There is no single program that recovers a crypto wallet. There is a small set of well-understood open-source tools, each of which solves one narrow part of the problem, and the actual skill is diagnosing which part you have before you pick one.
This is a survey of the tools that do real work, written for someone who wants to understand their own situation. Everything listed here is free and open source, or free and runs in your browser. Nothing on this page requires paying anyone, including me.
Read the safety section at the bottom before you download anything. The market for fake recovery tools is much larger than the market for real ones.
Start by identifying what you actually have
Locked out of a wallet like this one?
I repair hardware wallets, crack forgotten passwords, and rebuild broken seed phrases — on my own bench in Denver.
Half the recovery attempts I see fail because the owner was running the right tool against the wrong file format. A 2012 Bitcoin-Qt wallet.dat and a 2023 descriptor wallet are both called wallet.dat and share almost nothing internally. An Electrum file and a MetaMask vault are both JSON and are not interchangeable.
Our free Wallet File Inspector exists for exactly this. It identifies what a wallet file is, and for Bitcoin Core it reports whether the file is encrypted, whether it is readable or damaged, how many keys it holds, and which addresses are in it. It runs entirely in your browser, uploads nothing, and never displays private keys. There is an offline copy and the source is published on GitHub.
Answer three questions before going further: which software created this, is it encrypted, and is the file intact.
Tools for a forgotten password
btcrecover
The main open-source password-recovery tool for cryptocurrency wallets. Originally written by Christopher Gurnee and now maintained as an actively developed community fork, it is a Python program that supports a long list of wallet formats: Bitcoin Core, Electrum, MultiBit, Armory, Blockchain.com, MetaMask, Dogecoin, Litecoin, and more.
What makes it the right tool is not raw speed but its token-file system. You describe the structure of what you half-remember, and it generates the candidates: token lists, positional rules, typos, capitalisation variants, leetspeak substitutions, prefixes and suffixes. This is the machinery that turns "a band name, a capital, and probably a year on the end" into a finite search. If you have been building the fragment list described in ideas for remembering your forgotten Bitcoin password, a btcrecover token file is what that list turns into.
It also handles the case where you know your password but the wallet rejects it, which is more often a typo or an encoding problem than an actual mystery.
hashcat, with a hash extracted from the wallet
Where btcrecover is flexible, hashcat is fast. It is a GPU password cracker that does not understand wallet files at all, so the workflow is two-stage: extract a hash from the wallet, then attack the hash.
For Bitcoin Core, the extractor is bitcoin2john.py, which ships with the jumbo build of John the Ripper. It reads a wallet.dat and prints a $bitcoin$... hash string. Hashcat then attacks that hash in mode 11300. Equivalent extractors exist in the same John the Ripper collection for Electrum, Ethereum keystores, MetaMask, and various others, each with its own hashcat mode.
The tradeoff is worth understanding. Hashcat's throughput is far higher, but expressing a nuanced, rule-driven guess is harder than in btcrecover, and Bitcoin Core's key derivation is deliberately slow, which caps how much the speed advantage buys you. In practice serious cases use both: btcrecover to explore hypotheses about the password's shape, hashcat to grind the promising ones at scale.
A note on the extractors: bitcoin2john.py pulls the encrypted master key out of the file. That is not the same as pulling out your coins, but it is still sensitive material, so treat the hash file like the wallet itself.
Tools for a damaged or missing seed phrase
The seed phrase checker
For the single most common seed problem, one word that is wrong or misread, our free Seed Phrase Checker validates a BIP-39 phrase, identifies which word breaks the checksum, and suggests the correction. It runs in the browser with nothing sent anywhere, and there is an offline build.
Use the offline build for any phrase that guards real money. That is not a formality; see the safety section.
seedrecover, part of btcrecover
For harder seed cases, btcrecover ships a companion tool for BIP-39 and Electrum seeds. It handles missing words, wrong words, transposed words, unknown derivation paths, and passphrase searches, and it validates candidates against an address you know belongs to the wallet.
That last part is the important design detail. Without a known address, a search cannot tell a correct reconstruction from a valid-but-different wallet, because every checksum-valid phrase produces a real wallet. If you have any address or extended public key from the original wallet, dig it out; it converts a guess into a test.
