Resource · the master list
Which wallet passwords can be recovered? The complete list.
Every wallet falls into one of three buckets: reset, crackable offline, or effectively impossible. Here is the verdict for every major wallet — so you stop guessing and start doing the one thing that works.
By Robbert Bink · ~8 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
Many file-based wallet passwords are technically attackable offline — but not always by cracking. Custodial accounts reset through the platform, and older file-based wallets (wallet.dat, MultiBit, Electrum, Ethereum keystores) can be cracked offline when the password is human-made and you have clues. A random, strong password — especially a long one generated by a password manager — is generally infeasible to brute-force; no wallet, tool or service changes that.
How to read this list
Three verdicts, three different actions. Find your wallet and do exactly what its verdict says — that is the whole method:
RESET
Custodial account (exchange). Prove identity, set a new password, done. No recovery needed at all.
CRACKABLE OFFLINE
File-based encryption with a known KDF. With clues and the right hardware, a human-chosen password can be found.
IMPOSSIBLE
Random strong password. Slow legacy formats like Armory are a different story — memory-hard and very slow per guess, so clues are essential, but not impossible. The math: no service can change this.
The master list
Find your wallet below — filter by verdict or search by name. Every row ends with the one action that actually matters.
Jump straight to: MetaMask · Monero · wallet.dat · Electrum · Ethereum keystore · BIP38 · MultiBit · mSIGNA · Coinomi · Armory · Android wallets
| Wallet | What you have | Encryption / KDF | Verdict | The path | Offline tools |
|---|---|---|---|---|---|
| Coinbase, Binance, Kraken, Gemini · exchanges | — (custodial) | A custodial account | RESET | Reset the account password — see exchange & custodial wallets | — |
| MetaMask | Encrypted vault | PBKDF2-SHA256 — legacy 10k, newer vaults store their own KDF params in the vault (read the stored count; 900k is one documented value, not universal) · $metamask$ |
CRACKABLE OFFLINE | Vault crackable offline via btcrecover — MetaMask guide | btcrecover · hashcat 26600 (legacy extension) / 26610 (newer; 26620 only in newer/development builds) / 31900 (mobile) |
| Monero (official wallets) | .keys file |
ChaCha8 (older) / ChaCha20 (newer) · $monero$ |
CRACKABLE OFFLINE | The seed (25-word legacy / 16-word Polyseed / 13-word MyMonero) restores the wallet without the password; the .keys file is crackable with the custom-KDF tooling (monero2john) in the John the Ripper walkthrough — full Monero guide |
John the Ripper (monero2john) · Monero guide |
| BIP39 passphrase · the 25th/13th word | Forgotten passphrase (the 25th/13th word) | BIP39: PBKDF2-HMAC-SHA512, 2,048 iterations; candidates verified by deriving target addresses | CRACKABLE OFFLINE | btcrecover tests BIP39 passphrases directly. SLIP39 passphrases are a separate recovery mode with their own KDF (Feistel + PBKDF2-HMAC-SHA256) and a quorum of shares — do not apply BIP39 math to them — the passphrase guide has the math | btcrecover |
| Bitcoin Core / Bitcoin-Qt · old wallet.dat | wallet.dat — rounds vary per wallet (25k floor) |
iterated SHA-512 (EVP_BytesToKey) · $bitcoin$ |
