; if they help you, the developers accept tips.
 Sources & references
 btcrecover — tutorial
 hashcat — example hashes (wallet formats & modes)
 The raw material
 How your memory made it
 Keyboard layouts, capital letters, symbols and old habits — the patterns behind your password.
 Reconstruct your patterns →
 Before you build
 The 68-place search checklist
 The password might already be stored somewhere — 68 places to check, tick by tick.
 Work the checklist →
 Run it
 btcrecover step by step
 Install, token list, run, result — the complete walkthrough of the tool.
 Start the walkthrough →
 The reality check
 How long to crack a password?
 Real measured guesses-per-second per format — before you invest a week.
 See the numbers →
# Your wallet password is inside KeePass, Bitwarden, LastPass or 1Password — recover the manager.
URL: https://forgotwalletpassword.com/password-manager-recovery

Forgot Your Password Manager Master Password? Recover It
 Skip to content
 Password recovery · KeePass · Bitwarden · LastPass · 1Password
 Your wallet password is probably in a password manager. Forgot the master password? Here’s the recovery path.
 Most wallet passwords are not written down anywhere except a password manager. When the master password is forgotten, the wallet password is locked inside — but the manager itself is crackable offline. This page explains how, and when it is worth trying.
 By Robbert Bink · ~5 min read · Published 8 August 2026 · Last reviewed: 14 August 2026
 The headline
 KeePass, LastPass and 1Password vaults are encrypted with a key derived from your master password — deliberately slow, but crackable. With a copy of the vault and a good candidate list, hashcat can test millions of guesses per hour. The same rule applies: human-chosen passwords with clues are recoverable; long random ones are not.
 Why this page exists
 The search checklist tells you to check your password manager first — because that is where most wallet passwords are stored. But “checking” only works if you can open the manager. If the master password itself is gone, the wallet password is not lost: it is locked behind a second password, and that second password is exactly the kind of problem this site covers. (If the password is locked inside a protected document instead of a manager, the encrypted-file guide is the matching path.)
 Which managers are crackable — and how fast
 These are the official hashcat modes, straight from the hashcat example-hashes list:
 ManagerModeWhat it means
 KeePass 1 (.kdb) / KeePass 2 (.kdbx)13400 (AES-KDF, KDBX ≤ 3); KDBX 4: 34300 Argon2 / 34301 AESKDFKeePass 1 saves as .kdb, KeePass 2 as .kdbx — the classic desktop manager. Mode 13400 covers KeePass 1 (AES/Twofish) and KeePass 2 with AES-KDF (KDBX ≤ 3). KDBX 4 does not force a single KDF: KeePass lets you choose AES-KDF or Argon2, so identify the database version and KDF first (keepass2john reports which one your file uses) — current hashcat versions support both KDBX 4 variants via 34300 (Argon2) and 34301 (AESKDF).
 LastPass (local vault cache)6800You need your own locally cached vault (never anyone else’s); the hash line uses your email, the iteration count and the vault blob.
 Bitwarden (local data.json)23400Works from your own local vault file (data.json) — extract the hash line with bitwarden2hashcat or bitwarden2john. Before extracting, determine which KDF the account uses: mode 23400 and the standard extractor cover the supported Bitwarden format they were designed for — do not assume an Argon2id-configured vault follows the same route. The app’s encrypted export is a different file and is not used for cracking.
 1Password (agilekeychain)6600Legacy format — keychain files on your own device. Convert with 1password2john.py first; hashcat needs the extracted hash line, not the raw keychain.
 1Password (cloudkeychain)8200Legacy/later keychain format — still an offline file on your device. Convert with 1password2john.py before running hashcat.
 1Password (mobilekeychain)31800The local mobilekeychain format in 1Password 8 — a separate route, not the 6600/8200 1password2john conversion; verify the exact local format and required extraction route first. Modern 1Password accounts also use a Secret Key alongside the account password — that key is part of what has to be recovered.
 Password Safe v3 (.psafe3)5200Another legacy desktop manager with a crackable format.
 The speed reality: modern managers use hundreds of thousands of key-derivation iterations (KeePass 2 with Argon2 or high AES-KDF rounds, LastPass with high rounds). That makes a random 16-character master password effectively unreachable — but a human-chosen master password, which is most people’s reality, is exactly where a good candidate list wins.
 The walkthrough — five steps
 1
 Protect the database
 Work on a read-only copy of the vault or keychain file, offline, on your own machine. Never upload the vault to a public checker or unknown website — a website asking for your .kdb/.kdbx or keychain is harvesting it. The protection rules apply to manager files too.
 2
 Get the vault into a hash line
 KeePass: identify whether you have a KeePass 1 .kdb or KeePass 2 .kdbx database first, then the keepass2john script (from the John the Ripper project) extracts the hash line from your database. For KDBX 4, also check which KDF the file actually uses: KeePass lets you choose AES-KDF or Argon2, and current hashcat versions support both via 34300 (Argon2) and 34301 (AESKDF). LastPass: locate the locally cached vault in your browser extension’s storage (the lastpass2john script reads it) — the account’s CSV export does not contain the hash. Bitwarden: find the local data.json (desktop app or browser extension), determine which KDF the account uses, and extract the hash line with bitwarden2hashcat or bitwarden2john (hashcat mode 23400 — the standard extractor does not read Argon2id parameters, so do not assume that route applies to every vault). 1Password: identify the exact format first, then convert before running hashcat — for agilekeychain (6600) and cloudkeychain (8200), hashcat’s own guidance points to 1password2john.py; 31800 is a separate local mobilekeychain format (1Password 8) — verify the exact local format and required extraction route first. Modern accounts also use a Secret Key alongside the account password — that key is part of what has to be recovered. The hashcat walkthrough covers the general extraction flow.
 3
 Pick the mode
 From the table above: 13400 KeePass with AES-KDF (KDBX ≤ 3); KDBX 4 may be Argon2 (34300) or AES-KDF (34301) — identify the KDF first. 6800 LastPass, 23400 Bitwarden, 6600/8200/31800 1Password, 5200 Password Safe.
 4
 Build the attack
 A wordlist from your password hint list with rules, or a mask when you remember the shape:
 hashcat -m 13400 vault.hash words.txt -r rules/best66.rule
 This command is for AES-KDF databases (mode 13400). If the database is KDBX 4, mode 13400 will not load it — check the KDF that keepass2john reports: Argon2 databases use hashcat mode 34300, AES-KDF KDBX 4 databases use mode 34301. Master passwords follow the same habits as every other password you ever made — years, names, patterns. That is the memory work, and it decides the outcome.
 5
 Read the result — and unlock the chain
 A cracked master password may open the vault, and inside it is the wallet password (and often the seed phrase backup too) — for some password managers. For modern 1Password accounts, the account password alone is not enough: the Secret Key, an already signed-in device, Emergency Kit, recovery code, or another supported recovery route may also be required. If the status screen shows an unworkable pace, the verdict is that the master password was random — and no tool changes that. Check the math before investing weeks.
 Never upload your vault to a public checker or unknown website
 The vault contains every password you own, including the wallet password. Legitimate recovery runs offline on your own machine — never upload your vault file to a public checker or unknown website.
 Sources & references
 hashcat — example hashes (official mode list)
 KeePass — security and key-derivation documentation
 Do this first
 The 68-place search checklist
 Before cracking the manager, exhaust every place the master password could already be stored.
 Work the checklist →
 The tool
 hashcat step by step
 Masks, wordlists and rules — the full walkthrough, with every wallet and manager mode.
 Read the hashcat guide →
 The real key
 Build a password hint list
 Every wordlist is only as good as the candidates you feed it — build them from memory.
 Build your list →
 Understand the format
 How wallet encryption works
 KDFs, iterations and speed — the same mechanics that protect your wallet protect your manager.
 Read the mechanics →
# Password, seed phrase, PIN or passphrase — what did you actually lose?
URL: https://forgotwalletpassword.com/password-vs-seed-phrase

Password vs Seed Phrase vs PIN vs Passphrase
 Skip to content
 Guide 02
 Password, seed phrase, PIN or passphrase — what did you actually lose?
 These four terms get mixed up constantly, and each one is a completely different problem with a completely different recovery path. Knowing exactly which one you face is the difference between days and weeks — or between possible and impossible.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 “Password” and “seed phrase” are two different doors. If you still have the seed phrase (usually 12–24 words for BIP39 wallets — some families differ, such as Monero 25-word seeds or Polyseed 16-word seeds), the forgotten wallet password usually stops mattering — restore the wallet with the phrase and move on. If the seed is gone too, the password is the key, and your path depends on the wallet format and what you remember.
 The words people use casually — “password”, “phrase”, “PIN”, “code”, “key” — hide several very different doors. Before you try anything, find out which door is locked. A wallet password and a seed phrase are different credentials: a seed phrase may restore a wallet without the old wallet password, depending on the wallet.
 The credentials, side by side
 What you lost
 What it is
 What happens without it
 Recovery path
 Wallet password
 Unlocks an encrypted wallet file — e.g. wallet.dat, an Electrum wallet, an Ethereum keystore JSON
 You can’t open the file — but your keys still exist inside it
 Search, recall, or targeted password recovery on the file
 Seed phrase (recovery phrase)
 Usually 12–24 words for BIP39 wallets, but some wallet families use different lengths — such as Monero 25-word seeds or Polyseed 16-word seeds. In seed-derived wallets the phrase derives the wallet’s normal accounts; manually imported private keys, JSON accounts, hardware-wallet accounts or accounts from another phrase may need separate recovery material
 Without it, the wallet’s normal seed-derived accounts cannot be recreated on a new device; imported accounts need their own recovery material, and if the phrase is the only surviving material, access may be unrecoverable
 Finding a copy — reconstructing lost seed words isn’t covered on this site (the search checklist)
 Extra passphrase (“25th word”)
 An optional extra passphrase / string — often nicknamed “25th word”, but not limited to BIP39 words — layered on the seed that creates a hidden wallet
 The seed alone opens a different, empty wallet
 Recall / structured guessing — almost always human-chosen
 Hardware-wallet PIN / phone passcode
 Local device lock — never leaves the device
 The device locks or wipes itself; the keys still live in the seed
 Usually not a wallet-password cracking case; restore from the seed or use device/account recovery
 Wallet-app spending PIN
 App-level PIN used by some old wallets (e.g. Bitcoin Wallet for Android/BlackBerry)
 Without it, spending stays locked in that app
 May be recoverable for supported wallet formats — btcrecover searches spending PINs as a numeric range
 Exchange / custodial password
 Login credentials for an account at Coinbase, Binance, Kraken or similar — the provider holds the keys, not you
 The account stays locked until you regain access
 Account reset through the provider, with identity verification — not password cracking
 Private key
 A single cryptographic key (WIF 5…/K…/L… or raw hex) that directly controls a balance
 Without it, that specific balance is unreachable
 Only from a copy or backup — a plain private key is not guessed like a password
 BIP38-encrypted private key
 A passphrase-protected private key in a 6P… string — everything needed to rebuild the key except the passphrase
 Without the passphrase, the key stays locked
 Recoverable by testing candidate passphrases offline against the 6P… string (btcrecover) — see the BIP38 guide
 Computer / device password
 The login password for the computer, phone or encrypted storage that contains the wallet
 The device stays locked — and on phones and encrypted devices, recovery may require erasing the device, which can destroy local wallet data
 Normal account recovery for the device — separate from wallet-password recovery, but do not reset, wipe, factory-reset or reinstall before checking whether wallet data, backups or app storage can be preserved
 The good news, first
 If you still have the correct wallet file, recovery may still be possible — the file gives recovery tools something to test against. But the real odds depend on the wallet format, the file’s condition, the password’s strength and what you remember.
 Mixing these up wastes weeks
 People hunt for a “password” when what they lost is a passphrase, or buy new hardware when what they need is the seed. If you are not sure what you have, check the file extension and the wallet name — .dat, keystore JSON (UTC--*.json), or an Electrum wallet file in the Electrum data folder (no fixed extension — often default_wallet) — and write it down.
 How to tell which one you lost
 Do you open a wallet file with a password? → You lost a wallet password.
 Do you see a recovery phrase — a grid of words? → You lost a seed phrase. Identify the wallet family first before judging it by word count: BIP39 seeds are usually 12–24 words, but Monero (25-word legacy / 16-word Polyseed) and other families differ.
 Did your wallet ask for an “extra passphrase” / “25th word” at setup? → You may have a BIP39 passphrase — a free string, not a word from the BIP39 list.
 Is it a hardware wallet asking for a short code? → That’s a device PIN.
 Do you log into an exchange website or app? → That’s an account password, and the provider may be able to reset it.
 Are you looking at a single long string that starts with 5, K or L? → That’s a private key, not a password — keep it offline and never share it.
 Can you not get into the computer or phone itself? → That’s a device password — recover the device through its normal account flow, but be careful: on phones and encrypted devices a forgotten passcode may require erasing the device, which can destroy local wallet data. Do not reset, wipe, factory-reset or reinstall before checking whether wallet data, backups or app storage can be preserved.
 A seed phrase is not just another password
 Never type a seed phrase into this website, a form, an email, or any unknown tool — a seed phrase can recreate the wallet’s normal seed-derived accounts on any device, so anyone who receives it can move the funds. Legitimate wallet-file password recovery does not need your seed phrase; it works on a copy of the encrypted wallet file. Seed-passphrase recovery is different: if you are testing a forgotten BIP39/SLIP39 extra passphrase, the seed/mnemonic or required shares may be needed locally in an offline tool — never enter them into a website, form, email, chat or unknown tool. Wallets like MetaMask make the file case concrete: the app password only guards a local vault, and the phrase restores its SRP-derived accounts — imported private-key/JSON or hardware accounts need their own recovery material.
 What to store
 Whatever you lost, these five things take ten minutes and can save everything:
 Copy the wallet file — read-only — to a USB stick and a second device. Keep the originals untouched.
 Write down what you remember about the password: length, characters, words, dates, patterns. Memory evaporates fast under stress.
 Note the wallet type and version: the app name, file extension, and when you installed it.
 Note the wallet address that holds the funds, and roughly when you last used it.
 Export your password manager or check its recent items — before you forget which one you used.
 If your seed phrase is intact, a forgotten PIN is usually easy to bypass by restoring on a new device. A forgotten extra passphrase is different: the seed alone may open a different wallet, so the passphrase still has to be remembered or reconstructed. If the file is intact but the password is gone, read the next guides: where old passwords hide, and how your memory built this one.
 Related guides
 Sources & references
 BIP39 — mnemonic code for generating deterministic keys
 BIP32 — hierarchical deterministic wallets
 Next guide · 02
 Where old passwords hide
 Before you crack anything — the 30-minute sweep that finds most “forgotten” passwords.
 Search the trails →
 Guide · 03
 How your memory made it
 Human passwords follow habits — dates, names, substitutions. Rebuild yours.
 Rebuild the pattern →
 Guide · 04
 Is recovery technically possible?
 Whatever you lost, the math decides — possible, feasible, or impossible.
 Read the feasibility →
 The bigger picture
 Which wallet passwords can be recovered?
 Whatever you lost, the verdict table has your wallet — every one in one table.
 See the master list →
# The next ten minutes decide whether your case stays recoverable.
URL: https://forgotwalletpassword.com/protect-your-wallet-files

Protect Your Wallet Files — 5 Moves Before Recovery
 Skip to content
 Guide 09 — read this before touching anything
 Protect your wallet files before you try anything else.
 Recoverable wallets are lost to specific mistakes — reinstalling, wiping, or letting a stranger “take a quick look”. These five moves take ten minutes, cost nothing, and can save everything.
 By Robbert Bink · ~4 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Copy your wallet file read-only to two safe places, write down every clue you remember, and then touch nothing until you know what you are doing. Most recoverable cases become unrecoverable through panic, not through the original loss.
 The five moves, in order
 1
 Make read-only backup copiesCopy the wallet file (wallet.dat, UTC--*.json, wallet.aes.json, *.wallet.aes, an Electrum wallet file with no fixed extension, or another wallet-specific backup) to a USB stick and a second device — before you try a single password. Then mark both copies read-only so no app or tool can alter them. The original stays exactly where it is.
 2
 Write down everything you rememberLength, characters, words, dates, patterns, other passwords from that era. Memory decays fastest under stress — capture it now, on paper or in a password journal. This becomes your candidate list.
 3
 Log the wallet type and versionApp name, file extension, version if you can find it, and roughly when you installed it. Feasibility (guide 08) depends on this exact information, and it is easy to forget later.
 4
 Note the wallet address and last activityWrite down the address that holds your funds and when you last saw a balance. This helps identify the case if you ever need help — an address alone is not proof of ownership.
 5
 Export and check your password managerIf the password is in a manager you no longer use, find it now — guide 05 covers the full sweep. Check recent and recently-deleted items before you forget which manager it was.
 The seven things never to do
 Never reinstall or “update” the wallet app — some updates migrate or overwrite wallet files.
 Never wipe or reformat the device, even if the wallet “seems broken”. Deleted ≠ gone — but only while the disk is untouched, and on a modern SSD with TRIM deleted data can become unrecoverable quickly even without obvious overwriting. If the only copy may have been deleted from an SSD, stop using the device immediately, avoid rebooting or installing recovery tools on it, and image the drive or get specialist help before experimenting.
 Never upload the wallet file to any website, form, or “online checker” that asks for it — an online cracker cannot work, so the only thing a checker can do is take the file.
 Never enter your seed phrase into a website, chat, email, support form, unknown app, or untrusted tool. For software-wallet recovery, only use the official wallet restore flow you intentionally installed. For hardware-wallet seeds, enter the words only on the hardware device itself or in the manufacturer’s approved on-device recovery flow.
 Never install remote-access software (AnyDesk, TeamViewer, ScreenConnect) for a “recovery agent”.
 Never pay an upfront fee, “deposit”, “gas” or “tax” to unlock anything.
 Never hammer the real wallet with guesses — some wallets wipe after repeated failures. Test on a copy.
 Why “just try it” is dangerous
 You are not fighting the password — you are fighting entropy. Every reckless action (reinstall, wipe, failed-guess lockout) converts a recoverable situation into an unrecoverable one. The files are the evidence; treat them like crime-scene evidence, because to you, that is exactly what they are. And if the file is corrupted, the device is dead or the seed is gone, no password testing helps — see the seven cases that aren’t a password problem.
 Your wallet file is on an old or dead computer
 This is one of the most common real cases — and usually not a lost cause. The wallet file lives on an old machine, and the password problem only starts once the file is safely in your hands. So: stop using that machine now. Do not reinstall the system, do not run “repair” tools, and do not let anyone “take a quick look” — every one of those can overwrite the very file you need.
 If the machine still powers on, copy the wallet file to a working computer and one backup before you touch anything else — the file-location guide shows where it hides. If the disk is truly dead and you cannot get the file off, that is no longer a password problem: it is data recovery, which this site does not cover. Until then, the file is the only thing standing between you and a recoverable case.
 Is the drive itself encrypted (BitLocker, FileVault, a VeraCrypt container)? That is a second password problem, not a dead end — the encrypted-drive section on the encrypted-file guide covers it. Same rule: copy the disk or image first, then work on the copy.
 How your files should always be handled
 Your wallet file never needs to be uploaded anywhere public — for any reason. Real recovery work happens offline, on a copy, with you keeping control. If someone asks for your file “urgently”, without a clear agreement about what happens to your data, that alone is a reason to pause. Once your copies are safe, the complete DIY route takes over — from finding the file to rebuilding clues and running the tool: recover a wallet password yourself.
 Previous guide · 04
 Is recovery technically possible?
 Why your file format decides your odds — the feasibility equation.
 Read the feasibility →
 Quick answers
 Frequently asked questions
 “Is my wallet file enough?” “Do I need the seed phrase too?” — straight answers.
 Open the FAQ →
 The bigger picture
 Which wallet passwords can be recovered?
 Protected files, verdicts — every wallet in one searchable table.
 See the master list →
# No wallet file? The honest answer on what is still possible — seed, Blockchain.com email, custodial reset.
URL: https://forgotwalletpassword.com/recover-wallet-password-without-file

Can You Recover a Wallet Password Without the Wallet File?
 Skip to content
 Feasibility · the exceptions
 Can you recover a wallet password without the wallet file?
 The answer is usually “no” — the file is where your password gets tested. But “no file” does not always mean dead end. This page covers when it does, when it doesn’t, and exactly what still works.
 By Robbert Bink · ~7 min read · Published 10 August 2026 · Last reviewed: 15 August 2026
 The headline
 Usually no: without the wallet file (or the seed phrase behind it), there is nothing to test your password against — and no tool or service can change that. But “no file” is not the end: the seed phrase, custodial accounts, brain wallets and BIP38 encrypted private keys are the four real exceptions.
 The short answer
 If you have no copy of the wallet file at all — no backup, no export, nothing on an old drive or phone — the password itself cannot be recovered by testing. Here is why, and here is when that rule does not apply.
 You have the seed phrase → the password stops mattering; restore the wallet without it. → Password vs seed phrase
 Blockchain.com / Blockchain.info wallet → also seed-phrase based: current wallets use a 12-word Recovery Phrase, and with it the password stops mattering. Legacy pre-2016 Blockchain.info wallets are different — some use a recovery mnemonic with fewer or more than 12 words, which may reveal the wallet password from the time the phrase was created rather than functioning as a modern 12-word wallet seed. No phrase? The sign-up email at least retrieves the wallet identifier you need to log in; the crackable wallet.aes.json export is the file you already downloaded in the past — old downloads, email attachments and cloud storage hold it. → Blockchain.com wallet
 Exchange or custodial account → you never had a wallet file; reset through KYC, email or 2FA. → Exchange & custodial wallets
 Brain wallet → there is no file by design; the passphrase is the key, so it can be tested directly offline. → The brain wallet recovery guide
 Why the file matters
 Wallet encryption works like this: the file stores an encrypted master key plus a verifier. When you enter a password, the software derives a key from it and checks it against that verifier. Recovery tools do the same thing — but they need the file, because the verifier lives inside it. With no file, there is nothing to check a candidate against.
 That is also why a remote “password cracker” cannot help here: there is no remote copy of your wallet to test. The only meaningful recovery data is the file itself, the seed, or an account you can still prove you own. Anyone who promises to “recover” a password from nothing is not describing how the technology works.
 Exception 1 · You still have the seed phrase
 Most wallets derive their keys from a 12–24 word seed phrase, and the password is only a lock on the device or file. With the seed, you restore the wallet in the app and set a new password — the old one never needs to be recovered. This is the most common “I have no file” case, and it is usually a happy one. → Password vs seed phrase · The 25th/13th word — when the passphrase is also missing
 Exception 2 · Blockchain.com with your recovery phrase
 Blockchain.com (formerly Blockchain.info) wallets are self-custody: Blockchain.com itself states it cannot reset or recover the wallet password. The sign-up email does one smaller thing — the login page can mail you the wallet identifier you need to log in or find your backup — but that is not a reset. Current Blockchain.com wallets use a 12-word Recovery Phrase: restore the addresses derived from it anywhere and set a new password, and the old one stops mattering for them — imported addresses need their own private-key or wallet backups. Legacy pre-2016 Blockchain.info wallets are different: some use a recovery mnemonic with fewer or more than 12 words, which may reveal the wallet password from the time the phrase was created rather than functioning as a modern 12-word wallet seed. If you have the wallet.aes.json export instead, that file is what you crack. One legacy exception: in some older Blockchain.com / Blockchain.info cases the encrypted wallet payload can still be retrieved during a login attempt if you know the Wallet ID and can pass the required email/2FA checks — not a reset and not guaranteed, but “no old downloaded export” is not always the end. Only the separate custodial Trading Account product supports a normal password reset. → The Blockchain.com wallet explained
 Also check for a mobile cloud backup. Current Blockchain.com mobile app versions can create an encrypted cloud backup of the wallet (Apple iCloud or Google Drive), which Blockchain.com documents as the recovery route for cases where the wallet password and/or Recovery Phrase are lost — it restores on the same operating system and cloud account, with your app PIN if prompted. It is not a guarantee, but before you conclude the wallet is unrecoverable, check whether the app made that backup.
 Exception 3 · Exchange and custodial accounts
 If your coins are on Coinbase, Binance, Kraken or a similar platform, there was never a wallet file in your hands. “Forgot password” here means account recovery: identity verification, the linked email, and 2FA. That is a reset, not a cracking case. → Exchange & custodial wallets — just reset it
 Exception 4 · Brain wallets
 A brain wallet is the one case where “no file” is normal: the address is derived directly from a passphrase (for example via SHA-256), so there is nothing stored anywhere. If you forgot the passphrase, recovery means testing candidate passphrases offline and comparing the generated addresses — the same search logic as everywhere else on this site, just without a file to read first. → The brain wallet recovery guide
 Exception 5 · BIP38 encrypted private key
 A 6P… BIP38 string from a paper wallet is not a wallet file — it is the encrypted recovery target itself. It contains everything needed to rebuild the private key except the passphrase, so a forgotten passphrase can be tested offline against the string (for example with btcrecover’s --bip38-enc-privkey). → The BIP38 guide
 What to do now
 Before concluding you have “no file”, work the 68-place search checklist and the file-location guide: backups, old drives, phones, cloud exports and paper notes hold far more copies than people think. If the file exists anywhere, the normal route applies: protect the copy, build your clues, and run the tools. → How to recover a wallet password yourself
 And the real end: if there is truly no file, no seed, and no recoverable account, the password is gone with the data — no tool, GPU farm or service changes that. The money is not lost to a competitor; it is lost to physics, and that is exactly why this page exists.
 Frequently asked questions
 Can you recover a wallet password without the wallet file?
 Usually no: the wallet file stores the encrypted verifier that candidate passwords are tested against. With no file and no seed phrase, there is nothing to test — no tool or service can change that.
 When don’t you need the wallet file?
 Four real cases: you have the seed phrase (the password stops mattering), it is an exchange or custodial account (KYC reset), it is a brain wallet (no file by design), or it is a BIP38-encrypted private key — the 6P… string itself is the encrypted recovery target.
 I used Blockchain.com and still have my original email — what now?
 Blockchain.com's self-custody wallet password cannot be reset by Blockchain.com — the company itself states it. The sign-up email only helps retrieve the wallet identifier; without the 12-word recovery phrase, the wallet.aes.json export is what remains crackable. Only the separate custodial Trading Account supports a real password reset.
 The bigger question
 Is wallet password recovery possible?
 Which formats are feasible, how fast, and when recovery is genuinely impossible.
 Read the feasibility →
 Before you give up
 How to find your wallet file
 Exact paths on Windows, macOS and Linux — the copy you forgot is often still there.
 Find the file →
 Leave no stone unturned
 The 68-place search checklist
 Every place a forgotten password or wallet file can hide, ticked off.
 Start the search →
 Self-custody, no reset
 Blockchain.com wallet recovery
 The .aes.json export, the 12-word phrase — and why there is no reset button.
 Read the guide →
# Which wallet passwords can be recovered? The complete list.
URL: https://forgotwalletpassword.com/recoverable-wallets

