Monero wallet password recovery

Three routes, one verdict

Monero wallets were designed so that the password is not the only way in:

• You have the seed — 25-word legacy, 16-word Polyseed, or 13-word MyMonero. Restore the wallet in any official Monero wallet, set a new password, done. The old password stops mattering the moment the wallet is recreated from the seed. If the seed was written down with an optional passphrase and you forgot it, you have a password problem after all — but Monero’s passphrase is a seed offset: the mnemonic and the offset together derive a different wallet. That is Monero-specific mechanics, not the BIP39 “25th word” in the general passphrase guide — see the official restore-from-seed guide.
• You have the primary address and the private spend and view keys backed up separately. Monero officially supports restoring a spend-capable wallet from those three pieces alone — no mnemonic and no original .keys file (“restore from keys”). The old password plays no role; you simply set a new one after the restore.
• You only have the .keys file. The private keys still exist, encrypted by your password. This is a genuine password-recovery case: convert the file with monero2john and test candidates with John the Ripper.
• You have none of those. No seed, no separately backed-up keys, and no .keys file means no password recovery is possible — see recovery without the wallet file for the rare exceptions that still exist elsewhere.

A Monero note about the “passphrase”

Monero’s optional passphrase is not the BIP39 “25th word”. Monero calls it a seed offset: the mnemonic and the seed offset are used together to derive a new Monero wallet and seed. Restoring the same wallet therefore requires the exact mnemonic and the exact seed offset — a different offset (or none) derives a different wallet. The general passphrase guide explains the BIP39-style mechanics; for Monero, follow the official restore-from-seed guide and the wallet RPC’s seed_offset parameter. The algorithm and candidate speeds are not the same as the BIP39 case.

What the .keys file actually is

A Monero wallet on disk is several files, and only one matters for password recovery:

The password is never stored anywhere and no company can reset it. Instead, the wallet derives an encryption key from your password with Monero’s CryptoNight slow hash (a memory-hard KDF built to resist exactly the tools used for wallet.dat), and the private keys are stored encrypted — in newer wallets with ChaCha20, in older ones with ChaCha8. That design is why this case is slower than almost every other wallet on this site.

Where Monero stores your wallet

Default wallet folders, per platform:

• Windows: C:\Users\<you>\Documents\Monero\wallets\<walletname>\<walletname>.keys
• Linux: ~/Monero/wallets/<walletname>/ — older command-line builds used ~/.bitmonero/wallets/
• macOS: ~/Monero/wallets/<walletname>/ — older builds used ~/.bitmonero/wallets/
• Backups: cloud drives, USB sticks and old machines — the file may be named anything, but it always ends in .keys

The .keys file name matches the wallet name you chose, so searching for *.keys — or for fragments of a name you remember — is the fastest find. If the wallet is on a phone or an old computer that no longer boots, the extraction step comes first: get the wallet file off an old phone or check how to find your wallet file.

Step 1 · Protect the file

Copy the wallet folder (at minimum the .keys file) to a read-only backup before touching anything — never work on the original, never upload it to a public checker or unknown website, and never type the seed or password into a website. The .keys file is as sensitive as the wallet itself. → Protect your wallet files

Step 2 · Convert with monero2john

John the Ripper’s jumbo build ships monero2john.py in its run folder. Convert your .keys file to a hash line:

The resulting line starts with $monero$. Do not write the file off by age: John the Ripper’s jumbo build added support for legacy Monero wallets that predate the JSON format, so run monero2john.py on the actual file first — including older binary-format wallets. If extraction fails, the case becomes format- and version-specific rather than a blanket dead end. If you still know the password, opening the old wallet in a modern Monero client may migrate it to the current format. If the password is forgotten, that migration is not a workaround — preserve the original files and identify the exact wallet version instead of assuming it is unsupported.

Step 3 · Run John the Ripper

Start with a wordlist plus rules — the standard approach for human-made passwords:

If you remember the shape of the password, use a mask instead; if it resembles a base word plus digits or symbols, add that pattern:

Re-read any cracked hash any time with john --show monero.hash. For the full install, extraction and attack workflow — including the status screen and what each switch does — follow the John the Ripper walkthrough.

Why there is no hashcat mode

Admittedly frustrating: hashcat has no Monero wallet mode, and none is in the maintained mode list. The reason is the KDF. CryptoNight is memory-hard — designed so that GPUs and ASICs cannot run it orders of magnitude faster than a CPU. John the Ripper implements the format and runs it on CPU; that is the documented, maintained path. Anyone selling you “GPU-accelerated Monero cracking” is describing a different coin or a different wallet family, not a Monero .keys file.

Speed reality — read this before you start

Monero sits at the slow end of every speed table on this site. The CryptoNight KDF makes each candidate check a memory-hard operation, CPU-bound, an order of magnitude or more below the wallet.dat family — and far below what a GPU hashcat run achieves on Ethereum keystores. The consequence: this route only makes sense with a human-made password and genuine clues. “Just run a wordlist” on a long random password will not finish. If you have fragments, patterns or habits to reconstruct, the hint-list method is what turns them into candidates — and the benchmarks page shows where Monero fits among the other formats.

What you need before you start

• The .keys file (copy, not the original)
• Your best password clues — fragments, base words, patterns, dates
• John the Ripper jumbo from the official Openwall download — a distro package only if it is a real jumbo build with the wallet formats (Debian/Ubuntu’s john is core-only)
• Realistic expectations: seed and private-key restore first, cracking second, GPU shortcuts never

Your wallet’s verdict is in the master list, the one-line commands in the cheat sheet, and the full workflow in the JtR walkthrough.

Frequently asked questions