CRACKABLE OFFLINE | Fast to test — hundreds of guesses/sec on CPU, thousands on GPU. wallet.dat guide | hashcat 11300 · btcrecover · John the Ripper |
| Bitcoin Core · modern wallet.dat | wallet.dat — same KDF; rounds machine-tuned (~100 ms target) |
iterated SHA-512 · $bitcoin$ |
CRACKABLE OFFLINE | Slower, still feasible with clues. wallet.dat guide | hashcat 11300 · btcrecover · John the Ripper |
| Litecoin · Dogecoin · Bitcoin Cash · Dash | Same wallet.dat format |
iterated SHA-512 · $bitcoin$ |
CRACKABLE OFFLINE | Identical encryption to Bitcoin Core — fork wallets | hashcat 11300 · btcrecover · John the Ripper |
Other Bitcoin-family wallet.dat |
Bitcoin Knots, Unlimited, Classic, XT, Vertcoin, DigiByte, Viacoin, Groestlcoin… | iterated SHA-512 · $bitcoin$ |
CRACKABLE OFFLINE | Same wallet.dat encryption as Bitcoin Core — wallet.dat guide | hashcat 11300 · btcrecover · John the Ripper |
| Electron-Cash · BCH | Encrypted wallet file | Electrum-family encryption (BCH fork) | CRACKABLE OFFLINE | Supported by btcrecover (2.x–4.x). btcrecover guide | btcrecover |
| MultiDoge · DOGE | .key backup (MultiBit-style) |
3×MD5 (.key) | CRACKABLE OFFLINE | One of the fastest formats to test — same family as MultiBit Classic. btcrecover guide | btcrecover |
| Electrum · Electrum-LTC · versions 1.x–4.x | Encrypted keystore file | PBKDF2-SHA512 1,024 + ECC (2.8+); double SHA-256 (older) · $electrum$ |
CRACKABLE OFFLINE | PBKDF2-based from 2.8+, weaker double-SHA-256 for 1.x–2.7; crackable with clues. Electrum 2FA / TrustedCoin wallets are a special case: current btcrecover documentation excludes 2FA wallets from its standard Electrum password-recovery support — identify the wallet type before the generic route. Electrum guide | btcrecover · hashcat 16600 / 21700 / 21800 · John the Ripper |
| Ethereum keystore · geth, MEW, MyCrypto & EVM clones | UTC--*.json file |
scrypt or PBKDF2-HMAC-SHA256; parameters stored in the file's kdfparams (geth commonly uses scrypt N=262,144; lighter configs exist) · $ethereum$ |
CRACKABLE OFFLINE | scrypt or PBKDF2 — slow to test, feasible with clues. keystore guide | hashcat 15600 / 15700 · btcrecover · John the Ripper |
| Ethereum pre-sale wallet · 2014 | JSON wallet file |
PBKDF2-HMAC-SHA256 · $ethereum$w |
CRACKABLE OFFLINE | PBKDF2-HMAC-SHA256 — hashcat mode 16300 | hashcat 16300 |
| BIP38 paper wallets | 6P… encrypted key |
scrypt N=16,384 r=8 p=8 | CRACKABLE OFFLINE | scrypt-based, tens of guesses/sec. BIP38 guide | btcrecover |
| Brainwallets · bitaddress.org, Warpwallet | Passphrase-derived key | SHA-256 (bitaddress) / WarpWallet: scrypt N=2¹⁸ XOR PBKDF2-HMAC-SHA256 2¹⁶ rounds | CRACKABLE OFFLINE | The passphrase is the key itself — btcrecover tests SHA-256 and scrypt brainwallets. Deep guide — brain wallet recovery | btcrecover |
| Blockchain.com · wallet.aes.json | .aes.json export |
PBKDF2-SHA1 (10 / 10k / 5k) · $blockchain$ |
CRACKABLE OFFLINE | Feasible with clues — very early legacy V0 wallets use a separate algorithm (hashcat 34700); identify the version before using 12700/15200. Blockchain.com guide | hashcat 12700 / 15200 / 18800 (legacy V0: 34700) · btcrecover · John the Ripper |
| MultiBit Classic · legacy | .key (MD5) / .wallet (scrypt) |
3×MD5 (.key) / scrypt (.wallet) · $multibit$ |
CRACKABLE OFFLINE | The .key backup is one of the fastest formats to test; the .wallet variant uses scrypt. MultiBit guide |