Recoverable Wallet Passwords: The Complete List
 Skip to content
 Resource · the master list
 Which wallet passwords can be recovered? The complete list.
 Every wallet falls into one of three buckets: reset, crackable offline, or effectively impossible. Here is the verdict for every major wallet — so you stop guessing and start doing the one thing that works.
 By Robbert Bink · ~8 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Many file-based wallet passwords are technically attackable offline — but not always by cracking. Custodial accounts reset through the platform, and older file-based wallets (wallet.dat, MultiBit, Electrum, Ethereum keystores) can be cracked offline when the password is human-made and you have clues. A random, strong password — especially a long one generated by a password manager — is generally infeasible to brute-force; no wallet, tool or service changes that.
 How to read this list
 Three verdicts, three different actions. Find your wallet and do exactly what its verdict says — that is the whole method:
 RESET
 Custodial account (exchange). Prove identity, set a new password, done. No recovery needed at all.
 CRACKABLE OFFLINE
 File-based encryption with a known KDF. With clues and the right hardware, a human-chosen password can be found.
 IMPOSSIBLE
 Random strong password. Slow legacy formats like Armory are a different story — memory-hard and very slow per guess, so clues are essential, but not impossible. The math: no service can change this.
 The master list
 Find your wallet below — filter by verdict or search by name. Every row ends with the one action that actually matters.
 Jump straight to: MetaMask · Monero · wallet.dat · Electrum · Ethereum keystore · BIP38 · MultiBit · mSIGNA · Coinomi · Armory · Android wallets
 Wallet
 What you have
 Encryption / KDF
 Verdict
 The path
 Offline tools
 Coinbase, Binance, Kraken, Gemini · exchanges
 — (custodial)
 A custodial account
 RESET
 Reset the account password — see exchange & custodial wallets
 —
 MetaMask
 Encrypted vault
 PBKDF2-SHA256 — legacy 10k, newer vaults store their own KDF params in the vault (read the stored count; 900k is one documented value, not universal) · $metamask$
 CRACKABLE OFFLINE
 Vault crackable offline via btcrecover — MetaMask guide
 btcrecover · hashcat 26600 (legacy extension) / 26610 (newer; 26620 only in newer/development builds) / 31900 (mobile)
 Monero (official wallets)
 .keys file
 ChaCha8 (older) / ChaCha20 (newer) · $monero$
 CRACKABLE OFFLINE
 The seed (25-word legacy / 16-word Polyseed / 13-word MyMonero) restores the wallet without the password; the .keys file is crackable with the custom-KDF tooling (monero2john) in the John the Ripper walkthrough — full Monero guide
 John the Ripper (monero2john) · Monero guide
 BIP39 passphrase · the 25th/13th word
 Forgotten passphrase (the 25th/13th word)
 BIP39: PBKDF2-HMAC-SHA512, 2,048 iterations; candidates verified by deriving target addresses
 CRACKABLE OFFLINE
 btcrecover tests BIP39 passphrases directly. SLIP39 passphrases are a separate recovery mode with their own KDF (Feistel + PBKDF2-HMAC-SHA256) and a quorum of shares — do not apply BIP39 math to them — the passphrase guide has the math
 btcrecover
 Bitcoin Core / Bitcoin-Qt · old wallet.dat
 wallet.dat — rounds vary per wallet (25k floor)
 iterated SHA-512 (EVP_BytesToKey) · $bitcoin$
 CRACKABLE OFFLINE
 Fast to test — hundreds of guesses/sec on CPU, thousands on GPU. wallet.dat guide
 hashcat 11300 · btcrecover · John the Ripper
 Bitcoin Core · modern wallet.dat
 wallet.dat — same KDF; rounds machine-tuned (~100 ms target)
 iterated SHA-512 · $bitcoin$
 CRACKABLE OFFLINE
 Slower, still feasible with clues. wallet.dat guide
 hashcat 11300 · btcrecover · John the Ripper
 Litecoin · Dogecoin · Bitcoin Cash · Dash
 Same wallet.dat format
 iterated SHA-512 · $bitcoin$
 CRACKABLE OFFLINE
 Identical encryption to Bitcoin Core — fork wallets
 hashcat 11300 · btcrecover · John the Ripper
 Other Bitcoin-family wallet.dat
 Bitcoin Knots, Unlimited, Classic, XT, Vertcoin, DigiByte, Viacoin, Groestlcoin…
 iterated SHA-512 · $bitcoin$
 CRACKABLE OFFLINE
 Same wallet.dat encryption as Bitcoin Core — wallet.dat guide
 hashcat 11300 · btcrecover · John the Ripper
 Electron-Cash · BCH
 Encrypted wallet file
 Electrum-family encryption (BCH fork)
 CRACKABLE OFFLINE
 Supported by btcrecover (2.x–4.x). btcrecover guide
 btcrecover
 MultiDoge · DOGE
 .key backup (MultiBit-style)
 3×MD5 (.key)
 CRACKABLE OFFLINE
 One of the fastest formats to test — same family as MultiBit Classic. btcrecover guide
 btcrecover
 Electrum · Electrum-LTC · versions 1.x–4.x
 Encrypted keystore file
 PBKDF2-SHA512 1,024 + ECC (2.8+); double SHA-256 (older) · $electrum$
 CRACKABLE OFFLINE
 PBKDF2-based from 2.8+, weaker double-SHA-256 for 1.x–2.7; crackable with clues. Electrum 2FA / TrustedCoin wallets are a special case: current btcrecover documentation excludes 2FA wallets from its standard Electrum password-recovery support — identify the wallet type before the generic route. Electrum guide
 btcrecover · hashcat 16600 / 21700 / 21800 · John the Ripper
 Ethereum keystore · geth, MEW, MyCrypto & EVM clones
 UTC--*.json file
 scrypt or PBKDF2-HMAC-SHA256; parameters stored in the file's kdfparams (geth commonly uses scrypt N=262,144; lighter configs exist) · $ethereum$
 CRACKABLE OFFLINE
 scrypt or PBKDF2 — slow to test, feasible with clues. keystore guide
 hashcat 15600 / 15700 · btcrecover · John the Ripper
 Ethereum pre-sale wallet · 2014
 JSON wallet file
 PBKDF2-HMAC-SHA256 · $ethereum$w
 CRACKABLE OFFLINE
 PBKDF2-HMAC-SHA256 — hashcat mode 16300
 hashcat 16300
 BIP38 paper wallets
 6P… encrypted key
 scrypt N=16,384 r=8 p=8
 CRACKABLE OFFLINE
 scrypt-based, tens of guesses/sec. BIP38 guide
 btcrecover
 Brainwallets · bitaddress.org, Warpwallet
 Passphrase-derived key
 SHA-256 (bitaddress) / WarpWallet: scrypt N=2¹⁸ XOR PBKDF2-HMAC-SHA256 2¹⁶ rounds
 CRACKABLE OFFLINE
 The passphrase is the key itself — btcrecover tests SHA-256 and scrypt brainwallets. Deep guide — brain wallet recovery
 btcrecover
 Blockchain.com · wallet.aes.json
 .aes.json export
 PBKDF2-SHA1 (10 / 10k / 5k) · $blockchain$
 CRACKABLE OFFLINE
 Feasible with clues — very early legacy V0 wallets use a separate algorithm (hashcat 34700); identify the version before using 12700/15200. Blockchain.com guide
 hashcat 12700 / 15200 / 18800 (legacy V0: 34700) · btcrecover · John the Ripper
 MultiBit Classic · legacy
 .key (MD5) / .wallet (scrypt)
 3×MD5 (.key) / scrypt (.wallet) · $multibit$
 CRACKABLE OFFLINE
 The .key backup is one of the fastest formats to test; the .wallet variant uses scrypt. MultiBit guide
 hashcat 22500 / 27700 · btcrecover · John the Ripper
 MultiBit HD · legacy
 mbhd.wallet.aes, scrypt-based
 scrypt N=16,384 · $multibit$
 CRACKABLE OFFLINE
 Slower than Classic but supported by btcrecover — MultiBit guide
 hashcat 22700 · btcrecover · John the Ripper
 mSIGNA (CoinVault)
 Encrypted wallet database
 btcrecover format (see docs)
 CRACKABLE OFFLINE
 btcrecover reads it directly; feasible with clues. btcrecover guide
 btcrecover
 Hive for OS X
 bitcoinj-based encrypted wallet
 bitcoinj protobuf — scrypt
 CRACKABLE OFFLINE
 Same bitcoinj family as MultiBit — btcrecover handles it. btcrecover guide
 btcrecover
 Bitcoin Wallet (Android/BlackBerry) · KnC Wallet
 Spending PIN / encrypted backup
 bitcoinj scrypt / spending PIN
 CRACKABLE OFFLINE
 The numeric spending PIN is a small search space when its approximate length is known — PIN length varies, so configure the range you actually may have used; encrypted backups are crackable. btcrecover guide
 btcrecover
 Litecoin Wallet for Android · Dogecoin Wallet for Android
 Encrypted backups
 bitcoinj scrypt
 CRACKABLE OFFLINE
 All supported by btcrecover — btcrecover guide
 btcrecover
 Dogechain.info
 Encrypted wallet export
 PBKDF2-HMAC-SHA256 + AES · parameters/version stored in the wallet data
 CRACKABLE OFFLINE
 Not the bitcoinj scrypt family — btcrecover reads the Dogechain export directly; hashcat 32500 covers the applicable/older Dogechain format, but newer payload variants (e.g. AES-GCM) may differ, so identify the wallet format first. btcrecover guide
 btcrecover · hashcat 32500
 Bither
 Bither SQLite wallet database
 —
 CRACKABLE OFFLINE
 Supported by btcrecover's SQLite wallet-database loader (format-3; addresses.encrypt_private_key / password_seed) — exported/encrypted backups may need separate preparation — btcrecover guide
 btcrecover
 block.io
 Account “Secret PIN”
 PBKDF2-HMAC-SHA256 (iteration count stored in the wallet data; legacy ~2,048, newer 100,000+)
 CRACKABLE OFFLINE
 Identify the wallet format and stored pbkdf2_iterations first — a modern high-iteration wallet is far slower than a legacy one; wallet data can be retrieved via the block.io browser/Network route — btcrecover guide
 btcrecover
 btc.com (Blocktrail)
 BTC.com/Blocktrail recovery-sheet wallet data (not the raw PDF)
 PBKDF2-based (btcrecover BTC.com loader: salt/iterations/IV/ciphertext from the wallet data)
 CRACKABLE OFFLINE
 The wallet password that unlocks the backup sheets is recoverable with btcrecover, but the raw PDF is not the input — prepare the wallet data first (passwordEncryptedSecretMnemonic) — btcrecover guide
 btcrecover
 Yoroi (Cardano)
 Master password in wallet data
 PBKDF2-SHA512 19,162 + ChaCha20-Poly1305
 CRACKABLE OFFLINE
 Extract and test with btcrecover. For wallets created directly in Yoroi, the recovery phrase is 15 words; Yoroi can also restore compatible 24-word Cardano wallets created elsewhere. btcrecover guide
 btcrecover
 Toast Wallet
 Wallet passphrase
 —
 CRACKABLE OFFLINE
 btcrecover supports the passphrase — btcrecover guide
 btcrecover
 imToken · Eth clones
 Encrypted keystore (modified Eth format)
 scrypt / PBKDF2 · $ethereum$
 CRACKABLE OFFLINE
 btcrecover reads the modified keystore directly (needs identity.json from the imToken folder); plain keystores follow the keystore guide.
 btcrecover · hashcat 15600 / 15700
 Coinomi vault
 scrypt vault
 scrypt N=16,384 r=8 p=1
 CRACKABLE OFFLINE
 Vault crackable offline (scrypt) via btcrecover — Coinomi guide
 btcrecover · John the Ripper (coinomi2john)
 Exodus Desktop
 seed.seco wallet file
 scrypt (seed.seco)
 CRACKABLE OFFLINE
 Password-encrypted local wallet (scrypt) — extract with exodus2hashcat.py, then hashcat mode 28200 — Exodus guide
 hashcat 28200
 Terra Station
 Encrypted wallet JSON
 PBKDF2-SHA1 100 + AES-256-CBC
 CRACKABLE OFFLINE
 PBKDF2-SHA1 (100 rounds) + AES-256-CBC — hashcat mode 29600
 hashcat 29600
 Bisq
 .wallet file (scrypt)
 scrypt N=32,768 r=8 p=6 · $bisq$
 CRACKABLE OFFLINE
 scrypt-encrypted wallet file — extract with bisq2hashcat.py, then hashcat mode 29800
 hashcat 29800
 BitShares
 Wallet database (light client)
 —
 CRACKABLE OFFLINE
 Wallet database extractable with bitshares2john.py — JtR walkthrough
 John the Ripper (bitshares2john)
 Stargazer · Stellar (XLM)
 Encrypted wallet file
 $stellar$
 CRACKABLE OFFLINE
 Password-encrypted wallet file — hashcat mode 25500
 hashcat 25500
 Keplr · Cosmos
 Encrypted vault in extension storage
 scrypt (AES-128-CTR)
 CRACKABLE OFFLINE
 Legacy Keplr extension format: extract with keplr2john.py. Keplr v2/current formats: do not assume compatibility — identify the vault format first. JtR walkthrough
 John the Ripper (keplr2john)
 Cardano · legacy Daedalus
 secret.key (2017–2019 Daedalus wallets)
 PBKDF2-SHA512 + BLAKE2b/ChaCha20 (legacy)
 CRACKABLE OFFLINE
 Legacy Daedalus keys extractable with cardano2john.py — JtR walkthrough. Modern Daedalus wallets restore from the seed phrase instead.
 John the Ripper (cardano2john)
 Tezos
 Tezos ICO / fundraiser credentials
 —
 CRACKABLE OFFLINE
 Extract with tezos2john.py using the ICO mnemonic, fundraiser email and tz1 address — this is the ICO/fundraiser password route, not a generic client key file — JtR walkthrough
 John the Ripper (tezos2john)
 Armory
 armory.wallet, legacy
 ROMix-SHA-512 (memory-hard; memory/iteration parameters calibrated per wallet)
 CRACKABLE OFFLINE — very slow
 Memory-hard ROMix-SHA-512 KDF with no hashcat mode. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py) — a compatible extraction step is still required; older btcrecover/Armory workflows also exist, at roughly 15k–200k candidates per 0.2–3 hours — clues are essential. The Armory paper backup (Root Key / chain-code, not a BIP39 phrase) remains the fastest restore path
 btcrecover
 Any wallet with a random high-entropy password
 Password-manager-grade password
 — (n/a)
 IMPOSSIBLE
 Generally infeasible for any realistic hardware — run the entropy calculator to see why.
 —
 Encryption/KDF and hash-prefix figures verified against the hashcat example-hashes list and measured speed classes are on the benchmarks & methodology page. August 2026.
 “Crackable offline” never means guaranteed. It means the encryption is attackable at a measurable speed — your odds still depend on what you remember and how the password was built. Run the entropy calculator for your specific case. And “impossible” means impossible as a password-cracking route — the forgotten password itself is the dead end, not the wallet.
The three rules behind the whole list
 If your wallet isn’t in the table, it still fits one of a few security models — seed/key-based, encrypted-file based, hardware/device based, or custodial — and the model decides the verdict:
 Seed-based — the password is a lock, the phrase is the backupTrust Wallet, Exodus, Coinbase Wallet, Phantom, MetaMask and similar. Restore the phrase and the forgotten password stops mattering for the addresses derived from it — but imported accounts and newer passkey-based variants need their own recovery material. Note: the classic Coinbase Wallet app is being retired in favor of the Base App — the recovery phrase and addresses remain, but some networks are not supported in the Base App, so for those assets import the phrase into another compatible wallet; never enter it into unknown tools or websites.
 Passphrase-as-key — the passphrase is the recovery targetBIP38 encrypted private keys and brain wallets. There is no separate backup that makes the forgotten passphrase irrelevant: a BIP38 6P… string is an encrypted private key that contains everything except the passphrase, and a brain wallet derives its keys directly from the passphrase. The passphrase itself is what recovery tests.
 File-based — the password encrypts a filewallet.dat, Electrum, Ethereum keystores, Blockchain.com exports, MultiBit, Coinomi vaults, Monero .keys. The file holds your keys and the password unlocks them. Recovery is a technical problem with a real speed limit: sometimes yes, often no.
 Hardware/device based — keys live on the deviceLedger, Trezor, Coldcard and similar. Recovery is the manufacturer’s restore flow from the device seed — failed-PIN behavior is model-specific.
 Custodial — someone else holds the keysCoinbase, Binance, Kraken and other exchanges. You don’t recover anything — you reset the account password and the platform unlocks your balance.
 Before you try anything: secure the file and the clues
 Whatever the verdict, do the safe steps first: back up the wallet file to read-only media, write down everything you remember about the password, and check the search checklist before spending a second on guessing. The first 24 hours guide has the exact order.
 The caveats
 The rounds count, not the client version, decides speed. Bitcoin Core picks the iteration count at encryption time to take ~100 ms on the encrypting machine (minimum 25,000); reference wallets measure 68k–267k rounds. Fewer rounds means more guesses per second. The encryption explainer shows why.
 Clues beat hardware every time. One remembered fragment can shrink the search space by a million — worth more than any GPU. Rebuild your memory with how your memory made it.
 “Recoverable” is a spectrum, not a promise. Your real odds come from the feasibility framework — the wallet format, the password’s shape, and what you remember.
 Never upload your wallet file to a public checker or unknown website. Legitimate recovery runs offline on a copy. Protect your wallet files is the safety rulebook.
 Frequently asked questions
 Which wallet passwords can simply be reset?
 Exchange and custodial accounts — Coinbase, Binance, Kraken and similar — are the only ones where a forgotten password is a reset, not a recovery. The platform holds the keys; you prove identity, set a new password, and access is restored.
 Which wallet passwords are the easiest to recover offline?
 Old Bitcoin Core wallet.dat files can be tested at hundreds of guesses per second on a CPU (thousands with GPU acceleration), and MultiBit Classic’s .key backup (3×MD5) allows around a million guesses per second — making human-chosen passwords with a few clues genuinely recoverable. Modern wallets are deliberately slower.
 What makes a wallet password effectively unrecoverable?
 A genuinely random password with roughly 80+ bits of entropy — for example 14+ characters from a full character set — is generally infeasible to brute-force for any realistic hardware. Slow legacy formats like Armory are a different story: memory-hard and very slow per guess, but not impossible — strong clues make them realistic. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts; a compatible extraction step is still required.
 How this list was verified
 Every verdict is grounded in the same public sources the rest of this site uses: the hashcat example hashes wiki for the KDF/mode mapping (wallet.dat → 11300, Electrum → 16600/21700/21800 by salt type, Ethereum keystore → 15600/15700, BIP38 → no hashcat mode; btcrecover handles it), the btcrecover documentation for which formats the offline tools support, and the John the Ripper jumbo build for the *2john extraction scripts (bitcoin2john, electrum2john, ethereum2john, monero2john). Where a claim depends on a specific tool or version, the speed classes above are order-of-magnitude estimates, not benchmarks.
 hashcat — example hashes (wallet formats & modes)
 BIP39 — mnemonic code for generating deterministic keys
 btcrecover documentation (supported wallet formats)
 John the Ripper (jumbo) — *2john extraction scripts
 Sources & references
 btcrecover — performance benchmarks (measured crack speeds)
 hashcat — example hashes (wallet formats & modes)
 Bitcoin Wiki — wallet encryption
 btcrecover source — wallet formats & KDF parameters (Yoroi 19,162, SLIP39 support)
 Bisq source — wallet scrypt parameters (N=32,768 r=8 p=6)
 John the Ripper — cardano2john (legacy Daedalus secret.key format)
 Cite this page
 APA: Bink, R. (2026). Which wallet passwords can be recovered? The complete list. ForgotWalletPassword.com. https://forgotwalletpassword.com/recoverable-wallets
 Markdown: [Which wallet passwords can be recovered? The complete list.](https://forgotwalletpassword.com/recoverable-wallets)
 The arithmetic
 Is recovery technically possible?
 Every format’s speed class — and the line between possible and impossible.
 Read the feasibility →
 First step
 Which wallet file do you have?
 Identify your file type and jump straight to the right guide — or the right verdict.
 Identify your file →
# The 25th word isn't a word — it's a password.
URL: https://forgotwalletpassword.com/seed-phrase-passphrase

Forgot the Passphrase On Your Seed? The 25th Word Explained
 Skip to content
 Guide · a password, not a seed
 The 25th word isn’t a word — it’s a password.
 On top of your seed phrase you may have added one more secret: the optional BIP39 passphrase — the “25th word” (or “13th word” on a 12-word seed). It is not part of the seed. It is a password you chose, layered on top of it. Forget it, and your seed words alone open the wrong, empty wallet.
 By Robbert Bink · ~7 min read · Published 7 August 2026 · Last reviewed: 14 August 2026
 Short answer
 A forgotten seed phrase passphrase is usually recoverable, because it is a password problem, not a seed problem. Passphrases are almost always human-chosen (a name, a date, a phrase you reuse), and every candidate can be tested offline against the wallet address. A random manager-generated passphrase is the one dead end: find it stored — cracking is not feasible.
 What the “25th word” actually is
 The BIP39 passphrase is an optional, arbitrary string you can add when a wallet is created. People call it the “25th word” (24-word seed), the “13th word” (12-word seed), the “seed extension”, “extra word” or “hidden-wallet phrase” — but it is not a word from the 2048-word BIP39 list. It can be anything: a name, a date, a sentence, a random string, even a second language. Key facts:
 It is not part of the mnemonic. The passphrase is an extra input combined with the seed words at the moment you unlock the wallet, and it cannot be derived from the seed words themselves. Whether a particular wallet app stores or caches it is an implementation detail — never assume it is saved, never assume it is not.
 Same seed + different passphrase = a different wallet. Each passphrase derives a completely different set of addresses. Entering your 24 words without the passphrase opens a wallet that usually looks empty.
 It was designed as a security feature — a “hidden wallet” someone can find your seed and still not reach your funds. That same design is why forgetting it locks the wallet so completely.
 Why this is a password problem — not a seed problem
 This distinction is the whole page, so it is worth being blunt:
 The seed phrase is your backup. 12–24 fixed words from a standard list. Lose all of them and no tool on earth recreates the wallet — that is a different problem, and this site does not cover reconstructing lost seed words.
 The passphrase is your password. An arbitrary string you chose, the way you choose any other password. And like any password you chose yourself, it follows your habits — which is exactly what makes it recoverable.
 If your seed words are safe but the wallet shows the wrong (empty) addresses, you are almost certainly dealing with the passphrase — and you are on the right page.
 Do you even have one? The empty-passphrase test
 Before any recovery work, rule out the simplest explanation: the passphrase is empty. The default is no passphrase, and many “lost” wallets turn out to have never had one. Test it offline:
 Take your seed words and restore them in a fresh wallet on a device you control — without entering any passphrase.
 Compare the first address shown with the address you remember. Match? There was no passphrase (or it was empty) and your wallet is simply there. No match? That alone does not prove a passphrase was used — first check that the wallet type, derivation path and address/script type match the original wallet. If they do and the first address still differs, a non-empty passphrase is the likely cause, and the section below applies.
 Do this on a fresh device or a wallet you have already emptied — restoring a seed can overwrite the local copy you still need. The safe-copy rules apply here too.
 How passphrases get lost
 Because the passphrase is not part of the mnemonic, forgetting it feels different from a normal lockout. The usual stories:
 Set once at wallet creation years ago, written down nowhere, and silently forgotten.
 Stored in a password manager or notes app that has since been abandoned, wiped, or forgotten.
 Confused with the seed itself — people write “24 words + this other thing” and later cannot recall what the “other thing” was.
 Reused from another account or service, so it is somewhere in your password history.
 Search first — it is usually stored somewhere
 Most forgotten passphrases are found, not cracked. Work the search before touching any tool:
 Every password manager you have ever used — including old, abandoned and browser-built-in ones. Export and search them all.
 Notes apps, email drafts and attachments, cloud drives, old phones and their backups.
 Paper: the same notebook, drawer or safe where the seed lives is where the passphrase usually was recorded too.
 Browser password autofill — many people let the browser remember the passphrase field.
 The complete method is in where old passwords hide, and the tick-by-tick version is the 68-place search checklist.
 Never enter your seed words online
 Never type your seed — or your seed plus a “check” passphrase — into a website. Legitimate testing runs fully offline, on your own machine, under a written agreement that establishes who owns the wallet.
 If you have to recover it: how the math works
 With your seed words and at least one known address, every candidate passphrase can be tested: derive the wallet for seed + candidate, and check whether the address matches. That is the entire attack, and it is fast:
 Human-chosen passphrases are the most recoverable secret in crypto. They follow the same habits as any password you pick — names, dates, phrases, substitutions. The memory method rebuilds the candidate list.
 Measured speed: BIP39 passphrase candidates test at roughly 15,000 per second on a modern CPU (about 20,000 on GPU) — published btcrecover measurements. A structured candidate list of a few thousand habits is minutes, not months. See the password strength calculator for your exact numbers.
 Random passphrases are the straight “no”. If a password manager generated a 20-character random passphrase, no amount of GPU time finds it. Your only path there is locating it in the manager, an export, or a backup.
 Realistic verdicts
 Your situation
 Verdict
 Seed words safe; you remember fragments or the general shape of the passphrase
 Genuinely good odds — a structured candidate list finds it fast
 Seed words safe; passphrase human-chosen, built on habits you can recall
 Very good odds — this is the most recoverable case there is
 Seed words safe; passphrase created by a password manager
 Not feasible to crack — locate it in the manager or a backup
 Seed words themselves lost, with no copies anywhere
 Not recoverable — a different problem; search for a backup, not a passphrase
 How to never lose the passphrase again
 The passphrase defeats the usual backup advice, so it needs its own rule: store the seed and the passphrase separately. Seed on paper in one place, passphrase in a password manager (or a second physical location) — never both together. If one is compromised, the other still protects you. But both are required to restore the same passphrase-protected wallet: a different passphrase — including an empty one — derives a different wallet. If either is lost, you may permanently lose access, so both need reliable independent backups. The full prevention system is in how to never lose access.
 Sources & references
 BIP39 — mnemonic code for generating deterministic keys
 Start here
 Password vs seed phrase vs passphrase
 Make sure you know which of the three you actually lost — the answer changes everything.
 Confirm what you lost →
 Rebuild it
 How your memory made it
 Passphrases follow habits: names, dates, substitutions, reused strings. Rebuild your candidate list.
 Reconstruct the pattern →
 Before anything
 Where old passwords hide
 The 30-minute sweep that finds most forgotten passphrases before any cracking starts.
 Search every trail →
 Your numbers
 Password strength calculator
 Model your passphrase candidates against measured BIP39 speeds, not guesses.
 Run the numbers →
 Feasibility
 Is recovery possible?
 The 25th word’s honest odds — the feasibility math in plain numbers.
 See the verdict →
# 68 places a forgotten wallet password can hide — work through them all.
URL: https://forgotwalletpassword.com/the-ultimate-search-checklist

