Resource · identification
Your file extension tells us more than your memory does.
The wallet type decides the encryption, the testing speed, and therefore your recovery odds. Find the file — or the app name — and you instantly know which specialist guide applies to you.
By Robbert Bink · ~5 min read · Published 6 August 2026 · Last reviewed: 15 August 2026
Find the wallet file and read its extension: wallet.dat is Bitcoin Core — Core-derived forks (Litecoin, Dogecoin, Bitcoin Cash, Dash) share compatible legacy wallet encryption, though the database backend behind the file can differ (legacy BDB vs modern SQLite descriptor wallets) — a UTC--*.json file is an Ethereum keystore, a string starting with 6P is a BIP38 key, and an Electrum file lives in the app’s data folder. That one detail sends you to the right recovery guide — and the right feasibility expectation.
—
Detect by file content (offline)
Not sure from the name? Drop the file below — the check runs entirely in your browser, nothing is uploaded. It reads the file’s structure and suggests the most likely wallet format, with the guide to follow.
Identify by file type
| What you found | Wallet | Your guide |
|---|---|---|
wallet.dat |
Bitcoin Core / Bitcoin-Qt / classic desktop client — Core-derived forks (Litecoin, Dogecoin, Bitcoin Cash, Dash) share compatible legacy encryption; the backend inside wallet.dat can be legacy BDB or modern SQLite descriptor wallets |
wallet.dat guide · fork wallets |
UTC--2020-06-01T….json or 0x….json |
Ethereum keystore — geth, MyCrypto, MyEtherWallet, many EVM apps | Ethereum keystore guide |
| File in the Electrum data folder (no fixed extension, JSON-like content) | Electrum (1.x–4.x) | Electrum wallet guide |
A long paper-wallet key starting with 6P |
BIP38-encrypted private key | BIP38 paper wallet guide |
| No file — just a 12- or 24-word phrase | Seed-based wallet (MetaMask, Trust Wallet, Exodus, Coinbase Wallet, Phantom, Atomic — nearly every mobile wallet) | Seed phrase passphrase |
.keys file (plus a cache file without extension) |
Monero — the official CLI/GUI wallets | Monero uses a custom KDF that btcrecover and hashcat don’t read directly — but the seed (25-word legacy, 16-word Polyseed, 13-word MyMonero) restores the wallet without the password, and if the seed is gone, the John the Ripper walkthrough is the specialist path for .keys files. See password vs seed and is recovery possible? |
armory.wallet (or a .wallet backup file) |
Armory — the old Python Bitcoin client | Legacy software with a memory-hard custom KDF (ROMix-SHA-512) and no hashcat mode. Current John the Ripper Jumbo supports Armory wallet hashes from btcrecover data extracts (extract-armory-privkey.py) — a compatible extraction step is still required; older Armory-specific workflows also existed. Your paper backup (Armory's own Root Key / chain-code format — not a BIP39 12-word phrase) is the practical path. See how wallet encryption works |
seed.seco in the Exodus Desktop data folder |
Exodus Desktop — password-encrypted local wallet (scrypt) | Exodus guide (hashcat mode 28200) |
| Encrypted JSON from Terra Station | Terra Station wallet — PBKDF2-SHA1 + AES-256-CBC | Master list — Terra Station row (hashcat mode 29600) |
| A 2014 presale wallet JSON (before the mainnet) | Ethereum pre-sale wallet | Master list — pre-sale row (hashcat mode 16300) |
| LevelDB storage folder of the Keplr extension | Keplr (Cosmos) — password-encrypted vault | Master list — Keplr row (legacy format: keplr2john; current Keplr v2 formats: do not assume compatibility — identify the vault format first) |
secret.key from a 2017–2019 Daedalus install |
Cardano — legacy Daedalus key file | Master list — Cardano row (John the Ripper, cardano2john) |
| BitShares light-client wallet database | BitShares 2 light client / wallet.bitshares.org | Master list — BitShares row (John the Ripper, bitshares2john) |
| Tezos ICO / fundraiser credentials — 15-word mnemonic, fundraiser email and tz1 address | Tezos ICO / fundraiser wallet | Master list — Tezos row (John the Ripper, tezos2john — the ICO/fundraiser route, not a generic Tezos client key extractor) |