hashcat 22500 / 27700 · btcrecover · John the Ripper |
| MultiBit HD · legacy | mbhd.wallet.aes, scrypt-based |
scrypt N=16,384 · $multibit$ |
CRACKABLE OFFLINE | Slower than Classic but supported by btcrecover — MultiBit guide | hashcat 22700 · btcrecover · John the Ripper |
| mSIGNA (CoinVault) | Encrypted wallet database | btcrecover format (see docs) | CRACKABLE OFFLINE | btcrecover reads it directly; feasible with clues. btcrecover guide | btcrecover |
| Hive for OS X | bitcoinj-based encrypted wallet | bitcoinj protobuf — scrypt | CRACKABLE OFFLINE | Same bitcoinj family as MultiBit — btcrecover handles it. btcrecover guide | btcrecover |
| Bitcoin Wallet (Android/BlackBerry) · KnC Wallet | Spending PIN / encrypted backup | bitcoinj scrypt / spending PIN | CRACKABLE OFFLINE | The numeric spending PIN is a small search space when its approximate length is known — PIN length varies, so configure the range you actually may have used; encrypted backups are crackable. btcrecover guide | btcrecover |
| Litecoin Wallet for Android · Dogecoin Wallet for Android | Encrypted backups | bitcoinj scrypt | CRACKABLE OFFLINE | All supported by btcrecover — btcrecover guide | btcrecover |
| Dogechain.info | Encrypted wallet export | PBKDF2-HMAC-SHA256 + AES · parameters/version stored in the wallet data | CRACKABLE OFFLINE | Not the bitcoinj scrypt family — btcrecover reads the Dogechain export directly; hashcat 32500 covers the applicable/older Dogechain format, but newer payload variants (e.g. AES-GCM) may differ, so identify the wallet format first. btcrecover guide | btcrecover · hashcat 32500 |
| Bither | Bither SQLite wallet database | — | CRACKABLE OFFLINE | Supported by btcrecover's SQLite wallet-database loader (format-3; addresses.encrypt_private_key / password_seed) — exported/encrypted backups may need separate preparation — btcrecover guide |
btcrecover |
| block.io | Account “Secret PIN” | PBKDF2-HMAC-SHA256 (iteration count stored in the wallet data; legacy ~2,048, newer 100,000+) | CRACKABLE OFFLINE | Identify the wallet format and stored pbkdf2_iterations first — a modern high-iteration wallet is far slower than a legacy one; wallet data can be retrieved via the block.io browser/Network route — btcrecover guide |
btcrecover |
| btc.com (Blocktrail) | BTC.com/Blocktrail recovery-sheet wallet data (not the raw PDF) | PBKDF2-based (btcrecover BTC.com loader: salt/iterations/IV/ciphertext from the wallet data) | CRACKABLE OFFLINE | The wallet password that unlocks the backup sheets is recoverable with btcrecover, but the raw PDF is not the input — prepare the wallet data first (passwordEncryptedSecretMnemonic) — btcrecover guide |
btcrecover |
| Yoroi (Cardano) | Master password in wallet data | PBKDF2-SHA512 19,162 + ChaCha20-Poly1305 | CRACKABLE OFFLINE | Extract and test with btcrecover. For wallets created directly in Yoroi, the recovery phrase is 15 words; Yoroi can also restore compatible 24-word Cardano wallets created elsewhere. btcrecover guide | btcrecover |
| Toast Wallet | Wallet passphrase | — | CRACKABLE OFFLINE | btcrecover supports the passphrase — btcrecover guide | btcrecover |
| imToken · Eth clones | Encrypted keystore (modified Eth format) | scrypt / PBKDF2 · $ethereum$ |
CRACKABLE OFFLINE | btcrecover reads the modified keystore directly (needs identity.json from the imToken folder); plain keystores follow the keystore guide. |