The Ultimate Search Checklist — 68 Places to Look
 Skip to content
 Guide 06
 68 places a forgotten wallet password can hide — work through them all.
 Most “forgotten” wallet passwords are found, not cracked. People write them down, save them, screenshot them, email them to themselves, or bury them in an old backup. This checklist walks you through every place — digital, physical and human — one tick at a time. Tick as you go; your progress is saved in your browser.
 By Robbert Bink · ~16 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 How to use this page
 Work from top to bottom and tick as you go — set aside 30–60 minutes and only stop when every box is ticked. The two most productive searches are the password-manager and email sections; do those even if you do nothing else today. Not sure what you lost? Start with the quick diagnostic.
 0 of 0 places checked — 0%
 Run these searches in your email and cloud storage first
 Open your email provider and cloud drives, search for each term, and check the sent, drafts, deleted and archive folders — not just the inbox. These 12 searches catch most self-sent backups in under five minutes.
 "seed phrase"
 "recovery phrase"
 "mnemonic"
 "private key"
 "wallet backup"
 "wallet.dat"
 "keystore"
 "blockchain"
 "bitcoin wallet"
 "password" + wallet name
 "24 words"
 "6P" (BIP38)
 Not searching in English? Run the same searches in your own language too — e.g. zaadzin (Dutch), Seed-Phrase (German), phrase de récupération (French), frase semilla (Spanish). The wallet app’s own name works in every language.
 Part 1 · Password managers & browser vaults
 0 / 8
 ▼
 Forgot the manager’s own master password? That is a separate recovery problem — the password manager guide covers KeePass, LastPass and 1Password.
 Found the password in a protected ZIP, Office file or PDF but can’t open it — or is the wallet file itself on an encrypted drive? The encrypted-file guide covers all of them — same offline tools.
 Your main password manager (LastPass, 1Password, Bitwarden, Dashlane, KeePass)
 Search the vault for the wallet’s name, your exchange, “crypto”, “bitcoin”, or the year you set it up. Check every folder and the archive — not just the main list. If you used the manager’s own password generator, the entry’s history tab may show the original value.
 Apple iCloud Keychain / Keychain Access
 On macOS open Keychain Access and search “wallet”, “bitcoin”, “crypto”, “seed”. Safari-saved passwords live under Settings → Passwords on iPhone and in System Settings on Mac.
 Google Password Manager (Chrome / Android)
 passwords.google.com or chrome://password-manager/passwords. Search every saved login — people often save the wallet password under the wallet’s website or the exchange URL.
 Firefox Lockwise / Edge password vault
 Both browsers save passwords locally — check even if you haven’t used them in years. Old browsers on old machines count too.
 Password-protected notes inside your manager
 Secure notes, credit-card sections, and “notes” tabs are classic seed-phrase hiding spots. Open every secure note, even ones that look unrelated.
 A second, older password manager you stopped using
 Check the phone/desktop you used before this one. Vaults from LastPass→Bitwarden→1Password migrations often leave the old vault behind, still installed.
 Password manager exports / CSV backups
 Many apps let you export everything to CSV. People do this “to be safe” and the file lands in Downloads or Documents, never opened again. Search your drives for *.csv, *.kdb and *.kdbx.
 The wallet app’s own password field / autofill history
 If the desktop wallet (Electrum, Exodus, Bitcoin Core) has “remember password” or autofill, the browser or OS may still hold it. Check form-fill history in Chrome and Safari.
 Part 2 · Notes, documents & files
 0 / 9
 ▼
 Notes apps: Apple Notes, Google Keep, Evernote, Notion, OneNote, Simplenote
 Search each app for “wallet”, “seed”, “crypto”, “12 words”, “24 words”, “backup”, “password”. Check the deleted/trash folder in each — notes get deleted and stay recoverable for weeks.
 Plain text files on every computer
 Search file contents, not just names: passwords.txt, wallet.txt, readme.txt, notes.txt, backup.txt. Use your OS search (or grep -Rni "seed" ~ on Linux/macOS) across Documents, Desktop, Downloads.
 Spreadsheets (Excel, Google Sheets, Numbers)
 People keep “accounts.xlsx” or a sheet called “Passwords” with every login including the wallet. Search all spreadsheets and check hidden tabs (right-click a sheet tab → Unhide).
 Word / Pages / PDF documents
 Search for “recovery”, “seed”, “backup” inside documents. PDFs of old emails, tax documents, or “crypto summary” files sometimes contain the words.
 ZIP / RAR / 7z / TAR archives
 Old backups live in archives. Search for *.zip, *.rar, *.7z, *.tar.gz and look inside — wallet files and seed text files are often archived and forgotten. Check archive passwords you reused elsewhere.
 Screenshots and photos on every device
 Open the gallery/photo app and search “screenshot”, “QR”, “wallet”, “backup”. The setup screen, the recovery sheet, a QR code of the address — all common screenshots. Check deleted-photos folders too.
 Exchange export / tax-report files
 CoinTracker, Koinly, or exchange CSV exports sometimes carry address lists or note fields. Search for the wallet address you remember — it may appear alongside a saved password or label.
 Browser downloads folder & browser history
 The keystore JSON you downloaded from MyEtherWallet years ago may still sit in Downloads. Search history for “keystore”, “myetherwallet”, “generate”, “wallet” to retrace when you created it.
 Desktop sticky notes and widget notes
 macOS Notes widgets, Windows Sticky Notes, and desktop applets. Windows Sticky Notes are searchable via the Sticky Notes app; Mac Stickies too. Physically check your monitor frame and desk for paper notes while you’re at it.
 Part 3 · Email & messages
 0 / 8
 ▼
 Search every email folder — sent, drafts, deleted, spam, archive
 People email themselves seeds “for safekeeping”. Search all folders, not just the inbox. Use the quick-search terms above and check the trash before it purges.
 Emails to yourself with attachments
 Search “to:me” + “wallet” / “backup” / “keystore”. Attached JSON keystores, wallet files, or screenshots are the classic self-backup that works.
 Old email accounts — the one before your current address
 Hotmail, Yahoo, Gmail, work email. Log into each and run the same searches. Old accounts are where the “setup era” mail lives.
 WhatsApp / Telegram “Saved Messages” / Discord / Signal DMs to yourself
 Saved Messages in Telegram is a very common seed hiding spot. Search your own chats for “seed”, “words”, “backup”, “phrase”. Check group chats where you might have shared it in an emergency (then consider those funds moved).
 Messages with the friend who introduced you to crypto
 That person may have told you how to set it up — the chat may contain the wallet name, the exchange, the year, or (concerningly) a shared phrase.
 Exchange welcome / recovery emails
 Coinbase, Kraken, Binance emails about your account may reference the wallet address or app used. They can also help you date the wallet’s creation, which anchors your memory search.
 Email drafts you never sent
 Drafts are the most forgotten folder. A half-written “my seed is...” draft counts as a backup — and if you find it, move the funds and delete it.
 Cloud chat exports (Slack, Teams, forums)
 If you discussed the wallet in a work chat or crypto forum, search those histories for the wallet name, address, or backup terms.
 Part 4 · Cloud storage & backups
 0 / 8
 ▼
 Google Drive / iCloud Drive / Dropbox / OneDrive / Mega
 Search each for *.txt, *.json, *.dat, *.csv and the keywords above. Check the trash/recycle bin of each cloud drive — deleted files linger for 30+ days.
 Old cloud accounts on other email addresses
 The Drive/Dropbox tied to your old email still holds its files. Same search, different account.
 Time Machine / Windows File History / Apple backups
 Time Machine may contain old deleted wallet files if a backup from that period still exists. Browse the backup timeline to the wallet’s setup period and look for wallet.dat, keystores, or seed text — but do not assume years-old deleted files are guaranteed: old backups can be thinned or deleted when the backup disk fills, and local snapshots are short-lived.
 Phone backups (iTunes, iCloud, Android)
 A full phone backup can contain app data, notes and photos from the era. Restoring/searching an old backup is work, but it’s one of the highest-yield searches when a seed was ever on a phone — getting the vault off the phone is its own step.
 NAS / home server / external drive
 If you own a Synology/QNAP or a USB drive “for backups”, search it — especially folders named backup, crypto, documents.
 Third-party backup services (Carbonite, Backblaze, Acronis, CrashPlan)
 Continuous backup services quietly hold versions of everything, including files deleted locally. Restore a file list from the setup era.
 Git repositories / code hosting
 Developers sometimes commit config files or keystores to private repos “temporarily”. Search GitHub/GitLab private repos and local .git history for wallet files. (And if you find one committed publicly — move the funds now.)
 Virtual machines / cloud servers / Docker volumes
 If you ran a node or a trading bot on a VPS (DigitalOcean, AWS, Vultr) or in Docker, the wallet or seed may live in that machine’s home directory or volume.
 Part 5 · Old devices & dead hardware
 0 / 9
 ▼
 The old laptop/PC you used when you set up the wallet
 This is the single highest-yield physical search. Even a dead laptop’s drive can be pulled and read as an external disk — the wallet file and browser data are still there. If the disk uses BitLocker, FileVault or another full-disk encryption system, you also need the disk unlock password, recovery key or account-based recovery route — do not assume the data is readable just because the drive can be physically removed. See where wallet files live.
 Old phones and tablets
 Search each one’s notes, gallery, and app data — even the ones “that stopped working”. If the phone powers on, check every app; if not, a backup may still exist.
 Old USB sticks and SD cards
 Plug in every stick you own and browse — not just the root. People save wallets to USB “for safety” and forget the stick entirely.
 The hardware wallet itself (Ledger, Trezor, etc.)
 Check its box, its recovery card, and the original packaging insert. Many devices ship with a card that people write the seed on. If you still have the device and it boots, note that a device PIN is not a wallet password — the real backup is the seed card it shipped with.
 Dead laptop hard drives — read them as secondary disks
 A “dead” laptop usually means the screen or battery died, not the disk. Pull the drive, put it in a USB enclosure, and browse it on another machine — but if the disk is BitLocker- or FileVault-encrypted, browsing it also requires the unlock password, recovery key or account-based recovery route; the data is not readable just because the drive can be removed. Full guide: how to find your wallet file.
 Old user profiles on shared computers
 Family PCs often have several Windows/macOS user accounts. The wallet was created under the account you used then — check each profile’s Documents/AppData.
 Old routers / IoT devices you configured
 A long shot, but if you ran a node on a Raspberry Pi or configured a router with a “notes” field, check those. Raspberry Pi SD cards are easy to read on a PC.
 Digital cameras / scanners / scan-to-email folders
 Paper backups are sometimes photographed or scanned. Check camera SD cards and any scan folder in your email.
 Old SIM cards and phone boxes
 People store seeds in the small box their phone or SIM came in. Check every gadget box in the house, not just phone boxes.
 Part 6 · Physical places
 0 / 12
 ▼
 Notebooks and journals — including old ones
 The classic spot. Flip through every notebook, planner and diary you own, not just recent ones. Seeds are often written on the last page or the inside cover.
 Sticky notes — desk, monitor, fridge, inside drawers
 The most underestimated place in the house. Check the back of notes, under the monitor stand, on the fridge, and inside desk drawers.
 Wallets, card holders, phone cases
 Yes, the physical wallet. Cards with handwritten numbers, slips of paper, the sleeve inside a phone case — all plausible hiding spots.
 Safes, lockboxes, safety deposit boxes
 If you have a home safe or a bank deposit box, that’s prime real estate for a seed on paper or metal. Check old ones you haven’t opened in years.
 Books — especially on a specific shelf
 Seeds are hidden between book pages, inside book covers, or in “bible-dip” style hiding spots. Check the books near your desk and the crypto/tech books you owned.
 Filing cabinets and old documents
 Bank statements, insurance folders, tax folders, old passports — a paper with 12 words doesn’t look special among papers. Go through the drawer systematically.
 Coat pockets, jacket linings, handbags, luggage
 The “emergency backup” in a coat you wore once. Check every pocket of every coat and bag, including travel bags.
 Garage, attic, basement, storage units
 Boxes you haven’t opened since a move are where paper backups go to die. Go through the labeled boxes — especially “documents”, “office”, “electronics”.
 Car — glovebox, sun visors, under seats, trunk
 A paper seed in the car “in case of house fire”. Check every compartment, including the spare tire area.
 Old calendars, planners, diaries, address books
 Passwords written next to dates, seeds on a calendar page, codes in an address book. Flip through every year, not just the current one.
 Under the keyboard, desk mats, monitor stands
 The “under the keyboard” cliché is a cliché because it works. Check desk mats, drawers within the desk, and the underside of monitor stands.
 A previous home — if you moved since setting up the wallet
 If you moved after creating the wallet, the paper backup may still be at the old address. Ask the current residents or landlord, and check any storage you left there. This is a real, documented recovery story category.
 Part 7 · People, timeline & memory
 0 / 7
 ▼
 Your partner, family, or housemates
 Ask the people who live with you whether they ever saw a paper with words or numbers, a USB stick, or a “crypto notebook”. Shared households create shared hiding spots.
 The friend or colleague who helped you set it up
 They may remember the wallet type, the year, or have a copy. Ask directly — most people who helped set up a wallet remember more than the owner does.
 Rebuild the timeline: when, where, on what device
 When did you buy crypto? Which exchange? Which device was new then? Pin the year and the machine — it shrinks the search from “everywhere” to “that machine, that era”. The memory guide walks through this systematically.
 The wallet’s creation evidence: exchange history, purchase records
 Your exchange purchase history dates the wallet. Bank statements and tax files confirm the year. A dated wallet = a dated search window.
 The password manager’s own timeline / password history
 If the wallet password was ever stored in a manager and later changed, the manager’s history may show the older value. Check item history where available.
 The IT person or previous owner of the machine
 If the laptop was bought second-hand, work-issued, or set up by an IT friend, they may have created user accounts or saved files. Worth one polite question.
 The wallet’s address in old chats, emails, or posts
 Search for the address string itself (e.g. bc1…, 0x…). Where the address appears, the surrounding conversation often reveals the wallet type and era.
 Part 8 · Digital archaeology & deleted files
 0 / 7
 ▼
 Recycle bin / trash on every OS and cloud drive
 Deleted wallet files and seed notes sit in trash for weeks. Check the recycle bin on each computer and the trash in Drive/Dropbox/iCloud. Before you do: stop using the disk — see the golden rule in protect your wallet files.
 Undelete tools for recently deleted files
 If a wallet file was deleted recently and the disk hasn’t been overwritten, undelete tools (Recuva, PhotoRec, TestDisk) can often recover it. The more the drive has been used since, the lower the odds — act fast, offline.
 Browser profile data of old browsers
 Old Firefox/Chrome profiles contain saved passwords, form history and cookies from the wallet era. Dig into %APPDATA%\Mozilla or ~/Library/Application Support — even without the browser installed, the profile folder may survive.
 OS-level file search for wallet-file names
 Search every drive for wallet.dat, default_wallet, UTC--*, *.keystore, *.wallet, and files containing encrypted_key or ciphertext. Paths per wallet: find your wallet file.
 Hardware wallet recovery sheets and stickers
 Ledger/Trezor ship recovery cards; some people stick the seed under the device, on the box, or in the manual. Check the manual and the sticker habit.
 Old app data from the wallet app itself
 Uninstalled apps leave data behind: %APPDATA%, ~/Library/Application Support, Android /data. The wallet identifier tells you which file you’re looking for per app.
 Paper backups photographed into cloud photo libraries
 Google Photos and iCloud Photos index text in images. Search your photo library for “words”, “paper”, “document”, or the wallet name — OCR may surface a photographed seed sheet. If you find one, treat that seed as digitally exposed: do not only delete the photo. First restore/check the wallet safely, create a fresh wallet with a new seed, move the funds to fresh addresses, and only then clean up the photo, trash folders, cloud backups and synced devices.
 Found something? Don’t celebrate yet — protect it first.
 Found the wallet file, a seed, or a password? Before you do anything with it: make a read-only copy, then read protect your wallet files. And if you found a seed or password in email, photos or chat — move the funds and delete the copy; it has been exposed for years.
 Every box ticked and still nothing? Here is what it means.
 If you’ve genuinely searched all 68 places, you are not a disorganized person — you’re in the majority. Most people who forget a wallet password also forgot where they put the backup. At this point the situation splits into three paths:
 You have the wallet file but not the password. This is the recoverable path: is recovery technically possible? and the offline tools explain the odds, which depend on the password’s strength and your memory of it.
 You have part of a seed phrase. That’s seed reconstruction, outside this site’s scope — the goal here is finding a complete copy. If the phrase is intact but a passphrase (25th/13th word) was used, that IS a password problem we cover.
 Nothing at all, no file, no phrase. Be honest with yourself: a fully random password with no file is mathematically unreachable — your realistic path is finding a stored copy.
 Cite this page
 APA: Bink, R. (2026). 68 places a forgotten wallet password can hide — work through them all. ForgotWalletPassword.com. https://forgotwalletpassword.com/the-ultimate-search-checklist
 Markdown: [68 places a forgotten wallet password can hide — work through them all.](https://forgotwalletpassword.com/the-ultimate-search-checklist)
 The short version
 Where old passwords hide
 The seven highest-yield places, if you only have 30 minutes.
 Do the 30-minute sweep →
 When the search fails
 How your memory made it
 If the password isn’t stored anywhere, rebuild it from your own habits.
 Rebuild the pattern →
 Keep your head
 The first 24 hours
 The calm, ordered plan for the day you realise the password is gone.
 Follow the plan →
# Terms of use for ForgotWalletPassword.com — acceptable use, no guarantees, liability and applicable law.
URL: https://forgotwalletpassword.com/terms

Terms of Use — ForgotWalletPassword.com
 Skip to content
 Terms of use
 The rules for using this site.
 Plain terms: what you may do here, what you may not do, and how far our responsibility goes.
 These terms
 By using ForgotWalletPassword.com you agree to these terms of use. If you do not agree, do not use the site. The disclaimer is part of these terms and should be read together with them.
 Educational use only
 This site publishes educational information about crypto wallet passwords, wallet file formats and password recovery. It is not financial, investment, legal or technical advice for your situation, and it does not provide recovery services. Content on the site may change, move or disappear at any time.
 Acceptable use
 You may use the guides, tools and instructions only for lawful purposes, and only on wallets, files, devices and accounts that you own or are authorized to access. You are responsible for ensuring that your use complies with the law of your country. The tools are designed for offline use on your own machines: do not upload wallet files, hashes or seed phrases to third-party “recovery” websites, and never share them with anyone who contacts you unsolicited.
 You may not misuse the site — for example, by attempting to disrupt it, scrape it at scale, or use its content to run scams or phishing. We may restrict access for anyone who does.
 No professional relationship
 Reading this site does not create a client, advisory, fiduciary or contractual relationship between you and the operator. If you use the separate recovery service operated by Crypto Recovers, that relationship is governed by the service’s own agreements, not by these terms.
 No guarantees
 Password recovery is governed by mathematics. No guide, tool or statement on this site guarantees that a forgotten password will be recovered, that a wallet file exists, or that a specific result will occur. Feasibility statements (“possible”, “unlikely”, “impossible”) are technical assessments, not promises.
 Intellectual property
 The text, structure, design and code of this site belong to the operator unless stated otherwise. You may read it, share links to it, and use the instructions for your own recovery. You may not republish substantial parts of the site, sell its content, or present it as your own without permission. Wallet names, logos and trademarks of third parties belong to their respective owners and are used here only to identify them.
 Third-party content and tools
 The site links to third-party tools (btcrecover, hashcat, John the Ripper, wallets and services) for convenience. We do not control those tools or sites and are not responsible for their behavior, security or data handling. Always download software from official sources and verify what you install.
 Disclaimer of warranties
 The site and its content are provided “as is” and “as available”, without warranties of any kind, express or implied, including accuracy, completeness, fitness for a particular purpose and non-infringement. We work to keep technical details current, but wallet versions, KDF parameters and file paths change over time.
 Limitation of liability
 You use this site and follow its instructions at your own risk. To the fullest extent permitted by applicable law, the operator and its owners, employees and contributors are not liable for any loss or damage — including, but not limited to, loss of funds, loss of data, or loss of access to a wallet or device — arising out of or in connection with your use of this site, its content, or anything you do (or do not do) after reading it. See the disclaimer for the full statement.
 Changes
 We may update these terms at any time. The current version is dated 15 August 2026. Continued use of the site after changes means you accept the updated terms.
 Applicable law
 These terms are governed by the laws of the Netherlands. The operator is established in the Netherlands (Crypto Recovers, KVK 75927276, Le Mairekade 77, 1013 CB Amsterdam). If a dispute arises from your use of this site, the courts of Amsterdam have jurisdiction, subject to any mandatory rules of your country of residence.
 Contact
 Questions about these terms: contact us or email support@cryptorecovers.com. See also the privacy policy and the disclaimer.
 Your data
 Privacy policy
 What this site collects, what it never sees, and your rights.
 Read the privacy policy →
 Legal fine print
 Disclaimer
 Educational content only — what this site is, what it isn’t, and who is responsible.
 Read the disclaimer →
 Get in touch
 Contact
 Corrections, questions and the right channel for a recovery case.
 Contact us →
# Offline token list builder — generate btcrecover tokens.txt from your password fragments, fully local.
URL: https://forgotwalletpassword.com/token-builder

Token List Builder — Offline (no internet needed)
 Offline tool · no internet needed
 Token list builder
 Turn the fragments you remember into a ready-to-run tokens.txt for btcrecover. Save this file, open it from your computer, and everything you type stays on your machine.
 How to use it: download this page as a single HTML file, then double-click it to open it locally. It works with your internet switched off. Nothing is sent anywhere — there is no server, no network request, nothing stored. Close the file and your fragments are gone.
 Download this tool — one HTML file
 Your fragments
 Enter pieces only — never your full password, and never a seed phrase.
 Base words — one per line (or space-separated)
 Numbers & years — comma-separated
 Symbols
 Capitalise first letter
 All caps
 Substitutions (a→@, e→3, o→0, s→$, i→!)
 Append year / number
 Prepend year / number
 Append a symbol
 Prepend a symbol
 Try separators ( _ . - )
 2-digit year variants
 Output for:
 btcrecover
 hashcat
 John the Ripper
 btcrecover wants a token list; hashcat and John the Ripper want a flat wordlist (one candidate per line). Pick your tool and the output formats itself.
 How long will testing take?
 Pick the wallet format and hardware you will test on — the estimate uses the measured speeds from the benchmarks page. It updates every time you generate a list.
 Wallet format
 Bitcoin Core wallet.dat (BDB)
 Bitcoin Core wallet.dat (SQLite)
 BIP38 paper key
 BIP39 passphrase
 Blockchain.com v0 export
 Blockchain.com v2 export
 Blockchain.com v3 export
 Coinomi vault
 Electrum 2.8+ passphrase
 Ethereum keystore (scrypt)
 MetaMask vault
 MultiBit Classic .key
 MultiBit HD
 Hardware:
 Ryzen 9 9950X CPU
 RTX 5090 GPU
 i7-10700K CPU
 Generate a list to see the estimate.
 Keep it safe:
 The generated file is your candidate list — store it offline with your wallet files and never upload it to a public checker or unknown website. Fragments and variations are fine; a full password or a seed phrase never belongs in any tool or website.
# wallet.dat — the most-studied wallet file in password recovery.
URL: https://forgotwalletpassword.com/wallet-dat-password-recovery