Something else (.sqlite, app-specific) |
Depends on the app — check its documentation | Ask the FAQ, or find it in the master list. |
Where wallet files live
If you have not found the file yet, these are the default locations — always search copies and old devices too:
wallet.dat format. Check both legacy and current Windows locations — Bitcoin: %APPDATA%\Bitcoin\ and %LOCALAPPDATA%\Bitcoin\ (the current default), with wallets in <datadir>\wallets\ or, on older/single-wallet setups, directly in the data directory. Litecoin: ~/.litecoin/, Dogecoin: ~/.dogecoin/, and so on — the data directory may differ by version or a custom datadir.~/.electrum/ or %APPDATA%\Electrum\ — with files like default_wallet.UTC--*.json in the keystore folder — ~/.ethereum/keystore/ or %APPDATA%\Ethereum\keystore\.6P… string is printed on the paper itself. If you only have a photo, the key is still recoverable from the photo. Preserve the original securely until the 6P… string has been independently verified — and ideally successfully decrypted. If the photo is cloud-synced, remove the synced copy only after creating a verified offline backup. Never destroy the only accurate copy before verification.Can’t find the file? Run the 30-minute sweep for backups, and read protect your wallet files before you touch anything.
Identify by app name
- Bitcoin Core / Bitcoin-Qt → wallet.dat
- Litecoin Core, Dogecoin Core, Bitcoin Cash (BCH), Dash → the same
wallet.datformat — fork wallets guide - Electrum → Electrum keystore
- geth, MyCrypto, MyEtherWallet, Mist → Ethereum keystore
- MetaMask, Trust Wallet, Exodus, Coinbase Wallet, Phantom, Atomic → seed-phrase based, not a password-file — but identify the exact wallet model first, because several apps now mix models. MetaMask wallets created with Google, Apple or Telegram login use a different recovery model; Trust Wallet SWIFT wallets use a passkey tied to your Apple/Google environment instead of a 12-word phrase; Coinbase Smart Wallet / Base wallet is passkey-based (a recovery phrase exists only if you set one) — and note that the classic Coinbase Wallet is being retired in favor of the Base App: the recovery phrase and addresses remain, but some classic-wallet networks are not supported in the Base App, so for those assets follow Coinbase’s current official guidance and use a wallet that supports the network; Phantom wallets created with Google or Apple recover via that account plus your PIN, with the phrase only exportable while you still have access. Accounts imported from a private key or JSON are not restored by the phrase. See the seed phrase passphrase and what did you lose?
- A paper wallet printed with a
6Pkey → BIP38
What about a wallet that isn’t listed?
There are hundreds of wallet apps, but only three security models — and yours fits one of them:
.keys, Armory — the file holds your keys, and the password unlocks it. Recovery is a technical problem with a real answer: sometimes yes, often no.Why the exact format matters
Low-round wallet.dat files test hundreds of guesses per second on a CPU (thousands with a GPU); Ethereum scrypt keystores test around a hundred. “It’s a Bitcoin wallet” is not enough — the rounds count also matters (machine-tuned when the wallet was encrypted; reference wallets range ~68k–267k, floor 25k). The speed table is in is recovery technically possible?
Still unsure?
Write down the file name, the extension and the app you remember — that is already most of the answer. Run the diagnosis for a first verdict, check the FAQ and the glossary for follow-ups, and for a one-glance verdict across every wallet — reset, crackable offline, or impossible — see the master list of recoverable wallet passwords.
Keep going — it’s all free
Not sure what you lost or what’s possible?
Take the quick diagnosis for a first verdict — it stops early when the answer is already clear — then work the search checklist. Everything here is informative, runs offline, and is free to use.