btcrecover · hashcat 15600 / 15700 |
| Coinomi vault | scrypt vault | scrypt N=16,384 r=8 p=1 | CRACKABLE OFFLINE | Vault crackable offline (scrypt) via btcrecover — Coinomi guide | btcrecover · John the Ripper (coinomi2john) |
| Exodus Desktop | seed.seco wallet file |
scrypt (seed.seco) | CRACKABLE OFFLINE | Password-encrypted local wallet (scrypt) — extract with exodus2hashcat.py, then hashcat mode 28200 — Exodus guide |
hashcat 28200 |
| Terra Station | Encrypted wallet JSON | PBKDF2-SHA1 100 + AES-256-CBC | CRACKABLE OFFLINE | PBKDF2-SHA1 (100 rounds) + AES-256-CBC — hashcat mode 29600 | hashcat 29600 |
| Bisq | .wallet file (scrypt) |
scrypt N=32,768 r=8 p=6 · $bisq$ |
CRACKABLE OFFLINE | scrypt-encrypted wallet file — extract with bisq2hashcat.py, then hashcat mode 29800 |
hashcat 29800 |
| BitShares | Wallet database (light client) | — | CRACKABLE OFFLINE | Wallet database extractable with bitshares2john.py — JtR walkthrough |
John the Ripper (bitshares2john) |
| Stargazer · Stellar (XLM) | Encrypted wallet file | $stellar$ |
CRACKABLE OFFLINE | Password-encrypted wallet file — hashcat mode 25500 | hashcat 25500 |
| Keplr · Cosmos | Encrypted vault in extension storage | scrypt (AES-128-CTR) | CRACKABLE OFFLINE | Legacy Keplr extension format: extract with keplr2john.py. Keplr v2/current formats: do not assume compatibility — identify the vault format first. JtR walkthrough |
John the Ripper (keplr2john) |
| Cardano · legacy Daedalus | secret.key (2017–2019 Daedalus wallets) |
PBKDF2-SHA512 + BLAKE2b/ChaCha20 (legacy) | CRACKABLE OFFLINE | Legacy Daedalus keys extractable with cardano2john.py — JtR walkthrough. Modern Daedalus wallets restore from the seed phrase instead. |
John the Ripper (cardano2john) |
| Tezos | Tezos ICO / fundraiser credentials | — | CRACKABLE OFFLINE | Extract with tezos2john.py using the ICO mnemonic, fundraiser email and tz1 address — this is the ICO/fundraiser password route, not a generic client key file — JtR walkthrough |
John the Ripper (tezos2john) |
| Armory | armory.wallet, legacy |
ROMix-SHA-512 (memory-hard; memory/iteration parameters calibrated per wallet) | CRACKABLE OFFLINE — very slow | Memory-hard ROMix-SHA-512 KDF with no hashcat mode. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py) — a compatible extraction step is still required; older btcrecover/Armory workflows also exist, at roughly 15k–200k candidates per 0.2–3 hours — clues are essential. The Armory paper backup (Root Key / chain-code, not a BIP39 phrase) remains the fastest restore path |
btcrecover |
| Any wallet with a random high-entropy password | Password-manager-grade password | — (n/a) | IMPOSSIBLE | Generally infeasible for any realistic hardware — run the entropy calculator to see why. | — |
Encryption/KDF and hash-prefix figures verified against the hashcat example-hashes list and measured speed classes are on the benchmarks & methodology page. August 2026.
“Crackable offline” never means guaranteed. It means the encryption is attackable at a measurable speed — your odds still depend on what you remember and how the password was built. Run the entropy calculator for your specific case. And “impossible” means impossible as a password-cracking route — the forgotten password itself is the dead end, not the wallet.