Forgot Your wallet.dat Password? The File Explained
 Skip to content
 Wallet format · Bitcoin-family coins
 wallet.dat — the most-studied wallet file in recovery.
 If your coins lived in Bitcoin Core, Bitcoin-Qt, Litecoin Core, Dogecoin Core, Bitcoin Cash, Dash or any classic desktop client, the file is called wallet.dat. It is the same file format across the entire Bitcoin family — and its encryption is public, well documented and, for old wallets, remarkably fast to test.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Wallet.dat passwords are among the most recoverable wallet types — especially low-round files. The key derivation uses iterated SHA-512 with a machine-tuned round count stored in the file (original baseline ~25,000; btcrecover’s reference wallets measure ~68k–267k). Fewer rounds means hundreds of guesses per second on a CPU and thousands on a modern GPU; high-round files run ~4× slower per guess.
 Which wallets use wallet.dat?
 wallet.dat is the wallet file of the entire Bitcoin family of Core clients — not just Bitcoin. The legacy encryption structure and recovery rules are shared across them, so this guide applies to all — with one caveat: the filename does not tell you which database backend is inside (legacy Berkeley DB vs modern SQLite descriptor wallets, depending on wallet type and version):
 Bitcoin — Bitcoin Core, Bitcoin-Qt (the reference client)
 Litecoin — Litecoin Core
 Dogecoin — Dogecoin Core
 Bitcoin Cash — BCHN, Bitcoin ABC, Bitcoin Unlimited
 Dash — Dash Core
 Dozens of older forks (Feathercoin, Viacoin and more) kept the same format
 One important detail: a wallet.dat only holds the keys of the coin it was created for. Your Dogecoin wallet.dat is not a Bitcoin wallet — if you used several coins, each client has its own file. See the wallet.dat forks guide for the coin-specific details.
How wallet.dat encryption works
 Since Bitcoin Core 0.4.0, wallet.dat encryption works like this:
 Your password is stretched with iterated SHA-512 (OpenSSL EVP_BytesToKey) using a random salt stored in the file.
 The result encrypts a randomly generated master key with AES-256-CBC.
 That master key encrypts your private keys. So a recovery attack only needs to verify the password→master-key step — which is exactly what makes it fast.
 Iteration counts: stored in the file and chosen when the wallet was encrypted, based on machine speed — the original baseline was ~25,000 rounds. Bitcoin Core 0.21 (released January 2021) introduced SQLite-backed descriptor wallets, but they were experimental — legacy BDB wallets still existed and remained common; from Bitcoin Core 23.0, newly created wallets use descriptor wallets by default unless legacy creation is selected. The rounds count stays machine-tuned and stored in the file. btcrecover’s reference wallets measure 67,908 and 267,488 rounds. Old wallets keep their original settings.
 Recovery tools and speeds
 Tool
 How it works
 Typical speed class*
 btcrecover
 Open-source, purpose-built for wallet.dat (and other Bitcoin-era wallets). Uses token files, masks and passphrase lists.
 Hundreds of guesses/sec on low-round files (CPU); low hundreds on high-round (~267k) files — GPUs multiply wallet.dat rates roughly 10–25×
 hashcat (mode 11300)
 GPU-accelerated cracking of Bitcoin/Litecoin wallet.dat.
 Same order-of-magnitude as btcrecover on good GPUs
 *Order-of-magnitude estimates on a high-end consumer GPU (e.g. RTX 4090 class). Exact rates vary by hardware and tool version — the category is what matters.
 Which iteration count does your wallet have?
 The single biggest factor in a wallet.dat case is the era of the file, because it determines the key-derivation cost. Roughly:
 EraBitcoin Core versionSHA-512 key-stretching roundsGuess cost
 2011–20200.4 – 0.2025,000+ — machine-tuned (reference wallets 68k–267k)Low rounds = fast guesses — the classic recoverable case
 2020–present0.21+ (SQLite descriptor wallets; default from 23.0)Machine-tuned, often 200k+ (reference ~267k)~4× slower per guess when rounds are ~4× higher
 You can usually tell from the file’s modification date and which wallet version created it. If you don’t know, the wallet’s own header or the software version that last opened it usually tells the story — see how wallet encryption works for reading these settings.
 A realistic wallet.dat attack workflow
 1
 Copy the file, read-only, offlineThree copies: the original stays untouched, one working copy, one backup. Never open it in a wallet that might migrate it. The five protection steps.
 2
 Run the search checklist firstThe password is often stored somewhere already — 68 places to look before cracking becomes the plan.
 3
 Build your token list from memoryNames, dates, symbols, substitutions, keyboard patterns — the raw material for btcrecover. How your memory made it.
 4
 Run btcrecover or hashcat on the copyStart with your most likely candidates, then widen. Check the math first: realistic cracking times.
 5
 Let the numbers decideIf your search space is weeks of GPU time, the feasibility math is the arbiter — before you buy hardware or spend any money.
 What decides your case
 Which iteration count — check the wallet version. A 2015-era wallet.dat is dramatically easier than a 2021+ one.
 What you remember — rebuild your candidate list first; raw brute force rarely wins.
 Human vs random — a human-chosen password with hints is realistic; a 16-character random one is not (see the feasibility guide).
 Never run tools on the original
 Always work on a read-only copy, offline, on a machine you trust. Do not open the wallet in newer Bitcoin Core versions that might migrate the file — the protection guide covers this in detail.
 Corrupted wallet or forgotten password?
 If the client says the wallet is damaged, unreadable or fails to open, the problem may not be the password at all. A wrong password produces a specific wrong-password error (Bitcoin Core: “The wallet passphrase entered was incorrect”); a file that “cannot be read”, is missing data, or was overwritten points to corruption — a different problem with different tools. The preserved copy (see protect your wallet files) is what makes either path possible. If the file itself is damaged, that is data recovery, which is outside this site’s scope.
 Related reading
 Frequently asked questions
 How do I know if my wallet.dat is actually encrypted?
 Do not infer encryption from whether Bitcoin Core opens the wallet. An encrypted wallet can load and display information while locked; the passphrase is required for private-key operations such as sending, signing or dumping keys. Check the wallet’s encryption/lock state instead, and only test on a verified copy.
 Why does an old wallet.dat crack so much faster than a new one?
 The iteration count is stored in the wallet and was chosen when it was encrypted, based on the machine’s speed; the original baseline was ~25,000 rounds, and btcrecover’s reference wallets measure 67,908 to 267,488 rounds. Fewer iterations means more guesses per second — a low-round wallet can test about 4 times faster than a high-round one, but only when it actually has fewer rounds.
 I have several wallet.dat backups — which should I work on?
 All of them, but always on copies. The right backup is the one holding the keys behind your balance; an old backup may be unencrypted or use far weaker settings, which changes everything. Never work on the originals — see protect your wallet files first.
 I remember part of the password — does that actually help?
 Enormously. Knowing the structure (“a name + a year + a symbol”), a few fragments, or even the length can shrink the search space from astronomical to realistic. This is the single biggest lever you control — build a hint list from every fragment you can recall before touching any tool. If you only remember part of the password, the partial-memory patterns show how to turn fragments with gaps into a search.
 Is my password stored inside the wallet.dat?
 No. The file stores an encrypted master key plus a verifier — a derived value that lets software check a candidate password without storing the password itself. That verifier is exactly what tools like btcrecover and hashcat test against, which is why recovery never requires spending or moving any coins.
 Can an online “wallet unlocker” service do this faster?
 No — and uploading your wallet.dat to one is how wallets get stolen. The same offline tools run at the same speed on your own hardware, and legitimate recovery never needs your file to leave your machine. See offline recovery tools.
 Sources & references
 Bitcoin Wiki — wallet encryption
 hashcat — example hashes (wallet formats & modes)
 Cite this page
 APA: Bink, R. (2026). wallet.dat — the most-studied wallet file in recovery. ForgotWalletPassword.com. https://forgotwalletpassword.com/wallet-dat-password-recovery
 Markdown: [wallet.dat — the most-studied wallet file in recovery.](https://forgotwalletpassword.com/wallet-dat-password-recovery)
 Guide · 04
 Is recovery technically possible?
 The full feasibility equation and all wallet formats side by side.
 Read the feasibility →
 Related format
 Electrum wallet guide
 Bitcoin wallets from the Electrum app — a different, slower encryption.
 Electrum guide →
 Overview
 Which wallet passwords can be recovered?
 wallet.dat’s verdict — and every other wallet — in one searchable table.
 See the master list →
# The vault is on an old phone? Extraction comes before the crack — ADB, iTunes, browser vaults.
URL: https://forgotwalletpassword.com/wallet-file-on-old-phone

Get Your Wallet File Off an Old Phone — Before You Crack It
 Skip to content
 Find the file · mobile edition
 Get your wallet file off an old phone
 The password crack runs on the wallet file — so if the vault only exists in a phone’s app storage, extraction comes first. This page gets your own wallet data out via backups and exports, strictly for the password recovery that follows. It is not phone recovery; it is the mobile half of finding your wallet file.
 By Robbert Bink · ~9 min read · Published 10 August 2026 · Last reviewed: 14 August 2026
 The headline
 The password crack runs on the wallet file — if that file only exists in a phone’s app storage, extraction comes first. This page gets your own vault out via backups and exports so the normal password recovery can start. It is not phone recovery; it is the mobile half of finding your wallet file.
 Strictly for password recovery — nothing else
 What this page is: the extraction step of wallet-password recovery — getting your own encrypted vault file out of your own phone or backups, so the password crack has a file to test.
 What it is not: phone unlocking, rooting, data recovery from dead hardware, seed-phrase reconstruction, or anything involving someone else’s device.
 Why extraction comes first
 Every recovery tool on this site tests candidate passwords against the wallet file — the encrypted vault, keystore or .keys file. If that file only exists inside a phone’s app storage, there is nothing to test until it is out. That is why “the vault is on my old phone” is usually the real blocker: the cracking is the easy part, the extraction is the hard part.
 Everything below works on your own device and your own backups, through the paths the platforms themselves provide: exports, ADB backups, cloud backups and encrypted computer backups. No lockscreen bypass, no rooting guide, no recovery of someone else’s data — those are not this site.
 Step 0 · Is this even a password case?
 Before you extract anything: if you still have the wallet’s seed phrase, you do not need the vault at all — restore it in the original wallet or a compatible wallet that supports the same seed type, coin and derivation settings, and set a new password. Extraction only matters when the seed is gone too and the encrypted vault is your only door. If you’re not sure which situation you’re in, the password vs seed phrase page settles it. → What did you actually lose?
 Android — the realistic paths
 Wallet app data on Android lives in the app’s private folder (/data/data/<package>/), which Android does not let you browse normally. Three paths get a copy out without changing the phone:
 The app still opens → use its own path. Some wallets let you export or reveal the vault data, or simply show you the file path in the app’s settings. If you can still unlock the app itself, your problem may already be solved by its seed phrase.
 ADB backup (Android 11 and earlier, and only sometimes). With USB debugging enabled, adb backup -f wallet.ab -noapk <package> may export the app’s data — whether it does depends on the app’s backup configuration (android:allowBackup and its backup rules; many wallet apps deliberately exclude sensitive data) and the Android version. On Android 12+ with apps targeting API 31+, adb backup only covers debuggable apps. If it works, unpack the result with the open-source Android Backup Extractor: java -jar abe.jar unpack wallet.ab wallet.tar (add the backup password as the last argument if you set one), and the vault file may be inside the .tar.
 Full-device backups. OEM cloud backups, Google One and manufacturer tools can contain app data; restoring one to another device you own may bring the vault back into the app, after which the export path applies.
 Root-style backup tools (Titanium Backup, Swift Backup) read the private folder directly, but this guide deliberately stops at the paths that don’t require changing the device. The same rule applies to every path: copy first, then work on the copy. Whatever you extract, the next step is the normal password recovery for that wallet — the table below shows the exact guide per app.
 iPhone — the encrypted backup
 Wallet app data on iPhone lives in the app’s local storage. An encrypted iTunes/Finder backup can carry more sensitive data than an unencrypted one: restore that backup to a device you own (or a fresh install) and the wallet app’s data may come back with it. How much comes back depends on how that specific app stores its secrets — some keychain classes are device-bound or excluded from backups, so wallet data is not guaranteed to be there.
 If the backup itself is password-protected and you don’t remember that password, that is a second lock — and it is a password problem this site does cover: hashcat mode 14700 (iTunes < 10.0) or 14800 (iTunes ≥ 10.0), extracted from the backup’s manifest. Realistic only with a human-made backup password and clues — the math is the same as everywhere else. → hashcat step by step
 Browser-extension vaults
 MetaMask, Keplr and imToken-style vaults in browsers live in the browser profile’s LevelDB storage (the extension-ID folder) — no phone needed. The MetaMask guide shows exactly where; the JtR walkthrough covers extracting Keplr.
 Wallet → what you need → what happens next
 WalletAndroid package / fileAfter extraction
 MetaMaskio.metamask — encrypted vaultMetaMask guide — vault → hashcat / btcrecover
 Coinomicom.coinomi.wallet — scrypt vaultCoinomi guide — coinomi2john / btcrecover
 imTokenim.token.app — keystore / vaultEthereum keystore guide — modified keystore (identity.json)
 Keplrcom.chainapsis.keplr — vaultkeplr2john → JtR (legacy extension format; identify v2/current vaults before assuming compatibility)
 Exodus (desktop)not a phone file — seed.seco from the desktop installExodus guide — exodus2hashcat → hashcat 28200
 Exodus (mobile)app vault on the device — do not assume seed.secono seed.seco / 28200 route — preserve app data and follow Exodus’s mobile recovery path (12-word secret key / passkey)
 Package names are the publicly documented Android identifiers; the exact vault filename inside the backup varies per app version. Once the file is out, the case is a normal one: find your verdict in the master list and run the right tool. Coinomi Desktop/Windows is not a phone-extraction case — check %LOCALAPPDATA%\Coinomi\Coinomi\wallets instead.
 The dead ends
 Two situations end before extraction starts. First: the vault never left the phone, you never made a backup, and the phone no longer works — getting data off dead hardware is data recovery, not password recovery, and this site deliberately does not cover it. Second: you have the seed phrase somewhere but can’t find it — that’s a search problem, not an extraction problem; the 68-place checklist is the systematic way to hunt it down.
 Safety rules (same as always)
 Never upload vault data, backups or phone images anywhere. Everything here runs offline, on copies, with tools from official sources — the vault file you extract is as sensitive as the seed itself. → Protect your wallet files
 Frequently asked questions
 Can I get a wallet file off a phone without rooting it?
 Often yes, via backups: ADB backup on Android 11 and earlier, an encrypted iTunes/Finder backup on iPhone, a full-device cloud backup restored to another device, or the app’s own export. Root-style backup tools exist, but this guide deliberately sticks to the paths that don’t require changing the device.
 Is this phone recovery or wallet password recovery?
 It is the extraction step of wallet password recovery: the password crack runs on the wallet file, so the file has to be out of the phone first. This page is not about recovering a phone or bypassing locks — only about getting your own wallet data via backups and exports.
 I never made a backup — what now?
 If the vault never left the phone and the phone no longer works, retrieving it is data recovery — outside this site’s scope. The realistic alternative is to find the seed phrase instead: the search checklist walks through every place it can hide.
 The desktop half
 How to find your wallet file
 Exact paths for wallet.dat, Electrum, keystores and vaults on Windows, macOS and Linux.
 Find the file →
 No file anywhere?
 Recovery without the wallet file
 The answer, plus the real exceptions that still work.
 Read the exceptions →
 The seed might still exist
 The 68-place search checklist
 Before extraction or cracking, search everywhere a seed or vault copy can hide.
 Start the search →
 The most common case
 MetaMask wallet recovery
 Vault vs seed phrase — and what unlocking the vault file actually takes.
 Read the MetaMask guide →
# How wallet password encryption changed over time — the version timeline.
URL: https://forgotwalletpassword.com/wallet-password-encryption-timeline

Wallet Password Encryption Timeline — How Formats Changed
 Skip to content
 Reference · version history
 How wallet password encryption changed over time.
 The same wallet name can hide very different encryption depending on the version — and the version decides how fast (or whether) recovery works. This page is the quick reference for what changed, when, and why it matters for your file.
 By Robbert Bink · ~5 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The headline
 Version first, tool second. A 2013 wallet.dat and a 2021 wallet.dat both call themselves wallet.dat — but one can test ~4× faster per guess. The same is true for Electrum, MultiBit and Blockchain.com files. This timeline shows the encryption changes that matter, so you can pin your file to its era before choosing a tool.
 The timeline at a glance
 Wallet / formatEraEncryption / KDFWhat it means for recovery
 Bitcoin Core wallet.dat2009–2011No built-in encryptionA wallet from this era was usually never encrypted — the password you remember may be irrelevant.
 Bitcoin Core wallet.dat0.4 (2011) – 0.20AES-256-CBC + iterated SHA-512 (EVP_BytesToKey), ~25,000-round baseline, machine-tuned at encryption timeOld files often have fewer rounds — faster to test. The count is stored in the file, not fixed by the version.
 Bitcoin Core wallet.dat0.21 (2021) – presentSame KDF; descriptor wallets use the SQLite backend (experimental in 0.21–22, default from 23.0) — legacy BDB wallets remainSame encryption, typically higher rounds; hashcat mode 11300 unchanged.
 Electrum1.x (2011–2014)Double-SHA-256-based key schemeVery weak by today’s standards — old Electrum files test fast.
 Electrum2.0–2.7 (2015–early 2017)Legacy keystore, double-SHA-256 familySame weak family; extraction picks the salt type.
 Electrum2.8+ (2017–present)PBKDF2-SHA512 1,024 + ECC (BIE1 keystore)Slower per guess; hashcat modes 21700/21800 by salt type.
 MultiBit Classic2011–2016.key backup: 3×MD5 · .wallet file: scrypt N=16,384The .key backup is ~1,000× faster per guess — the classic “wrong file” trap.
 MultiBit HD2014–2016scrypt N=16,384 r=8 p=1Much harder; the 12–24-word phrase restores without the password.
 Ethereum keystore v32016–presentscrypt or PBKDF2-HMAC-SHA256; parameters stored in the file's kdfparams (geth commonly uses scrypt N=262,144, but lighter/non-default configurations exist)Both slow; the JSON header names the KDF (hashcat 15700 vs 15600) — read the actual parameters before estimating speed.
 MetaMask Extension — legacy vaults2016–present (legacy layout)PBKDF2-HMAC-SHA256, 10,000 iterations fixed (hashcat 26600)Fast per guess; the phrase is the faster path whenever you have it.
 MetaMask Extension — newer vaultsNewer vault layouts (dynamic iteration counts)PBKDF2-HMAC-SHA256, iteration count stored in the vault metadata — read the actual parameters instead of assuming 10,000 (dynamic-count mode 26610; 26620 only in newer/development hashcat builds)Speed depends on the stored count — a 600,000-iteration vault is roughly 60× slower per guess than a 10,000 one; the phrase is the faster path whenever you have it.
 MetaMask MobileMobile app vaultsSeparate vault format — PBKDF2-based with its own parameters (hashcat 31900)Not the same as the extension vault — use the mobile-specific extraction and mode rather than applying extension parameters.
 Blockchain.comv0 (2011) / v2 / v3 (2020+)PBKDF2-SHA1 at 10 / 10,000 / 5,000 iterationsThe earliest exports are effectively unprotected; v2/v3 still crackable with clues.
 BIP38 paper keys2012–presentscrypt N=16,384 r=8 p=8Memory-hard — tens of guesses per second; clues decide.
 BIP39 passphrase2013–presentPBKDF2-HMAC-SHA512, 2,048 iterations; candidates verified by deriving target addressesThe “25th word” is a password problem, and a recoverable one with clues.
 Why the version decides your odds
 Two passwords of identical length can sit in completely different recovery universes purely because of when the wallet was encrypted. The master list shows the current KDF per wallet, the benchmarks page shows the measured speeds, and the feasibility guide turns both into a verdict. The one thing this timeline adds is time: the era of your file is often the first and most reliable clue about its encryption.
 How to find your version
 Bitcoin Core: the wallet version is visible in the client’s debug log and the wallet header; the wallet.dat guide explains the file versions.
 Electrum: let electrum2john.py detect the wallet format — for fully encrypted 2.8+ wallets it processes the encrypted container (base64 BIE1 prefix), not the JSON. The mode follows the generated $electrum$N prefix: 1/2/3 → 16600, 4 → 21700, 5 → 21800. Since 2.8, the whole wallet file can be ECIES-encrypted on top of the internally encrypted seed — the extractor handles that layer.
 Blockchain.com: the export filename and JSON structure identify v0/v2/v3.
 Not sure at all? The wallet-file identifier routes by extension and app first.
 Sources & references
 Bitcoin Core — wallet source (KDF and version history)
 Electrum — source (keystore and version history)
 hashcat — example hashes (mode and KDF reference)
 BIP38 — passphrase-protected private keys
 BIP39 — mnemonic code
 Today’s formats
 The master list
 Every wallet’s current verdict, encryption, tool and mode — the living counterpart to this timeline.
 Open the master list →
 The speeds
 Benchmarks & methodology
 Measured guesses per second per format — hardware, method and dates included.
 See the measured speeds →
 The mechanics
 How wallet encryption works
 KDFs, iterations and version differences — the reference behind every row above.
 Read the encryption reference →
 The verdict
 Is recovery possible?
 Turn the version and the speed into a straight answer — possible, feasible, or impossible.
 Read the feasibility →
# What are your real password recovery odds?
URL: https://forgotwalletpassword.com/wallet-password-entropy-calculator

Wallet Password Strength Calculator — Your Recovery Odds
 Skip to content
 Tool · built on measured crack speeds, not guesses
 What are your real recovery odds?
 This calculator turns your password into two numbers that decide everything: how many possibilities exist, and how fast the best available hardware could check them. It uses measured crack speeds from the open-source btcrecover benchmark suite — not marketing figures.
 By Robbert Bink · ~6 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Two numbers decide your case: the size of the password space (character-set size raised to the password length) and the guesses-per-second rate your wallet format allows. An old wallet.dat is checked hundreds of times per second on a desktop CPU; a modern Ethereum scrypt keystore only around a hundred. Use the tool below to find where your password falls — and what that means.
 Test password (don’t type your real password — use a random variation. It is processed only in your browser and never sent anywhere)
 Approximate length
 10
 Character types it would have contained
 lowercase
 UPPERCASE
 1234
 !@#$
 Wallet type
 Hardware doing the checking
 Typical modern CPU (16-core)
 High-end GPU (RTX 5090-class)
 What do you remember?
 Nothing — assumed fully random
 Weak clues — I know its general shape
 Good clues — I remember several parts
 Strong clues — almost everything
 Entropy—
 Possible passwords—
 No hints — full brute force—
 With your clues—
 Fill in the fields above to get your verdict.
 The password you type (or the shape you describe) is treated as a sample of the search space — the calculator estimates how long the space of similar passwords would take to check; it is not checking your actual password, which never leaves your browser. The clue reductions are deliberately conservative heuristics, not guarantees: “weak clues” narrows the space by a factor of 100, “good clues” by 10,000,000, “strong clues” by 100,000,000,000. Treat these clue reductions as rough examples, not predictions — real-world reduction depends on how specific, accurate and structured the clue is.
 The measured speeds behind this calculator
 Every rate in the dropdown comes from the official btcrecover performance benchmarks — the numbers the open-source recovery community actually measures, not advertises. “CPU” is a Ryzen 9 9950X (16 cores); “GPU” is an RTX 5090. Where a format is memory-hard (scrypt), GPUs gain little, which is why some rows show the CPU rate for both.
 Wallet formatKey derivation (verified)Guesses/sec, CPUGuesses/sec, GPU
 wallet.dat — low-round reference (~68k)iterated SHA-512 (EVP_BytesToKey)47211,950
 wallet.dat — high-round reference (~267k)iterated SHA-512 (EVP_BytesToKey)1223,210
 Ethereum keystore (scrypt)scrypt N=2¹⁸ (geth standard) · reference test N=2¹⁷96— (no GPU result in the reference test)
 BIP38 paper-wallet keyscrypt N=2¹⁴ r=8 p=87243 (GPU slower — CPU is the practical choice)
 MetaMask vault — legacy 10kPBKDF2-SHA256 10k5,1605,590
 Electrum 2.8+ passphrasePBKDF2-HMAC-SHA512 1k iterations; candidate verified by deriving keys (ECIES/BIE1)29,6704,300 (GPU slower — CPU is the practical choice)
 BIP39 passphrasePBKDF2-HMAC-SHA512 2k iterations; candidate verified by deriving target addresses15,25019,950 (RTX 5090/OpenCL)
 Blockchain.com — v0 exportPBKDF2-SHA1, 10 iterations627,580627,580 (CPU rate)
 Blockchain.com — v2 exportPBKDF2-SHA1, 10,000 iterations2,7709,470 (RTX 5090/OpenCL; CPU 2,770)
 Blockchain.com — v3 exportPBKDF2-SHA1, 5,000 iterations5,45020,030 (RTX 5090/OpenCL; CPU 5,450)
 MultiBit Classic — .key backup3×MD51,810,0001,810,000 (CPU rate)
 MultiBit Classic — .walletscrypt N=2¹⁴ r=8 p=1510510 (no GPU gain)
 MultiBit HDscrypt N=2¹⁴ r=8 p=1510510 (no GPU gain)
 Coinomi vaultscrypt N=2¹⁴ r=8 p=1503503 (no GPU gain)
 wallet.dat rows use the measured btcrecover reference values (67,908 and 267,488 rounds on the reference wallets). All rows are published measurements from the btcrecover benchmark suite (Ryzen 9 9950X / RTX 5090, July 2026). The MetaMask row is the legacy 10,000-iteration vault — newer vaults store their own KDF parameters in the vault data (read the actual count; 600,000 and 900,000 are both documented), which can run up to roughly 90× slower per guess. These are point estimates — real hardware varies with driver, tool version and your file’s KDF parameters — so treat every result as an order of magnitude, not a promise. Hardware, method and dates are on the benchmarks & methodology page.
 How the math works
 Entropy = length × log₂(character-set size). Each bit doubles the work: a 10-character lowercase password is ~47 bits; a 16-character mixed password is ~100+ bits. The jump from “hard for a week” to “hard for the universe” happens around 80 bits.
 Possible passwords = character-set^length. This is the search space — the number of guesses a blind attack would have to try.
 Time = search space ÷ guesses per second. A low-round wallet.dat checked at 472 guesses/sec needs ~2×10²¹ seconds for a 12-character random password — compare that with the ~4.4×10¹⁷ seconds the universe has existed.
 Clues shrink the space, not the speed. Remembering that the password began with your initials doesn’t make the GPU faster — it removes all passwords that don’t fit, which is worth orders of magnitude more. This is why memory reconstruction beats hardware.
 What the calculator cannot tell you
 Uncertainty. The output is one number from one benchmark run; the realistic range around it is usually “an order of magnitude either way”. Use it to separate minutes from months — not to bet on 4 hours vs 5.
 Whether your memory is right. It models the password you give it — not the one you actually used. If you feed it a 16-character guess and your real password was 11, the verdict is wrong in the optimistic direction.
 Hardware you don’t have. The rates assume hardware you can actually run offline. Cloud GPU rentals multiply the check rate — at a price.
 Pattern-based shortcuts. Real attacks use wordlists, keyboard-layout masks and year lists that are far smaller than the full space. If your password is patterned (a name, a date, a habit), the estimate sits closer to the “with your clues” column than the brute-force one — read how offline tools actually work.
 The difference between guessing and unlocking. A MetaMask password or a PIN gate may reset without any guessing — the calculator only models encryption that has to be broken offline.
 If the math says impossible, that’s the real answer
 A password with ~90+ bits of entropy cannot be brute-forced by anyone — not by a $500 online “service”, not by a lab with a server farm. You just ran the calculation most people skip. If your number lands in the impossible zone, that knowledge is your protection.
 Next steps with your number
 Fast to crack? Fix it now. If your verdict is minutes or hours, the priority is securing the wallet file and doing the 68-place search — your password is likely findable, and you want to be the one who finds it.
 Reachable with clues? Invest in memory reconstruction, then run the numbers again with the better clue level.
 Impossible? You now know the realistic range. Trust the math — anyone who claims otherwise is not doing real work.
 Sources & references
 btcrecover — performance benchmarks
 BIP39 — mnemonic code for generating deterministic keys
 ethereum.org — Web3 Secret Storage (keystore specification)
 BIP38 — passphrase-protected private keys
 The bigger picture
 Lost crypto statistics
 How much Bitcoin is really lost, the well-documented cases, and the source-cited numbers behind the headlines.
 See the data →
 Readable explainer
 How long to crack a password?
 The same math, explained in plain language with everyday examples.
 Read the explainer →
 Under the hood
 How wallet encryption works
 Key derivation, iteration counts, and what each wallet format does.
 Understand the KDF →
 The bigger picture
 Which wallet passwords can be recovered?
 Run the numbers, then find the verdict — every wallet in one table.
 See the master list →
 The line
 Is recovery possible?
 Your numbers, the ladder — possible, feasible, sensible, impossible.
 See the verdict →
# Recover a forgotten crypto wallet password yourself — the complete DIY route.
URL: https://forgotwalletpassword.com/how-to-recover-wallet-password

