Your wallet password is probably in a password manager. Forgot the master password? Here’s the recovery path.

Why this page exists

The search checklist tells you to check your password manager first — because that is where most wallet passwords are stored. But “checking” only works if you can open the manager. If the master password itself is gone, the wallet password is not lost: it is locked behind a second password, and that second password is exactly the kind of problem this site covers. (If the password is locked inside a protected document instead of a manager, the encrypted-file guide is the matching path.)

Which managers are crackable — and how fast

These are the official hashcat modes, straight from the hashcat example-hashes list:

The speed reality: modern managers use hundreds of thousands of key-derivation iterations (KeePass 2 with Argon2 or high AES-KDF rounds, LastPass with high rounds). That makes a random 16-character master password effectively unreachable — but a human-chosen master password, which is most people’s reality, is exactly where a good candidate list wins.

The walkthrough — five steps

1. 1

   Protect the database

   Work on a read-only copy of the vault or keychain file, offline, on your own machine. Never upload the vault to a public checker or unknown website — a website asking for your .kdb/.kdbx or keychain is harvesting it. The protection rules apply to manager files too.

2. 2

   Get the vault into a hash line

   KeePass: identify whether you have a KeePass 1 .kdb or KeePass 2 .kdbx database first, then the keepass2john script (from the John the Ripper project) extracts the hash line from your database. For KDBX 4, also check which KDF the file actually uses: KeePass lets you choose AES-KDF or Argon2, and current hashcat versions support both via 34300 (Argon2) and 34301 (AESKDF). LastPass: locate the locally cached vault in your browser extension’s storage (the lastpass2john script reads it) — the account’s CSV export does not contain the hash. Bitwarden: find the local data.json (desktop app or browser extension), determine which KDF the account uses, and extract the hash line with bitwarden2hashcat or bitwarden2john (hashcat mode 23400 — the standard extractor does not read Argon2id parameters, so do not assume that route applies to every vault). 1Password: identify the exact format first, then convert before running hashcat — for agilekeychain (6600) and cloudkeychain (8200), hashcat’s own guidance points to 1password2john.py; 31800 is a separate local mobilekeychain format (1Password 8) — verify the exact local format and required extraction route first. Modern accounts also use a Secret Key alongside the account password — that key is part of what has to be recovered. The hashcat walkthrough covers the general extraction flow.

3. 3

   Pick the mode

   From the table above: 13400 KeePass with AES-KDF (KDBX ≤ 3); KDBX 4 may be Argon2 (34300) or AES-KDF (34301) — identify the KDF first. 6800 LastPass, 23400 Bitwarden, 6600/8200/31800 1Password, 5200 Password Safe.

4. 4

   Build the attack

   A wordlist from your password hint list with rules, or a mask when you remember the shape:

   hashcat -m 13400 vault.hash words.txt -r rules/best66.rule

   This command is for AES-KDF databases (mode 13400). If the database is KDBX 4, mode 13400 will not load it — check the KDF that keepass2john reports: Argon2 databases use hashcat mode 34300, AES-KDF KDBX 4 databases use mode 34301. Master passwords follow the same habits as every other password you ever made — years, names, patterns. That is the memory work, and it decides the outcome.

5. 5

   Read the result — and unlock the chain

   A cracked master password may open the vault, and inside it is the wallet password (and often the seed phrase backup too) — for some password managers. For modern 1Password accounts, the account password alone is not enough: the Secret Key, an already signed-in device, Emergency Kit, recovery code, or another supported recovery route may also be required. If the status screen shows an unworkable pace, the verdict is that the master password was random — and no tool changes that. Check the math before investing weeks.

Sources & references

1. hashcat — example hashes (official mode list)
2. KeePass — security and key-derivation documentation