Get your wallet file off an old phone

Why extraction comes first

Every recovery tool on this site tests candidate passwords against the wallet file — the encrypted vault, keystore or .keys file. If that file only exists inside a phone’s app storage, there is nothing to test until it is out. That is why “the vault is on my old phone” is usually the real blocker: the cracking is the easy part, the extraction is the hard part.

Everything below works on your own device and your own backups, through the paths the platforms themselves provide: exports, ADB backups, cloud backups and encrypted computer backups. No lockscreen bypass, no rooting guide, no recovery of someone else’s data — those are not this site.

Step 0 · Is this even a password case?

Before you extract anything: if you still have the wallet’s seed phrase, you do not need the vault at all — restore it in the original wallet or a compatible wallet that supports the same seed type, coin and derivation settings, and set a new password. Extraction only matters when the seed is gone too and the encrypted vault is your only door. If you’re not sure which situation you’re in, the password vs seed phrase page settles it. → What did you actually lose?

Android — the realistic paths

Wallet app data on Android lives in the app’s private folder (/data/data/<package>/), which Android does not let you browse normally. Three paths get a copy out without changing the phone:

• The app still opens → use its own path. Some wallets let you export or reveal the vault data, or simply show you the file path in the app’s settings. If you can still unlock the app itself, your problem may already be solved by its seed phrase.
• ADB backup (Android 11 and earlier, and only sometimes). With USB debugging enabled, adb backup -f wallet.ab -noapk <package> may export the app’s data — whether it does depends on the app’s backup configuration (android:allowBackup and its backup rules; many wallet apps deliberately exclude sensitive data) and the Android version. On Android 12+ with apps targeting API 31+, adb backup only covers debuggable apps. If it works, unpack the result with the open-source Android Backup Extractor: java -jar abe.jar unpack wallet.ab wallet.tar (add the backup password as the last argument if you set one), and the vault file may be inside the .tar.
• Full-device backups. OEM cloud backups, Google One and manufacturer tools can contain app data; restoring one to another device you own may bring the vault back into the app, after which the export path applies.

Root-style backup tools (Titanium Backup, Swift Backup) read the private folder directly, but this guide deliberately stops at the paths that don’t require changing the device. The same rule applies to every path: copy first, then work on the copy. Whatever you extract, the next step is the normal password recovery for that wallet — the table below shows the exact guide per app.

iPhone — the encrypted backup

Wallet app data on iPhone lives in the app’s local storage. An encrypted iTunes/Finder backup can carry more sensitive data than an unencrypted one: restore that backup to a device you own (or a fresh install) and the wallet app’s data may come back with it. How much comes back depends on how that specific app stores its secrets — some keychain classes are device-bound or excluded from backups, so wallet data is not guaranteed to be there.

If the backup itself is password-protected and you don’t remember that password, that is a second lock — and it is a password problem this site does cover: hashcat mode 14700 (iTunes < 10.0) or 14800 (iTunes ≥ 10.0), extracted from the backup’s manifest. Realistic only with a human-made backup password and clues — the math is the same as everywhere else. → hashcat step by step

Browser-extension vaults

MetaMask, Keplr and imToken-style vaults in browsers live in the browser profile’s LevelDB storage (the extension-ID folder) — no phone needed. The MetaMask guide shows exactly where; the JtR walkthrough covers extracting Keplr.

Wallet → what you need → what happens next

Package names are the publicly documented Android identifiers; the exact vault filename inside the backup varies per app version. Once the file is out, the case is a normal one: find your verdict in the master list and run the right tool. Coinomi Desktop/Windows is not a phone-extraction case — check %LOCALAPPDATA%\Coinomi\Coinomi\wallets instead.

The dead ends

Two situations end before extraction starts. First: the vault never left the phone, you never made a backup, and the phone no longer works — getting data off dead hardware is data recovery, not password recovery, and this site deliberately does not cover it. Second: you have the seed phrase somewhere but can’t find it — that’s a search problem, not an extraction problem; the 68-place checklist is the systematic way to hunt it down.

Safety rules (same as always)

Never upload vault data, backups or phone images anywhere. Everything here runs offline, on copies, with tools from official sources — the vault file you extract is as sensitive as the seed itself. → Protect your wallet files

Frequently asked questions