How to Recover a Crypto Wallet Password Yourself (DIY Guide)
 Skip to content
 DIY guide · the full route
 How to recover a crypto wallet password yourself
 The complete do-it-yourself route: secure your files, find the wallet file, rebuild the password from clues, and run the right tool offline. Every step links to the guide that does it in detail.
 By Robbert Bink · ~9 min read · Published 10 August 2026 · Last reviewed: 14 August 2026
 The headline
 Many wallet passwords are recoverable offline with free, open-source tools — provided you still have the wallet file (or the seed phrase without its passphrase) and enough memory clues to make the search realistic. This page is the complete DIY route: the diagnosis flow identifies your case first, and this page walks you to a password you can type again.
 Before you start: what you need
 This route assumes you already know you have a self-custody wallet — if you’re unsure, run the diagnosis flow first. From here, two things decide whether recovery can work: the encrypted wallet file (or the seed phrase without its passphrase) and enough memory clues about the password’s structure. Without the file there is nothing to test; without clues the search space is almost always too large. Each step below explains one piece of that.
 Step 1 · Stop. Copy the files. Then think.
 Before anything else, make read-only copies of every wallet file you can find and write down anything you remember about the password — then start working. Do not reinstall the app, do not “fix” the wallet, and never upload the file to public checkers or unknown websites. The mistakes that end cases are reinstalls, “fixes” and reckless uploads; time alone rarely does — but data-retention countdowns (cloud trash, recently deleted files, backup retention, SSD behavior) are real, so freeze the device and check recoverable windows promptly. → Protect your wallet files · The first 24 hours
 Step 2 · Find the wallet file
 Recovery works on the file, not the app. wallet.dat, a UTC--* keystore, an Electrum file, a MetaMask vault, a MultiBit .wallet — each lives in a known location on Windows, macOS or Linux, and each can be copied safely. If the wallet only ever existed in a phone’s app storage, extraction comes first. Not sure which file is yours? Let the identifier widget match it from its name or extension. → How to find your wallet file · Wallet file on an old phone
 Step 3 · Check whether your case can be cracked
 Some wallets are effectively impossible to brute-force, and pretending otherwise wastes weeks. The equation has four parts: the wallet format, the number of key-derivation rounds, the password’s structure, and the hardware you can throw at it. Read the feasibility page before you run anything. → Is recovery possible? · How wallet encryption works
 Step 4 · Rebuild the password from memory
 Human passwords follow habits: dates, names, substitutions, keyboard layouts. Before you crack anything, search every place the password could already be stored — password managers, browsers, notes apps, old emails, device backups — and reconstruct what your brain actually built. Then turn every fragment into a candidate list. → Where old passwords hide · How your memory made it · The 68-place search checklist · Build a password hint list · Offline token list builder
 Step 5 · How to “crack” a wallet password: pick the right tool
 If you searched for “how to crack a wallet password”, this is the real version: cracking means testing candidate passwords against the wallet’s own verifier, one at a time, on your own machine. There is no magic “wallet password cracker” website — here is why it cannot exist — and the real crackers are free tools: btcrecover reads wallet files directly, hashcat attacks converted hash lines at GPU speed, and John the Ripper covers Monero .keys and keystores. Forgot a brain wallet passphrase? That is the same route: btcrecover tests passphrases directly with --brainwallet or --warpwallet — see the brain wallet recovery guide. Anyone who promises instant success on a random password is not telling the truth. → Choose the right tool
 Step 6 · Run it yourself
 Each tool has a full, verified walkthrough on this site: install, build your candidate list, run, and know when to stop. Start with btcrecover unless you remember the shape of the password (masks) or need maximum GPU speed. → btcrecover step by step · convert a wallet to a hash line · hashcat step by step · John the Ripper step by step · Command cheat sheet
 Step 7 · Judge the speed
 “How long will it take?” is a math question: candidates divided by guesses per second. The password strength calculator turns what you remember into a time estimate, the how-long page explains the math, and the benchmarks show measured speeds on real hardware with dates and methodology. If the estimate is centuries, change the plan — don’t change the numbers.
 Step 8 · When the tool misbehaves
 “No hashes loaded”, token length errors, wrong modes, extraction failures — almost every dead end has a known cause and a fix. Check the troubleshooting index before you reinstall anything. → Troubleshooting — errors & fixes
 Step 9 · When this isn’t a cracking case at all
 Three situations stop the DIY route before it starts: an exchange or custodial account (that’s a reset, not a crack), a wallet you can restore from its seed phrase (the password becomes irrelevant), and a forgotten seed passphrase (a password, not a seed — a separate, harder problem). Check these first; they save you weeks.
 Step 10 · After recovery: never be locked out again
 Once you’re back in, the prevention guide turns a one-time lesson into a permanent fix: seed backups on paper and metal, password managers, restore tests — so the locked-out feeling never happens again. → How to never lose access
 Not sure where you fit?
 The diagnosis flow
 Diagnose your exact case first: exchange, seed, passphrase or password — the verdict decides everything.
 Run the diagnosis →
 Which tool?
 Choose the right tool
 btcrecover, hashcat or John the Ripper — how they differ, and which one fits your clues.
 Compare the tools →
 One-page reference
 The command cheat sheet
 Every wallet format, one command: extract, mode, run — the quick reference table.
 Open the cheat sheet →
 The full picture
 Which wallet passwords can be recovered?
 Every wallet, one verdict: reset, restore, crackable or effectively impossible.
 See the master list →
# The wallet password locked inside a password-protected ZIP, Office file or PDF — recover it.
URL: https://forgotwalletpassword.com/wallet-password-in-encrypted-file

Wallet Password in an Encrypted File? Recover It
 Skip to content
 Password recovery · encrypted files & drives
 Your wallet password is locked behind an encrypted file or drive. Here’s how to get it back.
 People often save the wallet password — or the note that contains it — in a password-protected ZIP, Office document or PDF. Sometimes the wallet file itself sits on an encrypted drive (BitLocker, FileVault, VeraCrypt). Forgot that second password? It is exactly the kind of problem this site covers.
 By Robbert Bink · ~5 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The math
 A password-protected file — ZIP, Office, PDF or an encrypted drive — can usually be attacked offline with the same toolset as wallet files: hashcat plus the *2john extractors. If the password was human-made and you have clues, recovery is realistic; a long random one is not crackable by anyone. Never upload the file — everything runs offline, on a copy.
 When the wallet password lives inside a document
 Three scenarios cover nearly every real case:
 A password list or notes file — the wallet password saved in a .docx, .xlsx or PDF, locked with its own password;
 An encrypted backup archive — the wallet backup zipped (or RAR-ed) together with a text file containing the password;
 A protected PDF — a setup or recovery document with the password, seed or private-key notes inside.
 The where old passwords hide guide maps every one of these trails — including the browsers, notes apps and emails where the document itself may have been saved unprotected.
 First: search, then crack
 Before attacking the document, exhaust the 68-place search checklist — the same password is often also in a password manager, an email or an old device, where recovery is instant. If cracking is the path, follow the standard rules: work on a read-only copy, offline, with tools from official sources only (the protection rules apply to documents too).
 Which protected documents can be cracked offline
 These are the official hashcat modes for the formats that commonly hold wallet passwords — straight from the hashcat example-hashes list:
 FileWhat it usually holdshashcat modeExtraction
 7-Zip (.7z)Encrypted wallet backups116007z2john
 WinZip AESOlder encrypted backups13600zip2john
 PKZIP / ZipCrypto (.zip)Classic .zip encryption17200 / 17210 / 17220 / 17225 / 17230 — depends on the extracted hashzip2john
 RAR3-hpEncrypted archive (header + data)12500rar2john
 RAR3-p compressedEncrypted archive (data only)23800rar2john
 RAR3-p uncompressedEncrypted archive (data only)23700rar2john
 RAR5Encrypted archive13000rar2john
 MS Office (.docx/.xlsx)Notes and password lists9400 / 9500 / 9600 — Office 2007 / 2010 / 2013; older Office: 9700–9820office2john
 PDF (Acrobat 2–11)Printed notes and scans10400 / 10500 / 10600 / 10700, and in some cases 25400 — let pdf2john output and hashcat --help decidepdf2john
 KeePass (.kdb/.kdbx)Dedicated password vault13400 (AES-KDF, KDBX ≤ 3); 34300/34301 (KDBX 4)keepass2john — identify the version and KDF first: KDBX 4 may use Argon2 (34300) or AES-KDF (34301) — see password manager recovery
 The extraction scripts ship with the John the Ripper jumbo build. Same rule as every wallet on this site: the document password decides everything — human-made with clues is realistic, random is not. Check the math before investing time.
 What if the wallet file is on an encrypted drive?
 Sometimes the wallet file itself — not the password note — is the thing behind the second lock: an old laptop with full-disk encryption (BitLocker, FileVault), a VeraCrypt container, or an encrypted backup image. Open the volume and the wallet file inside is just a normal wallet again: the same tools, one extra door.
 The headline
 These are crackable — with the same honest limit as everything else on this site. Volume encryption is memory-hard and far slower per guess than a wallet file: only human-chosen passwords with clues are realistic, and you need the right header or recovery material first. A random or manager-generated password is effectively unreachable.
 FormatTool & modeWhat you needSpeed class
 BitLocker — user-password protector (Windows full-disk)hashcat 22100 · bitlocker2john/bitlocker2hashcat.pyDrive header with a user-password-protected VMKHundreds to low thousands of guesses/sec on a GPU — slower per guess than wallet.dat, only human-made passwords with clues
 BitLocker — TPM / TPM+PIN / startup-keynot the same offline password-cracking route—TPM-protected VMKs cannot be converted to a mode-22100 hash by the current extractor
 BitLocker — 48-digit recovery passwordnot an ordinary mode-22100 password search—Recovery-key brute force is treated as infeasible by the official extractor
 FileVault 2 (older macOS / CoreStorage)hashcat 16700 · fvde2johnRecovery-key dump from the encrypted volumeSlow — hundreds of guesses/sec or fewer; only human-made passwords with clues
 FileVault / APFS (macOS 10.13+ encrypted volume)separate route — hashcat 18300 (APFS) after identifying the exact configurationAPFS volume / keybag materialDifferent key architecture from legacy FileVault 2 — on Apple silicon / T2 Macs the Secure Enclave handles key material, so do not assume the CoreStorage route applies
 VeraCrypt (container or system)current hashcat route: 29411–29483 via veracrypt2hashcat.py; legacy 13711–13783 only if deliberately using the legacy routeContainer header; your PIM value if you set oneMemory-hard — tens to low hundreds of guesses/sec; a PIM makes it slower
 TrueCrypt (legacy container)current hashcat route: 29311–29343 via truecrypt2hashcat.py; legacy 6211–6243Container headerMemory-hard and slow — only worth it with clues
 LUKS (Linux)Hashcat: luks2hashcat.py → 14600/29511–29543 (LUKS1 variants) and 34100 for supported LUKS2/Argon2 configs (check the exact KDF first). John: luks2johnVolume headerLUKS1 crackable with clues (modes 29511–29543 by configuration). LUKS2 with a supported Argon2 configuration is recoverable via mode 34100 (argon2id + SHA-256 + AES) — but not every LUKS2 variant is supported, so identify the exact KDF, hash and cipher parameters before choosing a route
 Apple DMG (encrypted disk image)John the Ripper · dmg2johnThe encrypted imageNo hashcat mode — JtR only; realistic only with a human-chosen password and clues
 BestCrypthashcat 23900 (v3) / 24000 (v4) · JtR bestcrypt2johnVolume/container headerMemory-hard and slow — only worth it with clues
 DiskCryptorhashcat 20011–20013 · JtR diskcryptor2johnVolume/container headerMemory-hard and slow — only worth it with clues
 These formats are not part of this site’s measured benchmark suite — the speed classes above are order-of-magnitude, not measurements. Check the current tool documentation before estimating a run.
 The method, in order
 Search first. The wallet file (or its seed) often exists outside the encrypted volume — work the 68-place checklist before touching the drive.
 Back up the drive or image before anything else. The protection rules apply fully — including the old/dead-computer rule: copy, don’t repair.
 Extract the header or hash on a copy (the *2john / header tools above). Keep the original volume untouched.
 Attack with your candidate list — the hint-list method decides the case; test small before running long.
 Unlocked? The wallet file inside is now a normal wallet — follow its row in the master list.
 Never upload the encrypted volume, its header or recovery material to a public checker or unknown website. These attacks run offline, on copies, with tools from official sources only — exactly like every other recovery on this site.
The walkthrough — five steps
 1
 Protect the file
 Copy the encrypted document to read-only media and work on the copy, offline, on your own machine. Never upload it to a public checker or unknown website — an online “unlock” site is handing your password list to a stranger. The protection rules apply.
 2
 Extract the hash line
 Run the right extractor from the table above (7z2john, zip2john, rar2john, office2john, pdf2john) — it turns the file into a one-line hash without ever exposing its contents. The JtR walkthrough covers the general flow.
 3
 Pick the mode
 From the table above — for example 11600 for 7-Zip or 9400 for Office 2007 files. The hashcat walkthrough explains how modes and masks work.
 4
 Build the attack
 A wordlist from your password hint list with rules, or a mask when you remember the shape:
 hashcat -m 11600 archive.hash words.txt -r rules/best66.rule
 Document passwords follow the same habits as every password you ever made — years, names, patterns. That memory work is what decides the outcome.
 5
 Open the file, then the wallet
 A cracked password unlocks the document on your copy. Inside is the wallet password — and from there the normal wallet path applies: find your wallet in the master list and follow its verdict.
 Never upload your encrypted file to a public checker or unknown website
 The document may contain your wallet password, seed or private keys. Legitimate recovery runs offline on your own machine — never upload the file to a public checker or unknown website.
 Frequently asked questions
 Can a BitLocker or VeraCrypt drive really be cracked?
 Yes, when a wallet file sits inside and the password was human-made with clues. Volume encryption is memory-hard, so every guess is far slower than a wallet file — but with a good candidate list these are the same offline tools, run on a copy. A random or manager-generated password is not realistic.
 Can a password-protected ZIP really be cracked?
 Yes, offline, with the modes above. Speed depends on the file’s encryption (for example AES vs the older ZipCrypto scheme) and on your clues — a human-chosen password with a good candidate list is realistically recoverable; a random one is not.
 What if the document password is long and random?
 The same math as every wallet on this site: a genuinely random password is beyond any hardware, for anyone. The realistic path is to find it stored — work the search checklist before spending time cracking.
 Should I use an online service to unlock the file?
 No. An encrypted document that may hold wallet secrets should never leave your machine. Every format above cracks fine offline with free tools — that is the whole point of this walkthrough.
 Sources & references
 hashcat — example hashes (official mode list)
 John the Ripper (jumbo) — *2john extraction scripts
 Do this first
 The 68-place search checklist
 Before cracking the document, exhaust every place the password could already be stored.
 Work the checklist →
 The tool
 hashcat step by step
 Masks, wordlists and rules — the full walkthrough, with every wallet and document mode.
 Read the hashcat guide →
 The hiding places
 Where old passwords hide
 Managers, notes apps, emails and devices — most “forgotten” passwords are found, not cracked.
 Search the trails →
 The other vault
 Password manager recovery
 If the wallet password sits in KeePass, LastPass or 1Password instead, this is the path.
 Recover the manager →
# Measured wallet password recovery speeds — hardware, method and dates.
URL: https://forgotwalletpassword.com/wallet-password-recovery-benchmarks

Crypto Wallet Password Recovery Benchmarks — Measured Speeds
 Skip to content
 Reference · measured speeds
 Wallet password recovery benchmarks — measured, reproducible, dated.
 Every tabulated benchmark number below comes from a measured run. Values explicitly labelled as estimates are derived from measured figures and documented parameters. This page documents the hardware, the tool, the methodology and the dates behind those numbers — so you can judge them, reproduce them, and know when they stop being current.
 By Robbert Bink · ~5 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The headline
 Speeds are order-of-magnitude facts, not promises. The same wallet checks a different number of guesses per second depending on hardware, tool version, driver and the KDF parameters stored in the file. The figures below are measured on named reference hardware (btcrecover benchmark suite, July 2026) — treat every speed on this site as a rounded version of these runs.
 The hardware and how it was tested
 The numbers come from the official btcrecover benchmark suite (measured 2026-07-04), which publishes system, tool and per-wallet results. The systems that produced the figures used on this site:
 SystemCPUGPUOpenCL deviceOS
 #1RYZEN AI MAX+ 395 (32 threads)—gfx1151, 110 GBWindows 11
 #2Ryzen 9 9950X (32 threads)NVIDIA GeForce RTX 5090RTX 5090, 32 GBWindows 11
 #3i7-10700K (16 threads)NVIDIA GeForce RTX 3070RTX 3070, 8 GBWindows 10
 System #2 is the reference used for the rounded whole numbers on this site (e.g. 472, 11,950, 5,160). Where a row exists for CPU and GPU, both are shown.
 Measured password rates (guesses per second)
 Wallet formatKDF / parameters9950X CPURTX 5090i7-10700K CPU
 Bitcoin Core wallet.dat (BDB)iterated SHA-512, 67,908 rounds472 /s11,950 /s83 /s
 Bitcoin Core wallet.dat (SQLite)iterated SHA-512, 267,488 rounds122 /s3,210 /s23 /s
 BIP38 paper keyscrypt N=16,384 r=8 p=872 /s43 /s15 /s
 BIP39 passphrasePBKDF2-HMAC-SHA512, 2,048 iterations; candidate verified by deriving target addresses15,250 /s19,950 /s2,400 /s
 Blockchain.com v0 exportPBKDF2-SHA1, 10 iterations627,580 /s—62,350 /s
 Blockchain.com v2 exportPBKDF2-SHA1, 10,000 iterations2,770 /s9,470 /s431 /s
 Blockchain.com v3 exportPBKDF2-SHA1, 5,000 iterations5,450 /s20,030 /s698 /s
 Coinomi vaultscrypt N=16,384 r=8 p=1503 /s——
 Electrum 2.8+ passphrasePBKDF2-HMAC-SHA512, 1,024 iterations; candidate verified by deriving keys (ECIES/BIE1)29,670 /s4,300 /s4,670 /s
 Ethereum keystore (scrypt)scrypt N=2¹⁸ r=8 p=1 (geth standard)96 /s—16 /s
 MetaMask vault — legacy 10kPBKDF2-SHA256, 10,000 iterations5,160 /s5,590 /s690 /s
 MultiBit Classic .key3 × MD51,810,000 /s529,400 /s181,250 /s
 MultiBit HDscrypt N=16,384 r=8 p=1510 /s—135 /s
 Rounded from the published runs (9950X: 472.17 / 122.12 / 72.01 / 15.25K / 627.58K / 2.77K / 5.45K / 503.42 / 29.67K / 95.72 / 5.16K / 1.81M / 509.59; RTX 5090: 11.95K / 3.21K / 42.88 / 19.95K / 9.47K / 20.03K / 4.30K / 5.59K / 529.40K). GPU cells marked “—” are memory-hard formats where OpenCL was not run or barely helps. The Ethereum row is the suite’s reference test (N=2¹⁷ as published); the geth/Web3 standard is N=2¹⁸ = 262,144, which tests roughly 2× slower per guess on the same hardware.
 The MetaMask row is the legacy 10,000-iteration vault. Newer vaults store their own KDF parameters in the vault data — read the actual count (600,000 and 900,000 are both documented) — which is estimated at up to roughly 90× slower per guess, an extrapolation from the iteration ratio, not a separate 900k benchmark run. The same tools and commands apply, with a much longer wait.
 The BIP39 passphrase row has both a CPU and a GPU/OpenCL measurement in the official benchmark set (RTX 5090 ≈ 19,950 guesses/sec); use whichever matches your hardware.
 Two rows look odd until you know the cause: the MultiBit Classic .key and Electrum 2.8+ passphrase rows show GPU rates below the CPU rate. That is not a typo — the OpenCL path for those two formats in btcrecover is slower than the optimized CPU path, so the CPU column is the faster choice for them.
 Why ranges beat single numbers
 Real-world speeds vary with the tool version, the GPU driver, background load and — most of all — the KDF parameters inside your specific file. A wallet.dat encrypted on a 2013 laptop can test 4× faster than one encrypted on a 2024 desktop, because the iteration count is stored in the file, not fixed by the format. That is why this site says “hundreds” or “low thousands” in prose and points here for the measured figures, rather than pretending one number is your number.
 Use the strength calculator to combine a speed class with your own search space, and the cracking-time guide for what the result means in hours, years or centuries.
 How to reproduce or extend these numbers
 1Run the suite yourselfThe btcrecover project publishes the exact test commands with the benchmark page; the same repository also documents GPU acceleration setup and version pinning.
 2Record the full contextHardware model, tool version, driver, wallet file or test vector, KDF parameters, date. A number without that context is not a benchmark.
 3Report ranges, not recordsOne fast run on a cold machine is a fluke. When benchmarking your own hardware, repeat the test several times to estimate normal variance rather than treating the fastest single run as definitive.
 Freshness policy
 These figures are reviewed quarterly and re-measured when a major tool or GPU generation changes the picture. Every speed table on this site links back to this page, so a reader can always see how old the number is and on what hardware it was produced.
 Last reviewed: 14 August 2026 · Next scheduled review: November 2026.
 Sources & references
 BTCRecover — official performance benchmarks (measured 2026-07-04)
 BTCRecover — GPU acceleration documentation
 Cite this page
 APA: Bink, R. (2026). Wallet password recovery benchmarks — measured, reproducible, dated. ForgotWalletPassword.com. https://forgotwalletpassword.com/wallet-password-recovery-benchmarks
 Markdown: [Wallet password recovery benchmarks — measured, reproducible, dated.](https://forgotwalletpassword.com/wallet-password-recovery-benchmarks)
 Apply it
 The strength calculator
 Combine your search space with these speed classes to get your own odds — with real ranges.
 Run the calculator →
 The math
 How long to crack a password?
 What the rates mean in real time — from minutes to longer than the universe.
 See the times →
 Every wallet
 The master list
 Which wallet uses which KDF, mode and speed — one searchable table.
 Open the master list →
 The verdict
 Is recovery possible?
 Technically possible, practically feasible, or effectively impossible — the ladder.
 Read the feasibility →
# Every wallet format, one command — the recovery cheat sheet.
URL: https://forgotwalletpassword.com/wallet-password-recovery-cheat-sheet

