Forgot your MetaMask password? The seed restores — the vault can be cracked.

First: how was this MetaMask wallet created?

MetaMask now has two different wallet architectures, and the answer changes the recovery flow:

• Created from a Secret Recovery Phrase — the classic flow. The phrase restores the accounts derived from it anywhere; if the phrase is gone, the local encrypted vault is the offline crack target described below.
• Created by signing in with Google, Apple or Telegram — a newer flow. Your Secret Recovery Phrase is protected by the social account and your MetaMask password together. Access and recovery run through that social-login path, so “forgot password” is not automatically a local-vault crack. Follow MetaMask’s official social-login recovery documentation, and keep searching for any SRP backup — without the SRP and without social-login access, this is a different, harder situation.

First, the almost-always-answer: the seed phrase

MetaMask’s password never touches the blockchain. It encrypts a local file called the vault, which holds your Secret Recovery Phrase and imported keys. Reset the password or delete the extension — the funds are still on-chain, and the phrase restores the accounts derived from it anywhere. Imported accounts (private key, JSON, hardware) are not restored by the phrase — keep their private keys or the old vault until every expected address is verified. So before anything technical:

• Search for the 12-word Secret Recovery Phrase: paper backups, notes apps, password managers, old emails, screenshots, and cloud backups (see the 68-place checklist).
• If you find it, install MetaMask fresh, choose “import wallet”, enter the phrase, and set a new password. Then verify that every expected address is present — including imported accounts — before removing the old vault.
• The phrase is the real asset. Anyone with it controls the wallet, so never share it with anyone.

If the phrase is gone — SRP-created wallets: the vault

This route applies to wallets created from a Secret Recovery Phrase. If the wallet was created with Google/Apple/Telegram, follow the social-login recovery flow above before treating a local vault as your target.

The vault is encrypted with PBKDF2-HMAC-SHA256 + AES-GCM. Legacy vaults fixed the KDF at 10,000 iterations; newer vaults store their own parameters in the vault data — read the actual count rather than assuming one default (values such as 600,000 and 900,000 are both documented). Fewer iterations means faster guessing — the legacy vault is among the fastest wallet formats to test, while newer vaults are often 10–90× slower per guess depending on the stored count. Three ways to approach it, in order:

1. 1

   Find the vault on your device

   In Chrome/Edge, the vault lives in Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn (that is MetaMask’s extension ID); in Firefox, in the extension’s indexedDB storage. You can copy or export that vault data directly — the MetaMask app does not need to be open or logged in — and the copied folder is exactly what the offline tools (metamask2hashcat.py / btcrecover’s extract-metamask-vaults.py) crack. Back up the folder before touching anything — the protection rules apply here too.

2. 2

   Test candidates with the official vault-decryptor

   MetaMask’s own tool (vault-decryptor) runs entirely in your browser, locally — you paste the vault data and a candidate password, and it returns the phrase if the password is right. It is the fastest test of a remembered password. Only use it offline, never upload vault data to a random site.

3. 3

   Run a real search with hashcat

   Convert the vault to a hash line (the community metamask2hashcat.py script does this — it reads the KDF parameters from the vault) and run the matching mode with your hint list or masks:

   hashcat -m 26600 vault.hash words.txt -r rules/best66.rule # legacy 10k vaults
   hashcat -m 26610 vault.hash words.txt -r rules/best66.rule # newer dynamic-iteration vaults (26620 in recent hashcat builds)

   At the legacy 10,000 iterations, a modern GPU tests roughly 5,600 candidates per second (the measured rate on an RTX 5090). A newer vault at a high stored count (900,000 is documented, but read the actual value from the vault) runs roughly 90× slower — the same tools, with a hashcat version that supports the newer vault layout, and a far longer wait. Either way, human-chosen passwords with fragments or a known pattern are realistic, but the candidate list still decides the case. The hashcat walkthrough covers the full command flow.

The honest limits

• A random, 16+ character password is effectively unreachable — no tool, no service and no “hacker” changes that. Check the math before investing weeks.
• The iteration count is not a single number anymore. Legacy vaults used 10,000 PBKDF2 iterations; newer vaults store their own parameters in the vault data — read the actual count (600,000 and 900,000 are both documented), which can be roughly 10–90× slower per guess. Extraction tools like metamask2hashcat.py read the parameters for you, and hashcat handles the formats with modes 26600 (legacy), 26610 (newer extension vaults; 26620 in recent/development builds) and 31900 (mobile).
• Never paste vault data into an online “unlocker”. The legitimate tools run locally, on your own machine, on a copy.

Frequently asked questions

Sources & references

1. MetaMask — official vault-decryptor (client-side tool)
2. hashcat — example hashes (mode 26600, MetaMask)