Yes. There are real services that recover forgotten wallet passwords, and the way they work is less mysterious than the marketing suggests. They take an encrypted wallet file, combine it with everything you remember about the password, and run a targeted search offline until one candidate opens it. That is the whole trick. It works when you have the file and some usable memory of the password, and it does not work when you have neither.
This page answers the question straight: what a legitimate service does, what you need to bring, whether you should just do it yourself, and how to tell a real service from the ones that prey on people in your position.
What a legitimate service actually does
Locked out of a wallet like this one?
I repair hardware wallets, crack forgotten passwords, and rebuild broken seed phrases — on my own bench in Denver.
A forgotten-password recovery has three parts.
- You provide the encrypted wallet. A Bitcoin Core
wallet.dat, an Electrum file, a MultiBit backup, a Blockchain.comwallet.aes.json, or a similar file. The password protects the file, and the file is what gets attacked. For many wallet types the service can extract a password hash from the file and work from that, so the file itself does not need to travel. - You provide the clues. Words you used, capitalization habits, number patterns, the year, common substitutions, approximate length. A good service turns these into a candidate generator, not a blind guess list.
- The search runs offline on GPUs. Each candidate is tested against the encryption, and the result is confirmed against a known receiving address so nobody is relying on hope.
The odds depend on how much you remember. A password you built from a few words and a number is a tractable search. A truly random password of ten or more characters is out of reach for everyone, including every service that claims otherwise. The honest version of the odds is in the recovery odds by scenario article, and the technical walkthrough of how a search is built is in how I recover a forgotten Bitcoin Core wallet password.
What you need before anyone can help
| What you have | Can a service help? |
|---|---|
| The encrypted wallet file and some memory of the password | Yes. This is the case services are built for. |
| The wallet file and no memory of the password at all | Rarely. With nothing to narrow the search, only a short password falls. |
| Only a Bitcoin address or a transaction ID | No. There is nothing to attack. |
| Coins already sent to someone else | No. A confirmed transaction cannot be reversed. |
| An exchange account you cannot log into | No. Use the exchange's own support process. |
If you are not sure the file you have is a real, intact wallet, the free wallet file inspector tells you in your browser, with nothing uploaded.
Should you try it yourself first?
If you are technical, probably yes, and a good service will tell you the same. Two free, open-source tools do the core job on your own computer:
- btcrecover builds password searches from token lists and typo rules, and supports Bitcoin Core, Electrum, MultiBit and Blockchain.com wallets, among others.
- Hashcat is the general-purpose GPU password cracker. A helper script extracts the hash from a wallet file, and Hashcat has modes for the common wallet formats.
Doing it yourself costs nothing and keeps the wallet on your machine. Before you start, copy the wallet file and work only on the copy. If your password was something like a pet's name plus a year, expect a quick result.
Hire a service when the situation is harder than a standard tool run:
- Your clues are fuzzy or numerous and the search needs to be designed, not just run.
- The search space is big enough to need serious GPU time.
- The wallet is an older or damaged format that the standard tools do not read cleanly.
- You tried and ran out of road, and you would rather pay a percentage than keep tuning.
Hiring someone for a case you could have solved with a free tool in an evening is not a tragedy, but it is a 15% to 20% fee, so try the cheap route first if you can.
How to tell a legitimate service from a scam
This is where the industry gets dangerous. People who have lost access to coins are exactly who recovery scammers look for. Five checks separate the two.
- They never contacted you first. Real services are found by the client. A "recovery agent" who messaged you on Telegram, replied to your Reddit post, or emailed you unprompted is an impersonator, whatever name they use.
- Nothing upfront. The fee is a percentage of what is recovered, due only on success. A deposit, a "gas fee," a "release fee," or a software purchase before results is the signature of the scam.
- A named operator and a registered legal entity. A person you can look up and a company you could sue, with the registration verifiable in a government registry.
- A written contract before anything changes hands. Scope, fee, and what happens to your material afterwards.
- A plain statement of what they will not do. A real service says it cannot recover stolen funds or open exchange accounts. A page that promises everything is promising nothing.
The legit-or-scam article goes through the disqualifiers in depth, and the free Recovery Scam Checker scores any service against the same questions.
The real risk: whoever cracks it can spend it
Handing over an encrypted wallet file is not the same as handing over your seed. The file is encrypted, so by itself it opens nothing. But if the service finds the password, they now hold everything needed to move your coins. A recovery provider is therefore trusted with the funds, at least briefly, and the criteria above exist to make that trust reasonable.
Two practical protections beyond choosing well. Ask whether the service can work from a password hash rather than the full file, which keeps the wallet with you for supported formats. And ask how the file travels and what happens to it when the job closes. The wallet file handling FAQ describes what to expect on both.
What it costs
Among the named services that publish a figure, the fee is 15% to 20% of the recovered amount, charged only if the recovery works. The comparison of named services lays out each one's fee, entity, and contract, sourced from their own sites with check dates, and it includes this service.
Where I fit
I am David Veksler. I run WalletRecovery.info through Veksler Consulting LLC in Denver, Colorado (registry ID 20218030311), and I have done this work since 2017. The fee is 15% of the recovered amount under 100 BTC and 10% above, due only on success. The assessment is free, the terms are in a written contract, and my messages are signed with a published PGP key. I never contact anyone first, so if someone claims to be me and reaches out, check the scam warning page before replying.
For a forgotten password specifically, the forgotten wallet password page lists the cases I take and what makes one viable. If you would rather try the DIY route first, the steps above are the right ones, and the ideas for remembering a forgotten password article will help you build the clue list either way.
If you have the wallet file and want an honest read on whether it is worth a search, start with a free assessment.