Crypto Wallet Password Recovery — Command Cheat Sheet
 Skip to content
 Quick reference · btcrecover · hashcat · John the Ripper
 Wallet password recovery — the command cheat sheet.
 Every wallet format, the command that runs it — one page. Copy, adapt, run. The full reasoning, install steps and honest limits live in the walkthroughs linked from each row.
 By Robbert Bink · ~6 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The headline
 Every command below only works as well as your candidate list. Copy the right command, but build the list first — the hint-list guide is the method, this page is the syntax. Always run on a copy of your file, offline, with tools from official sources only.
 How to use this page
 Three steps: (1) identify your file — the identifier or the master list; (2) find your wallet in the table below and copy the command for the tool you chose; (3) if the command errors, the troubleshooting index has the fix. The btcrecover, hashcat and John the Ripper walkthroughs contain the full steps behind every row.
 The three tools at a glance
 ToolThe basic commandStart here
 btcrecoverpython btcrecover.py --wallet <file> --tokenlist tokens.txtFull walkthrough
 hashcathashcat -m <mode> <hashfile> words.txt -r rules/best66.rule (renamed from best64.rule in recent versions — older installs use best64.rule)Full walkthrough
 John the Ripperjohn --wordlist=words.txt --rules=All <hashfile>Full walkthrough
 Extraction scripts: extract-*.py lives in btcrecover’s extract-scripts/ folder (for btcrecover’s own --data-extract path), *2hashcat.py in hashcat’s tools/ folder, and *2john.py in John’s run/ folder — the *2john lines are what the hashcat columns need. Full recipes: convert a wallet to a hashcat hash.
 Wallet → the command that runs it
 Wallet / filebtcrecoverhashcatJohn the Ripper
 wallet.dat — Bitcoin Core, Litecoin, Dogecoin, BCH, Dash
 python btcrecover.py --wallet wallet.dat --tokenlist tokens.txt
 bitcoin2john.py wallet.dat > wallet.hashhashcat -m 11300 wallet.hash words.txt -r rules/best66.rule
 bitcoin2john.py wallet.dat > wallet.hashjohn --wordlist=words.txt --rules=All wallet.hash
 Electrum — 1.x–4.x wallet file
 python btcrecover.py --wallet <file> --tokenlist tokens.txt2FA/TrustedCoin wallets: special case — not covered by the standard btcrecover route; identify the wallet type first
 electrum2john.py <file> > e.hashmode follows the $electrum$N prefix: 1/2/3 → 16600 · 4 → 21700 · 5 → 21800
 electrum2john.py <file> > e.hash
 Ethereum keystore — UTC--*.json
 python btcrecover.py --wallet UTC--*.json --tokenlist tokens.txt
 ethereum2john.py UTC--*.json > eth.hash (remove any filename: prefix), then hashcat -m 15600 eth.hash words.txt (PBKDF2) · -m 15700 (scrypt)
 ethereum2john.py UTC--*.json > eth.hash
 Ethereum pre-sale — 2014 JSON
 —
 ethereum2john.py on the pre-sale JSON → hashcat -m 16300 presale.hash words.txt
 —
 BIP38 — 6P… paper key
 python btcrecover.py --bip38-enc-privkey 6P… --tokenlist tokens.txt
 No hashcat mode
 —
 Blockchain.com — wallet.aes.json
 python btcrecover.py --wallet wallet.aes.json --tokenlist tokens.txt
 blockchain2john.py <file> > bc.hash-m 12700 (legacy My Wallet) · -m 15200 (v2/v3) · -m 18800 (2nd password) · very early V0: -m 34700 (identify first)
 blockchain2john.py <file> > bc.hash
 MetaMask — vault data (legacy 10k or newer dynamic-iteration vault)
 Reads the vault folder directly; extract-metamask-vaults.py produces a clean vault file
 metamask2hashcat.py --vault vault.json > mm.hash — the extractor reads the KDF parameters from the vault-m 26600 (legacy) · -m 26610 (newer dynamic-iteration) · -m 31900 (mobile) — 26620 only in newer/development hashcat builds; use the modes your installed version supports
 —
 MultiBit Classic / HD — .key · .wallet · .wallet.aes
 Classic .key: direct / data-extract (fastest). Classic .wallet: btcrecover direct (slower) — or hashcat 27700 / John via multibit2john. HD mbhd.wallet.aes: extract/direct; hashcat 22700 also applies
 multibit2john.py <file> > mb.hash-m 22500 (.key) · -m 27700 (.wallet) · -m 22700 (HD)
 multibit2john.py <file> > mb.hash
 Coinomi — scrypt vault
 Reads the vault directly
 —
 coinomi2john.py <vault> > co.hash
 Exodus — seed.seco
 —
 exodus2hashcat.py seed.seco > ex.hashhashcat -m 28200 ex.hash words.txt -r rules/best66.rule
 —
 BIP39 passphrase — the 25th/13th word
 python btcrecover.py --bip39 --mnemonic "your 12/24 words here" --addrs <known-address> --addr-limit 10 --tokenlist tokens.txtYou also need the mnemonic and a known address/xpub target; for Ethereum/altcoins add the appropriate --wallet-typeSLIP39 passphrases: separate --slip39 mode — different KDF, needs a share quorum
 —
 —
 Monero — .keys file
 —
 No hashcat mode
 monero2john.py wallet.keys > monero.hashjohn --wordlist=words.txt --rules=All monero.hash
 “—” means that tool has no supported path for this format — use the listed tool instead. Rows verified against the official btcrecover, hashcat and John the Ripper documentation (9 August 2026). Several 2john extractors prefix the hash with filename: — remove that prefix before running hashcat; the conversion guide covers it.
 Specialist formats — one tool each
 FormatCommand
 Brainwallet (SHA-256 / scrypt)btcrecover reads it directly — see the walkthrough for the address setup · dedicated guide
 Terra Stationneeds extraction first — assemble the salt + IV + ciphertext hash from the wallet data, then hashcat -m 29600 terra.hash words.txt -r rules/best66.rule · extraction guide
 Bisq — .walletbisq2hashcat.py bisq.wallet > bisq.hash → hashcat -m 29800 bisq.hash words.txt
 Stargazer (Stellar/XLM)needs extraction first — build the $stellar$... record (salt/IV/ciphertext) from the wallet data, then hashcat -m 25500 stellar.hash words.txt -r rules/best66.rule · extraction guide
 Keplr (Cosmos)keplr2john.py <vault-folder> > keplr.hash → john --wordlist=words.txt --rules=All keplr.hash — legacy extension format only; identify v2/current vaults before assuming compatibility
 Cardano — legacy secret.keycardano2john.py secret.key > ada.hash → john --wordlist=words.txt --rules=All ada.hash
 BitSharesbitshares2john.py <db> > bs.hash → john --wordlist=words.txt --rules=All bs.hash
 Tezos ICO / fundraiser credentialstezos2john.py <seed words> <fundraiser email> <tz1 address> > xtz.hash → john --wordlist=words.txt --rules=All xtz.hash — the ICO/fundraiser password route, not a generic Tezos client key file
 btcrecover wallet formats — three situations, three commands
 There is no single command that fits every wallet below. Split the list into three cases: files btcrecover reads straight into --wallet, formats that need a special btcrecover flag, and formats that need extraction or preparation first.
 Direct --wallet formats
 Same command — python btcrecover.py --wallet <file> --tokenlist tokens.txt — no extraction, no mode number:
 Wallet / fileNote
 mSIGNA (CoinVault) wallet databaseReads the keychain directly
 Hive for OS Xbitcoinj-family encrypted wallet — wallet-password route via btcrecover
 Litecoin / Dogecoin Wallet for Androidbitcoinj encrypted backup
 Toast WalletWallet passphrase
 imToken keystoreModified Ethereum keystore — also hashcat 15600/15700
 Electron-Cash · MultiDogeElectrum-family (BCH) / MultiBit-style .key backup
 Special BTCRecover flags required
 These formats need an extra btcrecover flag — the generic command above tests the wrong target:
 Wallet / fileNote
 Bitcoin Wallet (Android/BlackBerry) · KnC WalletSpending PIN or encrypted backup. For the spending PIN add --android-pin — without it btcrecover tests the backup password instead: python btcrecover.py --wallet <backup-file> --android-pin --tokenlist pins.txt
 Yoroi (Cardano)Not a direct --wallet input — extract the encrypted master-password value from the wallet data first, then use BTCRecover’s --yoroi-master-password workflow
 Hive Android / iOS / Web is a different case again: not the same wallet-file/password route — btcrecover documents these under seed recovery instead.
 Extraction / preparation required
 Not a direct --wallet input — prepare the recovery target first:
 Wallet / fileNote
 Dogechain.infoSeparate workflow — wallet.aes.json / Dogechain recovery (extract-dogechain-privkey.py)
 BitherBither SQLite wallet database (format-3; fields such as addresses.encrypt_private_key / password_seed) — not every exported/encrypted backup is the direct target
 block.ioAccount “Secret PIN” — PBKDF2-HMAC-SHA256; check the stored iteration count first (legacy ~2,048 vs newer 100,000+) before estimating speed
 btc.com (Blocktrail)Prepare the recovery-sheet wallet data first (passwordEncryptedSecretMnemonic) — the raw PDF is not the --wallet input
 Password managers & encrypted documents
 When the wallet password sits behind a second lock, the same tools open it. All modes from the official hashcat example-hashes list:
 Filehashcat modeExtraction
 KeePass 1 (.kdb) / KeePass 2 (.kdbx)13400 (AES-KDF, KDBX ≤ 3); 34300/34301 (KDBX 4)keepass2john — identify the version and KDF first: KDBX 4 may use Argon2 (34300) or AES-KDF (34301)
 LastPass vault (local cache)6800local XML/SQLite vault cache via lastpass2hashcat.py — not the CSV account export
 Bitwarden — PBKDF2-configured vaults23400bitwarden2john
 Bitwarden — Argon2id-configured vaultsno generic 23400 route — identify the KDF firstworkflow that supports the Argon2id configuration (not the standard 23400 extractor)
 1Password6600 / 8200keychain files
 Password Safe (.psafe3)5200pwsafe2john
 7-Zip (.7z)116007z2john
 WinZip AES (.zip)13600 — PKZIP/ZipCrypto uses 17200/17210/17220/17225/17230 instead; let the extracted hash decidezip2john
 RAR3 / RAR512500 (RAR3-hp) · 23700 (RAR3-p uncompressed) · 23800 (RAR3-p compressed) · 13000 (RAR5) — let rar2john's output deciderar2john
 MS Office (2007+)9400 / 9500 / 9600 (+ 9700–9820 old)office2john
 PDF10400–10700, and in some cases 25400 — let pdf2john decidepdf2john
 The full walkthroughs: password manager recovery and wallet password in an encrypted file.
 Encrypted drives & volumes
 When the wallet file itself sits on an encrypted drive or in a container — the full method is on the encrypted-file guide:
 FormatTool / modeExtraction
 BitLockerhashcat 22100bitlocker2john
 FileVault 2 (CoreStorage)hashcat 16700fvde2john
 APFS-encrypted volume (macOS 10.13+)hashcat 18300APFS keybag/volume material
 TrueCrypthashcat 6211–6243 (legacy) / 29311–29343 (current)truecrypt2john (legacy) / truecrypt2hashcat.py (current)
 VeraCrypthashcat 13711–13783 (legacy VeraCrypt) / 29411–29483 (current)veracrypt2john (legacy) / veracrypt2hashcat.py (current)
 LUKShashcat 14600 (legacy LUKS v1) / 29511–29543 (LUKS1 by config) / 34100 (LUKS2 Argon2, supported configs)luks2john (legacy) / luks2hashcat.py (LUKS2)
 Apple DMGJohn the Ripperdmg2john
 Flags that save your run
 btcrecover — test candidates first, then let it save progress and resume:
 python btcrecover.py --listpass --tokenlist tokens.txt
 python btcrecover.py --wallet wallet.dat --tokenlist tokens.txt --autosave progress.sav --typos 1 --typos-case --typos-swap --typos-repeat
 Resume after a crash (this flag must be the only option): --restore progress.sav. Already have full candidate passwords? Use --passwordlist candidates.txt instead of a token list.
 hashcat — wordlist + rules, or a mask when you know the shape:
 hashcat -m 11300 wallet.hash words.txt -r rules/best66.rule
 hashcat -m 11300 -a 3 wallet.hash '?u?l?l?l?l?l?d?d'
 hashcat -m 11300 -a 6 wallet.hash words.txt '?d?d'
 hashcat -m 11300 -a 7 wallet.hash '?u?l' words.txt
 Hybrids (-a 6 word + mask ending, -a 7 mask + word) cover mixed clues in one run. Preview what your wordlist + rules generate before spending GPU time: hashcat --stdout -a 0 words.txt -r rules/best66.rule | head.
 John the Ripper — wordlist + rules, mask, or incremental; cracked passwords land in the potfile:
 john --wordlist=words.txt --rules=All monero.hash
 john --mask='?u?l?l?l?l?l?d?d' monero.hash
 Re-read a cracked hash anytime: john --show monero.hash.
 Before you run anything: copy the wallet file, work offline, download only from official sources, and never upload the file to a public checker or unknown website or paste vault data into any website. The candidate list decides the case — build it on purpose.
 Sources & references
 3rdIteration/btcrecover — source & extract-scripts/
 hashcat — example hashes (modes) & tools/
 openwall/john — jumbo build & *2john scripts
 Cite this page
 APA: Bink, R. (2026). Wallet password recovery — the command cheat sheet. ForgotWalletPassword.com. https://forgotwalletpassword.com/wallet-password-recovery-cheat-sheet
 Markdown: [Wallet password recovery — the command cheat sheet.](https://forgotwalletpassword.com/wallet-password-recovery-cheat-sheet)
 The real key
 Build a password hint list
 Commands are syntax — the candidate list decides the case. Build it from your memory, on purpose.
 Build your list →
 Which tool fits?
 Choose the right tool
 btcrecover, hashcat or John — the comparison and when each one wins.
 Pick your tool →
 The bigger picture
 Which wallet passwords can be recovered?
 The full master list — verdict, encryption and tool for every major wallet.
 See the master list →
# Wallet password recovery troubleshooting — errors and fixes.
URL: https://forgotwalletpassword.com/wallet-password-recovery-troubleshooting

Wallet Password Recovery Troubleshooting — Errors & Fixes
 Skip to content
 Troubleshooting · errors & fixes
 Wallet password recovery troubleshooting — the errors that stop people, solved.
 Most failed recovery attempts are not hard cases — they are five familiar mistakes: the wrong file, the wrong version, the wrong hash line, the wrong mode, or the wrong expectations. Work through the symptom below and you will usually find the fix in minutes.
 By Robbert Bink · ~6 min read · Published 9 August 2026 · Last reviewed: 14 August 2026
 The headline
 Before you blame the tool, check the five usual suspects: (1) the wrong file or one that isn’t encrypted, (2) the wallet version needs a different extractor or mode, (3) the hash line was extracted wrong, (4) the candidate list is empty or malformed, (5) the speed is normal for a memory-hard format. Each entry names the symptom, cause and fix.
 btcrecover: the wallet won’t load
 SymptomLikely causeFix
 “Wallet file ... could not be loaded” / “no wallet type matches”The file is a different wallet than expected, unencrypted, or a version the tool doesn’t read.Identify the file first (which wallet file is it?), confirm it is actually encrypted, and check the master list for the right tool. Some legacy versions need an extract script instead of a direct read.
 Wallet.dat loads but finds no encrypted keysThe wallet was never encrypted, or you pointed at a copy that was migrated.Open a duplicate copy once in an isolated matching client version, but do not infer encryption from whether it opens — an encrypted wallet can load while locked, with the passphrase only needed for private-key operations (wallet.dat FAQ). Check the wallet’s lock/encryption state instead, and keep the original untouched and backed up.
 Very low speed / no GPU accelerationThe format is memory-hard (scrypt, BIP38, Armory) or GPU support isn’t set up.Check the benchmarks page for the expected speed class — “slow” is often normal.
 Run crashed / lost progressNo autosave.Restart with --autosave progress.sav and resume with --restore progress.sav — alone on the command line (btcrecover walkthrough).
 hashcat: no hashes loaded or token length exception
 SymptomLikely causeFix
 “No hashes loaded”The hash file is empty, has trailing junk, or the mode doesn’t match the line format.Check the line starts with the right prefix ($bitcoin$, $electrum$, $ethereum$, $multibit$, $metamask$) and pick the matching mode from the hashcat guide.
 “Token length exception”The hash line does not match the token structure expected by the selected mode — usually a wrong hash mode, a malformed hash, or input that does not fit the expected hash layout (truncation, extra fields, prefixes or separators).Check the hash mode, re-extract the hash with the correct script, and inspect the line for truncation, extra fields, prefixes or separators. This is not a signal to filter passwords out of your wordlist.
 Wrong mode accepted but nothing cracksThe hash is a different sub-format (e.g. Electrum salt type 4 vs 5).Use the salt type inside the hash to pick 16600 vs 21700/21800 (Electrum) — details in the Electrum guide.
 GPU shows 0 H/s or isn’t usedDriver/OpenCL issue, or the format does not support this GPU/parameter set.Update the GPU driver, verify with hashcat -I, and check whether the exact mode supports your GPU and whether sufficient device memory is available — memory-hard formats can be memory-limited and may perform better on CPU for some parameter sets, but they are not inherently CPU-only.
 Extraction: the hash line looks wrong
 Empty output from bitcoin2john / electrum2john — the file is unencrypted, a different format, or the script needs the right argument order. Re-check the file type first.
 The hash has a filename prefix or trailing text — extractors often prepend the filename (wallet.dat:$bitcoin$…) or add a label after a space. hashcat needs only the $bitcoin$… part: strip everything before the first colon and anything after the first whitespace.
 Electrum 2.8+ wallet “too small to parse” — the wallet is unencrypted or an unsupported version. For a fully encrypted wallet file, identify the BIE1/BIE2 encrypted storage format or let the current extractor detect it — do not expect the raw file to contain readable wallet JSON such as use_encryption; verification happens after decryption.
 MetaMask extraction fails — use the official metamask2hashcat.py from the hashcat tools folder and point it at the vault data, not the profile folder.
 The full extraction flow is in the John the Ripper walkthrough (which covers the *2john scripts) and the hashcat walkthrough.
 Wallet-level: opens but looks empty, or “corrupted”
 Wallet opens but the balance is missing — you restored the right wallet with the wrong seed/backup, or the file predates your funds. Not a password problem: check what you actually lost.
 “Wallet file is corrupted” — this is different from a forgotten password. A wrong password gives a wrong-password error; a damaged file gives a parse error. See the wallet.dat guide (corrupted vs forgotten section).
 Old backup won’t open in the modern client — version migration. Use the matching client version (on a copy, never the original) or the identifier to pin the era.
 Still stuck?
 Run the diagnosis from the top and check the master list for your exact wallet — every row links to the guide that covers its quirks. If the file is genuinely damaged or the version is unsupported by every public tool, that is a different problem from a forgotten password, and this site says so plainly rather than promising otherwise.
 Sources & references
 BTCRecover — documentation
 hashcat — example hashes and mode reference
 John the Ripper (jumbo) — extraction scripts
 The tool
 btcrecover step by step
 Install, token list, run, result — the full walkthrough this index references.
 Read the walkthrough →
 The tool
 hashcat step by step
 Modes, masks and rules — the reference for every mode mentioned above.
 Read the walkthrough →
 Every wallet
 The master list
 Find your wallet, its format, its tool and its verdict in one table.
 Open the master list →
 First step
 Which wallet file do you have?
 Half of every error above is a misidentified file — start here.
 Identify the file →
# The six-question decision tree when you forgot your wallet password.
URL: https://forgotwalletpassword.com/what-to-do

Forgot Your Wallet Password? What to Do First
 Skip to content
 Guide 01
 Forgot your wallet password? Start with the flow.
 Every “forgot my wallet password” case ends in one of four verdicts: reset, restore from seed, crackable offline, or effectively impossible. Read the flow below — or run the interactive diagnosis on the homepage and get the same verdict in about a minute.
 By Robbert Bink · ~5 min read · Published 9 August 2026 · Last reviewed: 16 August 2026
 The headline
 Most “forgot my wallet password” stories end in one of four verdicts: reset, restore from seed, crackable offline, or effectively impossible. This page explains the flow step by step; each step tells you which branch is yours and links to the guide that takes it from there.
 Run the interactive diagnosis Prefer the full DIY route?
 Step 1 · Is it an exchange or custodial account?
 If yes — this is a reset, not a recovery case. Coinbase, Binance, Kraken and similar platforms hold the keys; you prove identity and set a new password. Nothing on this site applies. → Exchange & custodial wallets
 If no — you hold the keys yourself (a wallet file, an app on your device, a hardware wallet). Continue below.
 Step 2 · Do you still have the seed phrase?
 If yes — the password stops mattering. Most seed-derived wallets restore their normal seed-derived accounts from the recovery phrase. Imported private keys, JSON accounts, hardware-wallet accounts, or accounts from another phrase may need separate recovery material. → Password vs seed phrase · The 25th word
 If the phrase itself is lost — that is a find-the-copy problem, not a cracking problem. Search paper, notes apps, email, photos, password managers and old backups. → The 68-place search checklist · Where old passwords hide
 If you have the phrase but added an extra passphrase (the “25th/13th word”) you don’t remember — that IS a password problem and often solvable. → Seed phrase passphrase
 Step 3 · Is it a wallet file or app password?
 Then the encrypted wallet file is your test target. First find it — most files are found in backups, old devices, cloud storage or old emails, not lost forever. → Find your wallet file · what still works without it
 Not sure it is even encrypted? An encrypted wallet can load and show public data while locked; the password is required for sending, signing or dumping keys. Check the wallet’s lock state, and identify the exact file. → Identify your wallet file · Dead device, corrupted file or missing seed? Those aren’t password problems either — the seven cases where cracking can’t help.
 Find your wallet in the master list — it shows the verdict, the encryption, the tool and the mode in one row.
 Step 4 · What do you remember about the password?
 Fragments, patterns, a shape (“a name + a year + a symbol”) — the strongest position; build a candidate list and the math usually follows.
 Nothing, and it was human-made — harder, but memory reconstruction (how your memory made it) plus the 68-place search checklist still wins real cases.
 It was randomly generated by a password manager — read the feasibility guide before spending a second on cracking; this is usually effectively impossible, so hunt for a stored copy.
 Step 5 · Is the math on your side?
 Speed × search space = time. Check your specific odds with the strength calculator, see the measured speeds, and read the ladder: possible, feasible, sensible, or impossible.
 Step 6 · Forgot a hardware-wallet PIN instead?
 A PIN is device-specific: after a number of wrong attempts the device wipes itself, and you restore from the seed phrase. The phrase is the real backup — the PIN alone is never enough. → Password vs seed phrase vs PIN · Back up your seed phrase
 Before you try anything
 Copy the wallet file read-only, write down every clue, and touch nothing until you have read the five protection moves. Recoverable cases are lost to specific mistakes — reinstalls, wipes, uploads — not by the original loss.
 Sources & references
 BTCRecover — documentation
 hashcat — example hashes
 Two minutes
 The quick diagnosis
 Answer a few questions on the homepage and get an instant first verdict.
 Run the diagnosis →
 In order
 The first 24 hours
 What to do in order — the calm sequence that works whether you start today or next week.
 Follow the plan →
 Your wallet
 The master list
 Every wallet, one table: verdict, encryption, tool, mode.
 Open the master list →
 First move
 Protect your wallet files
 Ten minutes that decide whether your case stays recoverable.
 Secure the evidence →
# Is wallet password recovery possible? The honest equation.
URL: https://forgotwalletpassword.com/when-recovery-is-possible

Can a Crypto Wallet Password Be Recovered? The Math
 Skip to content
 Guide 08
 Is wallet password recovery possible? The equation.
 Recovery is arithmetic: how many passwords can your wallet type check per second, divided by how many passwords you still need to try. Here is exactly how that plays out per wallet format.
 By Robbert Bink · ~7 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 Short answer
 Usually yes — when the password was human-chosen and you have hints, recovery can take days to weeks. A genuinely random 16-character password is generally infeasible to brute-force — no service, GPU farm or “hacker” changes that. No wallet file left? The real exceptions — seed phrase, custodial resets, brain wallets — are covered on recovery without the wallet file.
 How wallet encryption actually works
 Wallet files don’t store your password. They store an encrypted key, and your password is run through a key-derivation function (KDF) that turns it into the decryption key. The KDF is deliberately slow — it is the wallet’s whole defence against guessing. The number of times it runs per attempt is the iteration count:
 Low iterations = fast to test = easier recovery. Older wallets are faster to attack.
 High iterations / scrypt = slow to test = harder recovery. Modern wallets are slow by design.
 “Hashes per second” is the real speed. Modern GPUs try millions of guesses per second against simple hash types — but only tens to tens of thousands per second against deliberately slow wallet KDFs.
 The wallet formats, side by side
 For a one-glance answer on every major wallet — reset, crackable offline, or impossible — start with the master list of recoverable wallet passwords, then come back here for the speed numbers. When the verdict is feasible, the complete DIY route is how to recover a wallet password yourself.
 Wallet type
 Encryption / KDF
 hashcat mode
 Speed class (modern GPU)*
 Bitcoin Core wallet.dat (old)
 iterated SHA-512, ~25k+ rounds (machine-tuned; reference 68k)
 11300
 Thousands of guesses/sec (up to ~12k on a modern GPU)
 Bitcoin Core wallet.dat (modern)
 iterated SHA-512, machine-tuned rounds (reference ~68k–267k)
 11300
 Hundreds to low thousands of guesses/sec
 Electrum v1–4.x
 Encrypted keystore — PBKDF2 (2.8+), double SHA-256 (older)
 16600 / 21700 / 21800
 Low thousands of guesses/sec
 Ethereum keystore (scrypt)
 scrypt (default N=262144, r=8, p=1)
 15700
 Around a hundred guesses/sec
 Ethereum keystore (PBKDF2)
 PBKDF2-HMAC-SHA256; iteration count stored in crypto.kdfparams.c
 15600
 Often low-thousands/sec, but estimate from the actual c value
 BIP38 encrypted key
 scrypt (N=16384, r=8, p=8)
 —
 Tens of guesses/sec
 Brain wallet — SHA-256 (bitaddress.org)
 SHA-256(passphrase) → key, no KDF
 —
 Millions of guesses/sec on GPU (dedicated tools — no hashcat mode)
 Brain wallet — scrypt (WarpWallet/Memwallet)
 scrypt + optional email salt
 —
 Tens of guesses/sec
 *Speed classes are order-of-magnitude estimates on a high-end consumer GPU (e.g. RTX 4090 class). Exact rates vary with hardware, driver, and hashcat/btcrecover versions. What matters for your case is the category — thousands vs hundreds vs tens of thousands.
 What “impossible” actually means
 Brute force scales with entropy — the number of possible passwords. Roughly:
 8 characters, human-chosen (word + number + symbol): often recoverable in hours-to-days if you have hints.
 10 characters, human pattern: days-to-weeks with good clues and the right masks.
 12 characters, mixed random: centuries on consumer hardware — effectively impossible in practice.
 16+ characters, random (password manager): beyond any realistic hardware — no tool changes this.
 Lost seed phrase (12–24 words): a seed cannot be reconstructed from nothing — find a copy via the search checklist. If the seed is intact but a passphrase (25th/13th word) was used, that IS recoverable and this site covers it.
 Anyone who “guarantees” recovery of a random password is overpromising
 The maths is public and it does not care about marketing. A promise to crack an unknown 16-character random password should be treated with caution — the real answer is that no tool or service can change the search space.
 The four levels: possible vs feasible vs sensible vs impossible
 “Can it be recovered?” is not one question — it is four, and they are often confused:
 Technically possibleThere exists a way to test passwords offline. Almost every encrypted wallet file qualifies — the question is never “is it possible”, it’s “how long”.
 Practically feasibleWith your clues and hardware, the search completes in a sane timeframe (minutes to weeks). This is where hint lists and masks win.
 Economically sensibleThe compute cost (electricity, rented GPUs) is worth less than the wallet. A $5,000 GPU-week for a $200 wallet is technically feasible but not sensible.
 Effectively impossibleRandom high-entropy passwords (roughly 80+ bits, e.g. 14+ random characters from a full character set): search spaces beyond any realistic hardware. No tool, GPU farm or service changes this.
 The distinction matters because most “is it recoverable?” questions collapse two different things: can a tool test this password? and will my password be found in a useful lifetime? The calculator answers the second with your numbers, and the measured speeds page shows the rates behind it — hardware, method and dates included.
 The three factors that decide your case
 1 · What you remember
 Fragments, patterns, lengths, reused words. Every clue shrinks the search space from astronomical to manageable. This is the biggest lever you control — rebuild it with the memory method.
 2 · The wallet format
 Low-round wallet.dat? Thousands of guesses per second on a GPU. A modern Ethereum keystore with scrypt? Around a hundred. Format decides the speed; speed decides the odds.
 3 · Randomness
 Human-chosen passwords are guessable by design. Random passwords are not. No amount of hardware changes that — the line is the line.
 What tools like btcrecover and hashcat do
 Open-source tools such as btcrecover and hashcat automate the guessing: they read your wallet file, generate candidate passwords from masks and token files, and test them at the wallet’s KDF speed. They are free, offline, and well documented. But they are tools, not magic:
 Masks — structural templates like ?u?l?l?l?l?l?d?d?d (capital + 5 letters + 3 digits).
 Token files — your candidate list from the memory guide, plus year/number/symbol mutations.
 Passphrase attack — your known words in every order, with every separator.
 Success almost always comes from clues narrowing the space — never from raw brute force. That is why the diagnosis on the homepage starts with what you remember.
 Running tools safely
 Only ever run recovery tools on a read-only copy of your wallet file, on a machine you trust, offline. Never upload the file to a public checker or unknown website, and never hand it to anyone without a contract — protect your wallet files first. And if the password isn’t actually the problem — a dead device, a corrupted file or a missing seed — check the seven cases where cracking can’t help before you start.
 Format-specific deep dives
 Your wallet type changes everything. Jump to the specialist page for yours:
 Frequently asked questions
 Is any wallet password technically uncrackable?
 Yes: genuinely random passwords with roughly 80+ bits of entropy — for example 14+ characters from a full character set — are generally infeasible for any realistic hardware, including well-funded attackers. No tool or service changes that; anyone promising otherwise is lying.
 What single factor most improves my odds?
 What you remember about how the password was constructed. A clue that narrows the search space by a factor of a million is worth more than any GPU — which is why memory reconstruction comes before hardware.
 How long should I keep trying before concluding it is impossible?
 Run the numbers first: identify the format, estimate the space, check the measured crack speeds. The math is the verdict — if it says months of GPU time even with your clues, trust it, and decide with facts instead of hope.
 Sources & references
 hashcat — example hashes (wallet formats & modes)
 Specialist
 wallet.dat
 Iterated SHA-512, AES-256-CBC, ~25k–267k rounds. The most-studied wallet file in recovery.
 wallet.dat guide →
 Specialist
 Electrum wallet file
 Encrypted keystores with a slow KDF; the seed phrase remains the better backup.
 Electrum guide →
 Specialist
 Ethereum keystore JSON
 UTC--* files using scrypt or PBKDF2 — among the slowest to test per second.
 Keystore recovery →
 Specialist
 BIP38 paper wallets
 Encrypted private keys from paper wallets, scrypt-based, prefix “6P”.
 BIP38 guide →
 So what should you actually do?
 1
 Confirm the formatIdentify the exact wallet file and version. That alone tells you — within minutes — whether your case is feasible: the format fixes the encryption and the speed.
 2
 Build the clue setEverything you remember, in writing — the memory guide shows how to generate candidates.
 3
 Back up the file read-onlyNever work on the original. Do this before anything else.
 4
 Run the tools yourselfTest your candidate list offline, free, on your own machine — follow the btcrecover walkthrough or the hashcat walkthrough.
# Before you try to crack anything — find it.
URL: https://forgotwalletpassword.com/where-are-old-passwords