The three rules behind the whole list
If your wallet isn’t in the table, it still fits one of a few security models — seed/key-based, encrypted-file based, hardware/device based, or custodial — and the model decides the verdict:
6P… string is an encrypted private key that contains everything except the passphrase, and a brain wallet derives its keys directly from the passphrase. The passphrase itself is what recovery tests..keys. The file holds your keys and the password unlocks them. Recovery is a technical problem with a real speed limit: sometimes yes, often no.Before you try anything: secure the file and the clues
Whatever the verdict, do the safe steps first: back up the wallet file to read-only media, write down everything you remember about the password, and check the search checklist before spending a second on guessing. The first 24 hours guide has the exact order.
The caveats
- The rounds count, not the client version, decides speed. Bitcoin Core picks the iteration count at encryption time to take ~100 ms on the encrypting machine (minimum 25,000); reference wallets measure 68k–267k rounds. Fewer rounds means more guesses per second. The encryption explainer shows why.
- Clues beat hardware every time. One remembered fragment can shrink the search space by a million — worth more than any GPU. Rebuild your memory with how your memory made it.
- “Recoverable” is a spectrum, not a promise. Your real odds come from the feasibility framework — the wallet format, the password’s shape, and what you remember.
- Never upload your wallet file to a public checker or unknown website. Legitimate recovery runs offline on a copy. Protect your wallet files is the safety rulebook.
Frequently asked questions
Which wallet passwords can simply be reset?
Exchange and custodial accounts — Coinbase, Binance, Kraken and similar — are the only ones where a forgotten password is a reset, not a recovery. The platform holds the keys; you prove identity, set a new password, and access is restored.
Which wallet passwords are the easiest to recover offline?
Old Bitcoin Core wallet.dat files can be tested at hundreds of guesses per second on a CPU (thousands with GPU acceleration), and MultiBit Classic’s .key backup (3×MD5) allows around a million guesses per second — making human-chosen passwords with a few clues genuinely recoverable. Modern wallets are deliberately slower.
What makes a wallet password effectively unrecoverable?
A genuinely random password with roughly 80+ bits of entropy — for example 14+ characters from a full character set — is generally infeasible to brute-force for any realistic hardware. Slow legacy formats like Armory are a different story: memory-hard and very slow per guess, but not impossible — strong clues make them realistic. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts; a compatible extraction step is still required.
How this list was verified
Every verdict is grounded in the same public sources the rest of this site uses: the hashcat example hashes wiki for the KDF/mode mapping (wallet.dat → 11300, Electrum → 16600/21700/21800 by salt type, Ethereum keystore → 15600/15700, BIP38 → no hashcat mode; btcrecover handles it), the btcrecover documentation for which formats the offline tools support, and the John the Ripper jumbo build for the *2john extraction scripts (bitcoin2john, electrum2john, ethereum2john, monero2john). Where a claim depends on a specific tool or version, the speed classes above are order-of-magnitude estimates, not benchmarks.
- hashcat — example hashes (wallet formats & modes)
- BIP39 — mnemonic code for generating deterministic keys
- btcrecover documentation (supported wallet formats)
- John the Ripper (jumbo) — *2john extraction scripts
Sources & references
- btcrecover — performance benchmarks (measured crack speeds)
- hashcat — example hashes (wallet formats & modes)
- Bitcoin Wiki — wallet encryption
- btcrecover source — wallet formats & KDF parameters (Yoroi 19,162, SLIP39 support)
- Bisq source — wallet scrypt parameters (N=32,768 r=8 p=6)
- John the Ripper — cardano2john (legacy Daedalus secret.key format)
Cite this page
APA: Bink, R. (2026). Which wallet passwords can be recovered? The complete list. ForgotWalletPassword.com. https://forgotwalletpassword.com/recoverable-wallets
Markdown: [Which wallet passwords can be recovered? The complete list.](https://forgotwalletpassword.com/recoverable-wallets)
Keep going — it’s all free
Not sure what you lost or what’s possible?
Take the quick diagnosis for a first verdict — it stops early when the answer is already clear — then work the search checklist. Everything here is informative, runs offline, and is free to use.