Where Old Passwords Hide: Find Your Forgotten Password
 Skip to content
 Guide 05
 Before you try to crack anything — find it.
 Most “forgotten” wallet passwords were saved somewhere by a slightly more organised version of you. A systematic sweep of the usual hiding places takes an hour, and in many real cases it is faster and safer than starting with cracking tools.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 14 August 2026
 The headline
 Most “forgotten” wallet passwords were saved somewhere by a more organised version of you. A systematic sweep — password manager, notes, browser, email, old backups — resolves more cases in an hour than any cracking tool, and it costs nothing. Do this before you touch any tool.
 People rarely keep a wallet password in their head alone. It lives in a manager, a note, a browser, an email, or an old backup. Work through these trails in order — stop the moment you find it.
 Want the complete sweep?
 This page is the fast 30-minute version. The ultimate search checklist covers all 68 places — including old devices, physical hiding spots, people and deleted files — with interactive checkboxes that save your progress.
 The seven hiding places
 1 · Password managers
 Check every manager you have ever used — 1Password, Bitwarden, KeePass, Dashlane, LastPass, iCloud Keychain. Look beyond the vault search: check recently deleted items and old exports. Many people generated a wallet password years ago and stored it without noticing. Forgot the manager’s own master password? Recover the manager and the wallet password comes with it.
 2 · Browser saved passwords
 Open the built-in password manager of Chrome, Firefox, Safari or Edge (Settings → Passwords) and filter for wallet names, exchange domains, or “crypto”. Check old browsers on old computers — profiles you haven’t touched in years. Export the list and scan it calmly.
 3 · Notes apps and documents
 Search Apple Notes, Google Keep, Notion, Evernote and your file system for password, wallet, seed, backup, crypto, and the wallet app’s name. People love files called passwords.txt or a spreadsheet row with one “important” note. Found the right document but it is password-protected? Those files crack offline too — see wallet password in an encrypted file.
 4 · Old emails and messages
 Search your full email archive — including old and abandoned accounts — for the same keywords plus recovery, export, private key. People email themselves wallet files, key dumps, and setup instructions. Check Telegram, WhatsApp and Signal archives too.
 5 · Old devices and backups
 iCloud, Google Drive, Dropbox, OneDrive, Time Machine, external hard drives, USB sticks, the drawer laptop. Wallet files have extensions like .dat, .json, .aes — search the whole disk. Old phones can hold wallet apps that never got wiped.
 6 · The setup paperwork
 Hardware wallets ship with a card or booklet for the seed phrase — people often write both the seed and a password hint on it. Check safes, drawers, and the box the device came in. If you bought it second-hand, check your purchase email for the model and version.
 7 · Photos and screenshots
 Search your photo library for screenshots of setup screens, password notes, or wallet documents. Security warning: if you find a photo of your seed phrase, treat it as compromised: first copy it carefully to a secure offline backup, or move the funds to a new wallet, verify access, and only then delete the photo from the device, cloud library and backups where possible. It is a risk, not just a clue.
 The 30-minute sweep
 Run it exactly once, methodically, before you consider anything else:
 1
 Inventory everythingList every device, account, backup and drawer that could possibly hold a password or a wallet file. Write the list down.
 2
 Search with keywordsRun the same keyword set everywhere: wallet, seed, crypto, password, backup, recovery, plus the app name and your own name.
 3
 Check old accountsOld email addresses, old phones, old browsers, old laptops. The password predates your current setup, so search the past, not the present.
 4
 Ask one trusted personA partner or family member may remember a note, a drawer, or a moment when you “wrote it down somewhere”. Choose whom you trust carefully.
 5
 Record every hitWhatever you find — even a half-remembered string or a hint — write it down immediately in one password journal. It becomes your clue set.
 If nothing turns up
 Don’t panic — this is normal. The search wasn’t wasted: it ruled out the easy fix and built your clue set for the next step, rebuilding the password from memory. When your clues are ready, the complete route — from file to password — is the DIY recovery guide. And whatever you do, keep your wallet files safe: that guide comes first.
 Related guides
 Next guide · 03
 How your memory made it
 Nothing found? Rebuild the password from habits, patterns and keyboard layouts.
 Rebuild the pattern →
 Previous guide · 01
 What did you lose?
 Password, seed phrase, PIN or passphrase — make sure you are hunting for the right thing.
 Start here →
 Guide · 05
 Protect your wallet files
 The five moves that keep your case recoverable while you search.
 Secure the evidence →
 The bigger picture
 Which wallet passwords can be recovered?
 Found it? Now find the verdict — every wallet in one searchable table.
 See the master list →
# Your file extension tells us more than your memory does.
URL: https://forgotwalletpassword.com/which-wallet-file

Which Wallet File Do You Have? Identify Your Wallet Type
 Skip to content
 Resource · identification
 Your file extension tells us more than your memory does.
 The wallet type decides the encryption, the testing speed, and therefore your recovery odds. Find the file — or the app name — and you instantly know which specialist guide applies to you.
 By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
 Short answer
 Find the wallet file and read its extension: wallet.dat is Bitcoin Core — Core-derived forks (Litecoin, Dogecoin, Bitcoin Cash, Dash) share compatible legacy wallet encryption, though the database backend behind the file can differ (legacy BDB vs modern SQLite descriptor wallets) — a UTC--*.json file is an Ethereum keystore, a string starting with 6P is a BIP38 key, and an Electrum file lives in the app’s data folder. That one detail sends you to the right recovery guide — and the right feasibility expectation.
 What do you see? Pick the closest match:
 Choose what you found…
 A file named wallet.dat
 A file ending in .aes.json (e.g. wallet.aes.json)
 A JSON file starting with UTC— (UTC--2021-…-….json)
 A file named default_wallet (no extension)
 A paper-wallet string starting with 6P
 A .wallet file from MultiBit
 A .key file from a MultiBit backup
 An mbhd.wallet.aes file (MultiBit HD)
 Coinomi vault data backed up from my phone
 A .keys file from a Monero wallet
 A seed.seco file from Exodus Desktop
 MetaMask vault data (browser extension or mobile)
 An encrypted drive or container (BitLocker, FileVault, VeraCrypt, LUKS)
 Wallet app data from a phone backup
 An Armory wallet file (armory.wallet)
 I only remember the app I used
 Wallet—
 Encryption—
 Crack difficulty—
 —
 Detect by file content (offline)
 Not sure from the name? Drop the file below — the check runs entirely in your browser, nothing is uploaded. It reads the file’s structure and suggests the most likely wallet format, with the guide to follow.
 Drop your wallet file here
 or click to choose — stays on your machine
 Identify by file type
 What you found
 Wallet
 Your guide
 wallet.dat
 Bitcoin Core / Bitcoin-Qt / classic desktop client — Core-derived forks (Litecoin, Dogecoin, Bitcoin Cash, Dash) share compatible legacy encryption; the backend inside wallet.dat can be legacy BDB or modern SQLite descriptor wallets
 wallet.dat guide · fork wallets
 UTC--2020-06-01T….json or 0x….json
 Ethereum keystore — geth, MyCrypto, MyEtherWallet, many EVM apps
 Ethereum keystore guide
 File in the Electrum data folder (no fixed extension, JSON-like content)
 Electrum (1.x–4.x)
 Electrum wallet guide
 A long paper-wallet key starting with 6P
 BIP38-encrypted private key
 BIP38 paper wallet guide
 No file — just a 12- or 24-word phrase
 Seed-based wallet (MetaMask, Trust Wallet, Exodus, Coinbase Wallet, Phantom, Atomic — nearly every mobile wallet)
 Seed phrase passphrase
 .keys file (plus a cache file without extension)
 Monero — the official CLI/GUI wallets
 Monero uses a custom KDF that btcrecover and hashcat don’t read directly — but the seed (25-word legacy, 16-word Polyseed, 13-word MyMonero) restores the wallet without the password, and if the seed is gone, the John the Ripper walkthrough is the specialist path for .keys files. See password vs seed and is recovery possible?
 armory.wallet (or a .wallet backup file)
 Armory — the old Python Bitcoin client
 Legacy software with a memory-hard custom KDF (ROMix-SHA-512) and no hashcat mode. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py) — a compatible extraction step is still required; older Armory-specific workflows also existed. Your paper backup (Armory's own Root Key / chain-code format — not a BIP39 12-word phrase) is the practical path. See how wallet encryption works
 seed.seco in the Exodus Desktop data folder
 Exodus Desktop — password-encrypted local wallet (scrypt)
 Exodus guide (hashcat mode 28200)
 Encrypted JSON from Terra Station
 Terra Station wallet — PBKDF2-SHA1 + AES-256-CBC
 Master list — Terra Station row (hashcat mode 29600)
 A 2014 presale wallet JSON (before the mainnet)
 Ethereum pre-sale wallet
 Master list — pre-sale row (hashcat mode 16300)
 LevelDB storage folder of the Keplr extension
 Keplr (Cosmos) — password-encrypted vault
 Master list — Keplr row (legacy format: keplr2john; current Keplr v2 formats: do not assume compatibility — identify the vault format first)
 secret.key from a 2017–2019 Daedalus install
 Cardano — legacy Daedalus key file
 Master list — Cardano row (John the Ripper, cardano2john)
 BitShares light-client wallet database
 BitShares 2 light client / wallet.bitshares.org
 Master list — BitShares row (John the Ripper, bitshares2john)
 Tezos ICO / fundraiser credentials — 15-word mnemonic, fundraiser email and tz1 address
 Tezos ICO / fundraiser wallet
 Master list — Tezos row (John the Ripper, tezos2john — the ICO/fundraiser route, not a generic Tezos client key extractor)
 Something else (.sqlite, app-specific)
 Depends on the app — check its documentation
 Ask the FAQ, or find it in the master list.
 Where wallet files live
 If you have not found the file yet, these are the default locations — always search copies and old devices too:
 Bitcoin Core · Litecoin · Dogecoin · BCH · DashEach coin has its own data directory with the same wallet.dat format. Check both legacy and current Windows locations — Bitcoin: %APPDATA%\Bitcoin\ and %LOCALAPPDATA%\Bitcoin\ (the current default), with wallets in <datadir>\wallets\ or, on older/single-wallet setups, directly in the data directory. Litecoin: ~/.litecoin/, Dogecoin: ~/.dogecoin/, and so on — the data directory may differ by version or a custom datadir.
 ElectrumElectrum data folder — ~/.electrum/ or %APPDATA%\Electrum\ — with files like default_wallet.
 Ethereum / gethUTC--*.json in the keystore folder — ~/.ethereum/keystore/ or %APPDATA%\Ethereum\keystore\.
 Paper walletsNot a file at all — the 6P… string is printed on the paper itself. If you only have a photo, the key is still recoverable from the photo. Preserve the original securely until the 6P… string has been independently verified — and ideally successfully decrypted. If the photo is cloud-synced, remove the synced copy only after creating a verified offline backup. Never destroy the only accurate copy before verification.
 Can’t find the file? Run the 30-minute sweep for backups, and read protect your wallet files before you touch anything.
 Identify by app name
 Bitcoin Core / Bitcoin-Qt → wallet.dat
 Litecoin Core, Dogecoin Core, Bitcoin Cash (BCH), Dash → the same wallet.dat format — fork wallets guide
 Electrum → Electrum keystore
 geth, MyCrypto, MyEtherWallet, Mist → Ethereum keystore
 MetaMask, Trust Wallet, Exodus, Coinbase Wallet, Phantom, Atomic → seed-phrase based, not a password-file — but identify the exact wallet model first, because several apps now mix models. MetaMask wallets created with Google, Apple or Telegram login use a different recovery model; Trust Wallet SWIFT wallets use a passkey tied to your Apple/Google environment instead of a 12-word phrase; Coinbase Smart Wallet / Base wallet is passkey-based (a recovery phrase exists only if you set one) — and note that the classic Coinbase Wallet is being retired in favor of the Base App: the recovery phrase and addresses remain, but some classic-wallet networks are not supported in the Base App, so for those assets follow Coinbase’s current official guidance and use a wallet that supports the network; Phantom wallets created with Google or Apple recover via that account plus your PIN, with the phrase only exportable while you still have access. Accounts imported from a private key or JSON are not restored by the phrase. See the seed phrase passphrase and what did you lose?
 A paper wallet printed with a 6P key → BIP38
 What about a wallet that isn’t listed?
 There are hundreds of wallet apps, but only three security models — and yours fits one of them:
 Seed-based (the password is a lock, not the key)Trust Wallet, Exodus, Coinbase Wallet, Phantom, Atomic, MetaMask — most phone wallets, but identify the wallet model first. Traditional wallets restore from a 12- or 24-word phrase and the forgotten password becomes irrelevant. Newer variants do not follow that rule: MetaMask wallets created with Google, Apple or Telegram login, Trust Wallet SWIFT wallets (passkey tied to your Apple/Google environment), Coinbase Smart Wallet / Base wallet (passkey-based; a phrase exists only if you set one) and Phantom wallets created with Google or Apple (recovery via that account plus PIN) all have different recovery paths. Accounts imported from a private key or JSON are never restored by the phrase. How this works
 File-based (the password encrypts a file)wallet.dat, Electrum, Ethereum keystores, Blockchain.com exports, MultiBit, Coinomi, Monero .keys, Armory — the file holds your keys, and the password unlocks it. Recovery is a technical problem with a real answer: sometimes yes, often no.
 Custodial (someone else holds the keys)Coinbase, Binance, Kraken and other exchanges. You don’t recover anything — you reset the account password and let the platform unlock your balance.
 Why the exact format matters
 Low-round wallet.dat files test hundreds of guesses per second on a CPU (thousands with a GPU); Ethereum scrypt keystores test around a hundred. “It’s a Bitcoin wallet” is not enough — the rounds count also matters (machine-tuned when the wallet was encrypted; reference wallets range ~68k–267k, floor 25k). The speed table is in is recovery technically possible?
 Still unsure?
 Write down the file name, the extension and the app you remember — that is already most of the answer. Run the diagnosis for a first verdict, check the FAQ and the glossary for follow-ups, and for a one-glance verdict across every wallet — reset, crackable offline, or impossible — see the master list of recoverable wallet passwords.
 The arithmetic
 Is recovery technically possible?
 Every format’s speed class — and the line between possible and impossible.
 Read the feasibility →
 Definitions
 Glossary of wallet terms
 wallet.dat, keystore, scrypt, PBKDF2, entropy, hashcat — plain English, with links.
 Open the glossary →
 Before that
 The first 24 hours
 Secure the file and capture the clues before you do anything else.
 Follow the plan →
# Should You Pay a Wallet Recovery Service?
URL: https://forgotwalletpassword.com/should-i-pay-wallet-recovery-service

Should You Pay a Wallet Recovery Service? The Red Flags
 Skip to content
 Scam awareness · expectations
 Should you pay a wallet recovery service?
 Usually not — and this page shows you exactly when that changes. The same free tools run the same math on your machine, so before you pay anyone, learn the red flags and the honest odds.
 By Robbert Bink · ~7 min read · Published 13 August 2026 · Last reviewed: 16 August 2026
 The headline
 You almost never need to pay anyone. The same open-source tools are free, and they run the exact same math on your own machine. A recovery service cannot beat that math — the only things they can add are time, skill and GPU capacity. Before you pay anyone, you need the feasibility rules and the red flags that separate scammers from the very small number of legitimate professionals.
 Run the math first — it takes two minutes and decides whether any service could help you at all.
 The truth: the math doesn’t change
 Every candidate password is tested against the wallet’s key-derivation function — the same KDF, the same speed limit, whether you run it or someone else does. A service does not get a faster version of btcrecover, hashcat or John the Ripper. What they can sell you is their time, their skill and their setup — not a better algorithm, and certainly not a “backdoor” into wallet encryption.
 That leads to two real outcomes:
 Your case is feasible (file + clues, human-made password): the tools are free, and this site walks you through them step by step. Paying adds money, not success.
 Your case is not feasible (random password, no file, no clues): no service changes that. Anyone who says otherwise is lying to you.
 Check your odds with the strength calculator and the feasibility guide before you even consider paying.
 When paying could make sense (rare)
 There is a small, real exception. A verified professional — a named person or registered business with verifiable history — can save you the setup time, the learning curve, and sometimes provide GPU capacity you don’t own. That is legitimate. But the material you share with them changes everything. There are three levels:
 Level 1 — seed phrase / private keys: never share, with anyone, under any contract. No password-recovery scenario requires them. If a service asks for your seed “to check” or “to restore”, you are handing over the wallet itself — that alone ends the conversation.
 Level 2 — the full encrypted wallet file: sensitive, only under a written process. The file contains your encrypted keys; whoever decrypts it controls the wallet. A legitimate engagement works offline on a copy on your own machine — never upload the file to a public checker or unknown website. Only under a clear written agreement with a verified professional may the encrypted file itself be processed in a controlled workflow; the standard remote route is level 3 (the extract), not the file.
 Level 3 — a password-verification extract (hash line): the only material that should leave you. Tools like btcrecover’s extract-scripts produce a small line with the KDF parameters and a verification value. It is not normally a plaintext private key, but it can contain sensitive encrypted wallet material — treat it as sensitive recovery data and send it only to a recipient you trust. This is the legitimate technical route when you rent someone’s GPU power.
 The rules stay the same at every level: they tell you the honest odds before payment from your actual file and the real math; you pay for time, skill or GPU capacity, never for a guarantee that doesn’t exist; and anything they need from you beyond the extract line is a reason to slow down.
 One more distinction: if a service offers to “restore” from your seed because the file is gone, that is wallet restoration, not password recovery — you can do it yourself in the official wallet app, and nobody needs your seed to do it for you.
 The red flags — stop at any of these
 If a “recovery service” does any of the following, stop the conversation. This is the checklist that decides the case:
 Asks you to upload the wallet file or vault to a public checker or unknown website — or asks for your seed phrase under any contract. (An extracted hash line is a different matter — see the material levels above.)
 Promises recovery, a “guarantee” or a “hack” without assessing your actual case and the math.
 Wants payment upfront before explaining feasibility.
 Has no real identity: no name, no address, no business registration, no verifiable history.
 Reaches out to you first — via DM, email or a “we found your case” message. Legitimate services don’t hunt for desperate clients.
 Uses urgency or fear: “act now”, “before it’s too late”. There is no countdown in wallet recovery.
 Claims a backdoor into wallet encryption or a way around the KDF. That does not exist.
 Demands remote access to your computer.
 Asks for your seed phrase “to check” or “to restore” — even under a contract. A password-recovery service never needs it; sharing it hands over the wallet.
 Shows fake reviews or no verifiable references at all.
 Charges by the hour with no cap, so the bill can grow forever.
 Refuses to name the tools they would run and why.
 What a legitimate service actually looks like
 A named person or registered business you can verify independently.
 A written agreement that states scope, price and what happens if nothing is found.
 A feasibility statement before payment, based on your actual case.
 Work that runs offline on a copy of your file, or remotely on an extracted hash line — never public uploads of your file, never control of your machine, never your seed.
 They can name the exact material they need — normally an extracted hash line; under a written agreement the encrypted wallet file itself may also be the material — never your seed.
 References you can check, tied to real, verifiable cases.
 They treat your wallet file as sensitively as the seed — because it is.
 The before-you-pay checklist
 Work through these ten flags before you pay anyone. If any of them applies, stop — that is the answer. The same ten flags are in the printable offline recovery toolkit.
 0 of 10 flags checked — 0%
 They asked you to upload your wallet file or vault to a public checker or unknown website, or asked for your seed phrase
 Legitimate work runs offline on a copy of your file — or remotely on an extracted hash line. Anyone who wants your file without a clear written agreement — or who asks for your seed at all — is out.
 They promised recovery, a “guarantee” or a “hack” before assessing your case
 A real professional asks for the right material (your file for offline work, an extract for remote compute) and runs the math first. A guarantee is a sales line.
 They want payment upfront before explaining feasibility
 If they cannot tell you the odds before you pay, they are selling hope, not recovery.
 No verifiable identity — no name, address or business registration
 A named, registered, checkable business is the minimum bar for anyone holding your case.
 They contacted you first — DM, email or “we found your case”
 Legitimate services do not hunt for desperate clients. Cold outreach is a classic scam pattern.
 They use urgency or fear (“act now”, “before it’s too late”)
 There is no countdown in wallet recovery. Pressure is a scam signal, not a deadline.
 They claim a backdoor or a way around the encryption
 Wallet encryption has no backdoor. Anyone who says otherwise is lying to you.
 They demand remote access to your computer
 Real recovery runs on a copy of your file — or on an extract for remote GPU work. Demanding control of your machine means they want your machine, not your math.
 They asked for your seed phrase “to check”
 The seed phrase must never leave you — with anyone, ever. This alone ends the conversation.
 No verifiable references, or they refuse to name the tools
 Checkable references and the actual tools (btcrecover, hashcat, John) are the basics.
What to do instead — the free route
 Before you pay anyone, work this site in order: the diagnosis flow, then the 68-place search for the file, then rebuild the password from memory, then the right tool. Everything is free, runs offline, and every guide shows its sources. If the math says it’s feasible, you can do this yourself; if it says it isn’t, no payment changes that.
 Already paid someone? What to do now
 Stop all contact — no more deposits, “fees” or “refundable insurance”.
 Keep every message and payment record — it is your evidence.
 Contact your bank or card provider and the payment service or exchange used, and report the charge.
 Report to your local fraud authority (for example the FTC in the US, Report Fraud in the UK, or your national cybercrime/fraud reporting point).
 If you shared wallet files or phrases, treat the wallet as compromised — move funds to a new wallet if you still can.
 This is not legal advice and does not guarantee recovery of money — but it is the factual sequence that gives you the best chance.
 Frequently asked questions
 Can a wallet recovery service recover my password faster?
 No — the math is the same. Every candidate must be tested against the wallet’s key-derivation function, and that speed is a hardware property, not a service property. What a service can add is time, skill and GPU capacity — legitimately rented with an extracted hash line, never the wallet file or seed — not a faster algorithm. If a case is feasible, the free walkthroughs run the same tools.
 Is it safe to upload my wallet file to a recovery service?
 Never upload your wallet file, vault or seed phrase to a public checker or unknown website — the file contains your encrypted keys and the seed is the wallet itself. A legitimate recovery runs offline on a copy of your file on your own machine; for remote GPU work, the standard material is a password-verification extract (hash line), which can contain sensitive encrypted wallet material — treat it as sensitive recovery data. Under a clear written agreement, a trusted service may also work with the encrypted wallet file itself — but never your seed phrase or private keys. If an unknown site asks for your file or your seed “to check it”, stop — see why online services can’t work.
 How do I know if a recovery service is legitimate?
 A named person or registered business with verifiable history, a written agreement, a clear statement of the honest odds before payment, and a clear description of the exact material they need — normally an extracted hash line; under a written agreement they may also work with the encrypted wallet file itself, never your seed phrase or private keys.
 What should I do if I already paid a scam recovery service?
 Stop all contact, keep every message and payment record, contact your bank or card provider and the payment service or exchange used, report the case to your local fraud-reporting authority, and if you shared wallet files or phrases, treat the wallet as compromised and move funds if you still can.
 Sources & references
 US FTC — fraud reporting and consumer advice
 UK Report Fraud — report a fraud
 Europol — cybercrime reporting guidance
 This site’s feasibility framework (the math)
 Why
 Why online “crackers” are risky
 The technical reason no legitimate service can test your password remotely.
 Read the explanation →
 The math
 Is recovery technically possible?
 Feasible, sensible, or impossible — the line, wallet by wallet.
 Check the feasibility →
 Before anything
 Protect your wallet files
 Five moves that decide whether your case stays recoverable — before you touch anything.
 Secure the evidence →
 The route
 Recover a wallet password yourself
 The full DIY path, free and offline, step by step.
 Start the walkthrough →
# When It’s Not a Password Problem
URL: https://forgotwalletpassword.com/when-it-is-not-a-password-problem

When It’s Not a Password Problem — 7 Cases to Check First
 Skip to content
 Scope · know the real problem first
 When it’s not a password problem
 Not every locked wallet is a password problem. Dead devices, corrupted files, missing seeds and exchange lockouts need a different first step — and knowing which one you face saves you from wasting weeks.
 By Robbert Bink · ~6 min read · Published 13 August 2026 · Last reviewed: 13 August 2026
 The headline
 Password/passphrase testing usually needs an encrypted wallet file, but the test target is not always one: BIP38 encrypted private keys, brain wallets and supported seed-passphrase recovery cases are tested without a wallet file. If the file, the device or the seed is gone and no such exception applies, no tool — free or paid — changes that. This page shows the cases that look like password problems but aren’t, and what actually helps instead.
 Not sure which problem you have? The diagnosis flow routes you in two minutes.
 The layer rule: file, password, seed
 Every self-custody wallet has three layers, and cracking addresses exactly one of them:
 The seed (or passphrase) restores the wallet anywhere — the password stops mattering. Password vs seed phrase
 The encrypted file is what you crack — but only if it exists and is intact. Which file do you have?
 The password is the only layer a tool can test, and only against that file. The feasibility rules
 If the missing layer is the seed or the file, you don’t have a password problem yet — you have a different problem with a different first step.
 Seven cases that aren’t password problems
 1. Dead computer or lost phone
 The file hasn’t vanished — it’s on old hardware. Extraction comes first: get the wallet file off an old phone, or find it on the right OS. A physically damaged drive is data recovery, which this site deliberately does not cover — but the search for a second copy comes before any repair shop.
 2. Corrupted or half-overwritten file
 That’s an integrity problem, not a password problem. Cracking tests candidate passwords against a valid file; it cannot repair a damaged one. If a backup copy exists — even an old one — that’s your file. The 68-place search is where backups usually hide.
 3. Deleted file, no backup
 Search and undelete first, before any cracking. Only a copy can be tested, so the question is whether one still exists: the search checklist and file locations come before any tool.
 4. Broken or lost hardware wallet
 The PIN is temporary — but failed-PIN behavior is model-specific: devices may wipe, lock or permanently brick after their configured attempt limit. The seed restores the wallet where the model allows. What the seed is · backups & prevention
 5. Locked exchange or custodial account
 That’s an identity problem, not a recovery case: KYC reset — prove identity, set a new password. No cracking tool applies. Exchange & custodial wallets
 6. No seed, no file, no usable memory
 Without a file there is nothing to test the password against, and without the seed there is no restore path. This is the one case where the verdict is: effectively unrecoverable. The feasibility guide · what still works without the file
 7. The wrong wallet or app
 You may be attacking the wrong file entirely — a fork, a different app, or a backup instead of the live wallet. Identify the file by name and extension before anything else.
 Three questions that decide it
 Do you have the encrypted file? No → the search, extraction or backup problem comes first (cases 1–3, 7).
 Is the password the only missing piece? No → one of the seven cases above (cases 4–6).
 Do you have the seed? Yes → restore the wallet; the password stops mattering.
 Yes, yes, no → now — and only now — it is a password problem: check the feasibility, then run the DIY route.
 The rule
 Password/passphrase testing usually needs an encrypted wallet file, but there are exceptions where the test target is not a wallet file: BIP38 encrypted private keys, brain wallets, and supported seed-passphrase recovery cases. Where a file-based case applies, the password must be human-made enough that clues can rebuild it. Everything else is a different problem — and knowing that difference is what separates a realistic plan from weeks of wasted effort. The math is the same for free tools, paid tools and paid people.
 Frequently asked questions
 My computer died — is my password still the problem?
 Usually not yet. First get the wallet file off the old device — the old-phone guide covers phones, and the file-location guide covers every OS. Cracking only starts once the encrypted file is on a machine you can run tools on.
 My wallet file is corrupted — can cracking fix it?
 No. Cracking tests candidate passwords against a valid encrypted file; a damaged file is an integrity problem, not a password problem. Find an intact copy first — the 68-place search checklist is where backups usually hide.
 I have no seed and no file — what are my odds?
 Effectively zero for the password route, because there is nothing to test the password against. The feasibility guide and the without-a-file page explain exactly which exceptions still exist.
 Is a locked exchange account a password problem?
 No — it is an identity problem. Custodial accounts are recovered through KYC: prove identity, reset the password. Exchange & custodial wallets explains the route. No cracking tool applies.
 Sources & references
 This site’s feasibility framework (the math)
 The master list — which wallets are crackable at all
 Password vs seed phrase — the two different problems
 First
 Password vs seed phrase
 The two different problems — and why most “forgot my password” cases are actually a seed question.
 Read the difference →
 The math
 Is recovery technically possible?
 Feasible, sensible, or impossible — the line, wallet by wallet.
 Check the feasibility →
 The file
 Find your wallet file
 Exact paths per wallet and OS — before you touch any tool.
 Find the file →
 Old hardware
 Get the wallet file off an old phone
 Extraction comes before the crack — ADB, iTunes, browser vaults.
 Extract first →
# How Scammers Find You
URL: https://forgotwalletpassword.com/how-scammers-find-you

How Scammers Find You — and How to Block Them
 Skip to content
 Scam awareness · safety first
 How scammers find you
 Scammers don’t need your data — they create the crisis. Learn the channels they use to reach people with forgotten wallets, and the simple rule that blocks most of them.
 By Robbert Bink · ~6 min read · Published 13 August 2026 · Last reviewed: 13 August 2026
 The headline
 Scammers don’t find you — they place themselves where you’re already looking. Paid ads on recovery searches, fake “support”, DMs after you post a question, and fake tool downloads are the four main channels. One rule blocks almost all of them: never share your wallet file, your seed phrase or remote access with anyone who contacted you first.
 Before you click anything, run the red-flag checklist and read why online “crackers” can’t work.
 They advertise where you search
 Search “wallet password recovery” or “btcrecover” and the paid results are often scam pages: recovery “services”, lookalike domains one letter off the official name, or fake tool download sites. Scammers dominate these keywords precisely because desperate people click them.
 Check the exact domain — typosquats (one letter changed, a different TLD, a hyphen) are the tell.
 Only use official sources — the tool guide links the real btcrecover, hashcat and John repositories, and nothing else.
 Treat every paid ad as hostile until you have verified the business independently.
 They pose as support
 Post a question about a wallet and the DMs arrive: “we’re from the official wallet team”, “we need to verify your account”, “send your recovery phrase to confirm”. Real wallet teams never DM you first, never ask for your seed, and never ask you to “verify” by sending files or phrases.
 Official support is on official channels only — the app itself, the official docs, verified accounts.
 A DM from “support” is a scam until proven otherwise — and it never needs your seed to prove anything.
 Never install a “support tool” they send you — that’s how malware lands on your machine.
 They hunt in comments and forums
 Recovery threads attract “I know a guy” posts, fake success stories and shills who redirect you to a paid service. The pattern is always the same: they promise what the math doesn’t allow, then ask for the file or the fee. The red-flag guide shows exactly what that looks like.
 They build fake tools
 “Wallet password hacker” downloads, fake mirrors of btcrecover or hashcat, and “online unlocker” sites that ask you to upload your file. The first bundle malware; the last one collects your wallet file. The real tools are free, open source, and run offline — see which tool to use and why online “crackers” can’t work.
 The pattern behind all of it
 Every one of these channels runs the same four-step play:
 Urgency — “act now”, “your wallet is at risk”.
 Secrecy — “don’t tell anyone”, “don’t use other services”.
 Payment — an upfront fee, a “deposit”, or an “insurance”.
 Access — your file, your seed, or remote access to your machine.
 If a conversation hits any two of those four, it is a scam until proven otherwise.
 The simple rule that blocks most of it
 Official sources only — repositories, docs and the app itself, nothing found in ads or DMs.
 Never share the seed phrase — for any reason. Never share the file or the hash with someone who contacted you first; a written, trusted recovery process is the only exception.
 Never allow remote access — real recovery runs on your copy, offline.
 If they contacted you first, it’s a scam until proven otherwise. Legitimate services don’t hunt for desperate clients.
 Frequently asked questions
 How do scammers find me if I haven’t posted anything?
 They don’t need your posts. Paid search ads, typosquat domains and fake tools reach people who search for recovery terms; fake “support” hunts in public threads and social channels. The crisis itself makes you findable.
 Are Google or Bing ads for wallet recovery services legitimate?
 Treat every paid recovery ad as hostile until proven otherwise. Scammers dominate these keywords precisely because desperate people click them. Check the real domain, check the business, and never upload anything.
 Is it safe to download btcrecover or hashcat from a random site?
 No. Fake mirrors bundle malware. Download only from the official repositories and documentation — the tool guides on this site link exactly those, and nothing else.
 Why do scammers want my wallet file if they can’t crack it?
 Your file is valuable even without a cracked password: it can be sold, used in future attacks, or combined with other leaked data. It can also be uploaded and stored without your knowledge. Never share it.
 Sources & references
 This site’s red-flag guide for recovery services
 Why online wallet “crackers” can’t work
 The official, offline tools — and where to get them
 Before you pay
 Should you pay a recovery service?
 The red flags, the math, and the 10-point before-you-pay checklist.
 Read the red flags →
 Why
 Why online “crackers” are risky
 The technical reason no legitimate service can test your password remotely.
 Read the explanation →
 The tools
 Choose the right tool
 btcrecover, hashcat or John — from official sources, running offline.
 Pick the tool →
 Scope
 When it’s not a password problem
 Dead devices, corrupted files, missing seeds — the cases where cracking can’t help.
 Check the cases →
# Reported Recovery Services
URL: https://forgotwalletpassword.com/reported-recovery-services

Reported Wallet Recovery Services — an Evidence-Based List
 Skip to content
 Community · evidence first
 Reported wallet recovery services
 A curated list of recovery services with documented complaints — reviewed for evidence before publication. Search it, report to it, and read the caveats before you draw conclusions.
 By Robbert Bink · ~5 min read · Published 13 August 2026 · Last reviewed: 13 August 2026
 The headline
 This list only contains entries with verifiable evidence. “Reported” means someone has filed a documented complaint against this name or domain — it is not a legal verdict, a conviction, or proof. The list starts empty, fills slowly, and every entry carries its evidence, its date and a takedown path.
 Always run the red-flag checklist yourself — a name not on this list is not proof of legitimacy.
 How this list works
 Evidence first. Every entry needs verifiable links: documented complaints, dated screenshots, official reports, or court/public records. No evidence, no entry.
 Manual review. A human checks each submission before publication. This is not an open database — it is a curated list.
 Status is always “reported”. We never call an entry a scammer, a fraudster or guilty. The word “reported” is the ceiling of what a complaint proves.
 Removal works. If an entry is wrong, resolved or outdated, contact us with evidence and we review it on the same standard.
 The list
 Search by name or domain. Entries are added only after evidence review — an empty list is a starting point.
 Name / domainReported forEvidenceStatusAdded
 No entries yet. This list only publishes documented, evidence-checked cases. When the first one is reviewed, it appears here with its evidence and date — never sooner.
 How to report a service
 Have a documented complaint against a recovery service? Send it to us via the contact page or the feedback link on any page. Include:
 The name and exact domain of the service.
 What happened — dates, amounts, what was promised.
 Evidence links — complaints, reports, dated screenshots, or official records.
 What you paid and how (card, crypto, bank transfer).
 What happens next: a human reviews the evidence. Only documented cases are published; submissions without evidence are not listed, and we never publish your personal details.
 Corrections & takedown
 Think an entry is wrong, resolved or out of date? Contact us with evidence and we will review it on the same standard as the original entry — corrected or removed as the facts require. This page is educational information, not legal advice, and the status “reported” never claims more than a documented complaint exists.
 Frequently asked questions
 Why is the list empty?
 The list only publishes entries with verifiable evidence, and every submission is manually reviewed before anything appears. An empty list is a starting point — it fills only with documented, checked cases, never with unverified names.
 Can anyone be listed?
 No. A company is only listed if there is verifiable evidence of a documented complaint — links to reports, dated screenshots, or official complaints. Submissions without evidence are not published.
 How do I get a company removed from the list?
 Contact us with evidence that the entry is wrong, resolved or out of date. Every removal request is reviewed on the same evidence standard as additions.
 Is “reported” the same as “guilty”?
 No. “Reported” means a documented complaint exists against this name or domain. It is not a legal verdict, a conviction, or a substitute for checking the red flags yourself — the red-flag checklist is the real test.
 Sources & references
 This site’s red-flag guide for recovery services
 How scammers find you — the channels they use
 Why online wallet “crackers” can’t work
 Before you pay
 Should you pay a recovery service?
 The red flags, the math, and the 10-point before-you-pay checklist.
 Read the red flags →
 The channels
 How scammers find you
 Search ads, fake support, forums and fake tools — and the rule that blocks them.
 Read the channels →
 Report
 Contact — report a service
 Send a documented complaint with evidence; a human reviews it before anything is published.
 Send a report →
 Why
 Why online “crackers” are risky
 The technical reason no legitimate service can test your password remotely.
 Read the explanation →
# Offline Recovery Toolkit
URL: https://forgotwalletpassword.com/offline-recovery-toolkit

Offline Wallet Recovery Toolkit — Free Printable Pack
 Skip to content
 Free · printable · offline
 Offline wallet recovery toolkit
 One download with everything you print and tick while you work: the recovery playbook, the before-you-pay red flags, token examples and official tool links. Nothing runs online, nothing is uploaded.
 By Robbert Bink · ~3 min read · Published 13 August 2026 · Last reviewed: 13 August 2026
 The headline
 This kit keeps you organised — it does not crack anything by itself. It is the printable companion to the guides: the ordered steps, the before-you-pay red flags, token examples and the official tool links. The tools themselves stay on official sources, and everything here runs on your machine, offline.
 Download the toolkit (ZIP, ~6 KB)
 What’s inside
 recovery-playbook.pdf — the seven ordered steps (protect → search → rebuild → tool → run → verify), with checkboxes and the never-rules.
 before-you-pay-checklist.pdf — the 10 red flags, printable, with the caveat about “reported”.
 token-list-examples.txt — how to build a btcrecover token list from memory fragments.
 official-links.txt — the official btcrecover, hashcat and John repositories, plus this site’s walkthroughs.
 README.txt — the safety rules that apply before, during and after.
 How to use it
 Download the ZIP and open it on your machine — it works fully offline.
 Print the playbook and the red-flag checklist, or keep them open on a second screen.
 Work through the guides in order — every PDF links back to the page it came from.
 What this kit is not
 It is not a cracker, not a service and not a shortcut around the math. If the feasibility check says a case is not viable, no kit changes that — and nobody you can pay can either. The kit is the organised version of the free route, nothing more.
 Sources & references
 The official, offline tools — and where to get them
 The full DIY route, step by step
 Before you pay anyone — the red flags
 The tools
 Choose the right tool
 btcrecover, hashcat or John — from official sources, running offline.
 Pick the tool →
 The route
 Recover a wallet password yourself
 The full DIY path, free and offline, step by step.
 Start the walkthrough →
 The math
 Is recovery technically possible?
 Feasible, sensible, or impossible — the line, wallet by wallet.
 Check the feasibility →
 Before you pay
 Should you pay a recovery service?
 The red flags, the math, and the 10-point before-you-pay checklist.
 Read the red flags →
# ForgotWalletPassword.com — home
URL: https://forgotwalletpassword.com/

Forgot Crypto Wallet Password? How to Recover It
 Skip to content
 The all-in-one guide for when you forgot a crypto wallet password
 You forgot your crypto wallet password.This is where you start.
 Forgot your wallet password? Many locked wallets can be reopened — but only when you still have the right files and enough memory clues. This guide explains the math and the exact tools, so you can try recovery yourself, offline, on your own machine.
 Start the diagnosis
 Read the guides
 ◆ A seed phrase is not a password. It is recovered differently.
 ◆ Never share your seed phrase. Ever.
 ◆ A genuinely random password with 80+ bits of entropy is practically impossible to brute-force
 ◆ Copy your wallet files before you try anything else
 ◆ Always run recovery on an offline machine
 ◆ A seed phrase is not a password. It is recovered differently.
 ◆ Never share your seed phrase. Ever.
 ◆ A genuinely random password with 80+ bits of entropy is practically impossible to brute-force
 ◆ Copy your wallet files before you try anything else
 ◆ Always run recovery on an offline machine
 Step one — which password problem is it?
 What did you actually lose?
 Forgot a wallet password? Start here. A few quick questions — the quiz also catches the things people mix up with a password: a seed phrase, an extra passphrase, or a device PIN. It stops as soon as the verdict is clear — a first verdict, never a guarantee — and points you to the right guide.
 Password recovery diagnosis
 What are you trying to open or restore?
 Do you still have the wallet file itself?
 What do you remember about the password?
 How was the password created?
 A first indication, not a guarantee. Real feasibility depends on the exact wallet type, its encryption, and what you can recall.
 The guides
 One problem, a clear path to the answer
 First understand exactly what you lost — then follow the do-it-yourself walkthroughs that fit your wallet. Everything here is free, runs offline on your own machine, and is written in plain English.
 Understand your problem
 What to do first
 The diagnosis flow in reading form — see where each branch leads, then jump to the right guide.
 Read the flow →
 What did you lose?
 Password, seed phrase, PIN or passphrase — they are four different problems with four different answers. Know which one you face before you do anything else.
 Start here →
 Exchange & custodial wallets
 Forgot your exchange password? That’s a reset, not a recovery case — KYC, email and 2FA paths.
 Just reset it →
 The first 24 hours
 Your action plan in order — what to protect, what to note down, and what never to do.
 Start the action plan →
 Where old passwords hide
 Password managers, browsers, notes apps, old emails, device backups. Most “forgotten” passwords are found, not cracked.
 Search the trails →
 The ultimate search checklist
 68 places a forgotten password or seed can hide — paper, notes, devices, backups, old accounts — tick by tick.
 Work the checklist →
 How your memory made it
 Human passwords follow habits: dates, names, substitutions, keyboard patterns. Rebuild yours the way your brain built it.
 Rebuild the pattern →
 Is wallet password recovery possible?
 Wallet formats, encryption, GPU speeds — and the line between “hard but doable” and “mathematically impossible”.
 Read the feasibility →
 Protect your wallet files
 Five moves that decide whether your case stays recoverable — before you touch anything, install anything, or pay anyone.
 Secure the evidence →
 Then do it yourself
 Recover a wallet password yourself
 The complete DIY route in ten steps: protect the file, find it, rebuild the password from memory, pick the tool, run it — every step linked to its deep-dive.
 Start the full route →
 Choose the right tool
 btcrecover, hashcat and John the Ripper — which one fits your wallet, your clues and your hardware, and how to run them safely offline.
 Pick your tool →
 How wallet encryption works
 Key derivation, iteration counts, GPU speeds — the cryptography that decides whether your password can ever be cracked.
 Understand the math →
 Convert a wallet to a hash line
 The extraction step for hashcat: bitcoin2john, electrum2john and friends — wallet to one-line hash, with the exact commands and modes.
 Extract the hash →
 btcrecover step by step
 The full walkthrough — install, token list, run, result. Reads wallet.dat, Electrum, MultiBit and most Bitcoin-era wallets directly.
 Start btcrecover →
 hashcat step by step
 Modes, masks, wordlists and GPU speed — the walkthrough for wallet.dat, keystores, Electrum, MetaMask and the other hashcat formats.
 Start hashcat →
 John the Ripper step by step
 The specialist walkthrough — Monero .keys, keystores and the other formats only JtR reads, with wordlists and rules.
 Start John the Ripper →
 Build a password hint list
 Turn everything you remember — names, years, habits, typos — into the candidate list that decides recovery, with a practice demo and a downloadable offline builder.
 Build your list →
 Troubleshooting
 “No hashes loaded”, token length exceptions, wallets that won’t load, GPU not used — the common errors, causes and fixes in one index.
 Fix your error →
 Command cheat sheet
 Every wallet format, one command — extract, mode, run, in a single quick-reference table you can keep open while you work.
 Open the cheat sheet →
 Quick answers & special cases
 Recovery without the wallet file
 No file, no seed, no backup? The answer — and the real exceptions that still work, from the seed phrase to custodial resets and brain wallets.
 Read the exceptions →
 Frequently asked questions
 Can it be recovered? How long does cracking take? Straight answers to the questions everyone asks.
 Open the FAQ →
 Browse the complete guide index
 By file format
 What does your wallet format mean for your password?
 Your wallet format decides the encryption, the cracking speed, and therefore your password’s odds. Not sure which file you have? Identify it first — then jump to the technical deep-dive for that format.
 Which wallet passwords can be recovered?
 The master list — every major wallet with a verdict: reset, crackable offline, or impossible. Filter and search to find yours.
 See your verdict →
 Which wallet file do you have?
 Start here if you’re not sure what you’re looking at: identify the file by name, extension or app — the identifier points you to the right guide.
 Identify the format →
 wallet.dat
 The Bitcoin-family wallet file — used by Bitcoin Core, Litecoin Core, Dogecoin Core, BCH and more. Iterated SHA-512 key stretching, ~25k–267k machine-tuned rounds, hashcat mode 11300.
 Read the wallet.dat guide →
 Electrum wallet file
 Encrypted keystores with a PBKDF2-based KDF from 2.8+ — older files use a weaker double-SHA-256 scheme — and one big advantage: the seed phrase can bypass the password entirely.
 Read the Electrum guide →
 Ethereum keystore JSON
 UTC--* files using scrypt or PBKDF2 before AES-128-CTR. Among the slower common formats — your clues matter more than ever.
 Read the keystore guide →
 BIP38 paper wallets
 Password-encrypted private keys starting with “6P”. scrypt-based, one of the slowest formats to test — the string on the paper is the whole wallet.
 Read the BIP38 guide →
 .aes.json export
 The .aes.json export with the weak v0/v2/v3 PBKDF2-SHA1 formats — and the 12-word phrase that skips the password entirely.
 Read the Blockchain.com guide →
 wallet.dat forks
 The same wallet.dat family inside Litecoin Core, Dogecoin Core and Bitcoin Cash — but wallet type/version and Windows data-directory defaults differ per coin, so check each client’s actual setup.
 Read the fork wallet guide →
 By wallet / app
 Forgot a specific wallet’s password?
 Remember the app but not the file? These wallets each have their own twist — the vault, the seed phrase, or the legacy file format. Every other wallet lives in the master list.
 MetaMask
 The seed restores its SRP-derived accounts — imported private-key/JSON or hardware accounts need their own recovery material — and the encrypted vault can be cracked offline (PBKDF2: 10k legacy, newer vaults store their own count) if the phrase is gone too.
 Read the MetaMask guide →
 MultiBit
 Legacy wallets with two very different fates: Classic’s .key backup (3×MD5) cracks at a million guesses per second — its .wallet and HD use scrypt.
 Read the MultiBit guide →
 Coinomi
 The scrypt vault and the 24-word seed phrase — the password is a lock, not the key.
 Read the Coinomi guide →
 Exodus
 The 12-word seed restores the wallet without the password — and the password-protected seed.seco file can be cracked offline (hashcat 28200) if the phrase is gone too.
 Read the Exodus guide →
 Monero
 The seed (25-word legacy, 16-word Polyseed, 13-word MyMonero) restores the wallet instantly; without it, the .keys file is cracked via monero2john + John the Ripper — the dedicated guide has the full route.
 Read the Monero guide →
 imToken · Eth clones
 A modified Ethereum keystore (identity.json) — its own recovery path with scrypt/PBKDF2 modes, not a MetaMask vault.
 Read the Ethereum keystore guide →
 Brain wallet
 No file at all — the passphrase is the key. SHA-256 and scrypt routes, the real tools (btcrecover, brainflayer) and the honest limits.
 Read the brain wallet guide →
 Your wallet isn’t here?
 Every major wallet in one searchable table — reset, crackable offline, or impossible. Filter to find yours.
 Open the master list →
 Go deeper
 Go beyond the basics
 Prevention, the math behind your odds, and the situations around the core guides — the pages that answer “what if it happens again?” and “how likely is this really?”.
 Seed phrase passphrase
 The 25th/13th word — a password you add on top of your seed. Forget it and the derived addresses stay locked; unlike a lost seed, it can be recovered like a password.
 The 25th word explained →
 How to never lose access
 Seed backups on paper and metal, password managers, hardware wallets and the yearly restore test — prevention that actually works.
 Set up real backups →
 How long to crack a password?
 Realistic cracking times for every wallet format — search space vs GPU speed, with examples from 6 to 16 characters.
 See the real numbers →
 Lost crypto statistics
 Lost Bitcoin isn't the same as forgotten passwords — the real numbers, the famous 7,002 / 7,500 / 1,700 BTC cases, source-cited.
 See the data →
 Benchmarks & methodology
 Every speed number on this site, measured and dated: hardware, tool versions, ranges — and how to reproduce them.
 See the measured speeds →
 Encryption timeline
 How wallet password encryption changed over time — the version history that decides your odds, in one table.
 See the timeline →
 Password strength calculator
 Your recovery odds in plain numbers: entropy and time-to-crack for your wallet format, built on measured crack speeds.
 Run the calculator →
 Glossary of terms
 Seed phrase, BIP39, scrypt, entropy, hashcat, KDF — every term on this site explained in plain English, with links.
 Open the glossary →
 How to find your wallet file
 Exact default paths for wallet.dat, Electrum, Ethereum keystores and MetaMask on Windows, macOS and Linux — plus safe-copy rules.
 Locate the file →
 Wallet password in an encrypted file
 The wallet password locked inside a password-protected ZIP, Office file or PDF — those documents crack offline with the same tools.
 Recover the document →
 Stay safe
 Don’t get scammed while you recover
 Recovery is a vulnerable moment — and scammers know it. Know the red flags, how they reach you, and where to check a service before you pay anyone.
 Should you pay a recovery service?
 The red flags, the math, and a 10-point checklist before you pay anyone anything.
 Read the red flags →
 How scammers find you
 Search ads, fake support, forums and fake tools — the channels they use, and the rule that blocks them.
 See the channels →
 Reported recovery services
 A curated, evidence-checked list — and how to report a service you have proof about.
 Check the list →
 Offline recovery toolkit
 The printable playbook, red-flag checklist, token examples and official tool links — one free download.
 Get the toolkit →
 Reality check
 What determines whether your wallet comes back?
 Recovery is arithmetic. Three factors decide the outcome — and only one of them depends on luck.
 1 · What you remember
 The single biggest factor. Fragments, patterns, lengths, reused words — every clue shrinks the search space dramatically. “I remember nothing” is the hardest case, not the normal one.
 2 · The wallet format
 Old wallet files with weak encryption can be checked millions of times per second. Modern wallets deliberately slow that to a crawl. Format decides the speed — speed decides the odds.
 3 · Randomness
 A human-chosen password is guessable. A genuinely random password with 80+ bits of entropy — what a password manager generates — is not; no GPU farm changes that. That line is the whole point of this site.