The BIP-39 tool, offline only
Ian Coleman's BIP-39 tool is a single HTML page that converts between phrases, seeds, extended keys, and derived addresses across dozens of derivation paths. It is invaluable for diagnosing the restored-but-empty wallet problem, where the phrase is correct and only the derivation path is wrong.
It is also the tool most often impersonated by malicious clones. Download the release from the project's own repository, disconnect the network, and open the local file. Never use a hosted copy at some other domain with a real phrase.
Tools for a corrupt, deleted, or obsolete wallet file
Bitcoin Core's own salvage tooling
Before reaching for anything exotic, try Bitcoin Core itself. It ships a standalone bitcoin-wallet utility whose salvage command attempts to pull keys out of a damaged Berkeley DB wallet, alongside info, dump, and createfromdump for inspecting a wallet and rebuilding one from its raw records. Older releases exposed the same idea as a -salvagewallet startup flag instead.
One thing to know before you download: salvage has been removed from Bitcoin Core's development branch along with legacy Berkeley DB wallet support. It is present in the v29 releases and earlier. If you are working on a pre-descriptor wallet.dat, the newest build is not necessarily the one you want, and an older release may be the only one that will still touch your file at all.
Work on a copy either way. Salvage rewrites the file, and Bitcoin Core will also rewrite a wallet.dat simply by opening it, which is one of the classic ways people destroy the evidence while investigating.
pywallet
An older Python utility that reads Bitcoin Core wallet files directly and can dump the keys inside. Its more interesting mode scans a raw disk image for key material, which makes it useful when the file itself is gone but its blocks may still be on the drive.
It is old code and fussy about environments, but for pre-2014 wallet formats it sometimes reads what nothing else will.
PhotoRec and TestDisk
When the wallet file was deleted, the problem stops being a wallet problem and becomes a data-recovery problem. TestDisk repairs partitions and recovers lost filesystems; PhotoRec ignores the filesystem entirely and carves recognisable file structures out of raw sectors. Both are free and open source from CGSecurity.
Two hard constraints. First, run them against a disk image, not the live drive, and never install them onto the drive you are trying to recover from. Second, understand your storage: on a spinning hard drive a deleted file can survive for years, while on an SSD, TRIM typically erases the blocks within minutes of the delete. That is why deleted wallet file recovery is a genuinely different conversation depending on the hardware.
The original wallet software
Underrated and frequently the whole answer. Old MultiBit Classic and MultiBit HD wallets, early Electrum files, Armory databases, and other abandoned formats often open perfectly well in a period-appropriate build of the software that made them, running in a virtual machine with no network access. From there you export the keys and import them somewhere modern. Our MultiBit recovery and Electrum recovery pages cover the specifics for those two.
How to tell a real recovery tool from a seed stealer
This category of software is heavily targeted by criminals, because the victims arrive pre-selected: they are desperate, they hold crypto, and they are actively looking for something to paste a seed phrase into.
The rules are simple and they do not have exceptions.
A real tool never needs your seed phrase sent anywhere. If a website, browser extension, or app asks you to enter a recovery phrase or private key into a form that transmits it, it is stealing it. There is no legitimate version of this. Not for "validation", not for "checking your balance", not for "syncing".
Get it from the project's own repository. Not from a search ad, not from a link in a Telegram or Discord message, not from a YouTube description, not from a forum post by a helpful stranger. Search results and app stores routinely carry cloned versions with one function quietly modified.
Prefer open source, and prefer running it offline. The point of open source here is not that you will read the code. It is that many other people can, and that a backdoor in a widely used public repository does not survive long. Running with the network disconnected means that even a compromised copy has nowhere to send anything.
Nobody legitimate contacts you first. Unsolicited offers of recovery help, tools, or software are the leading edge of the recovery scam industry. I never message anyone unprompted, and our scam warning page explains how to verify that a message is genuinely from me. If you want a second opinion on a service that has approached you, the recovery scam checker scores it against the red flags.
When tools stop being the answer
Tools handle well-defined problems: a known format, a known kind of damage, a search you can specify. They stop helping when the diagnosis itself is uncertain, when several kinds of damage are stacked, when the search needs to be designed rather than configured, or when the wallet is physically broken and the problem is a soldering iron rather than a GPU.
At that point the free assessment is the cheapest next step, because the useful output is a straight answer about whether your case is winnable. There is no upfront fee, and if it is not winnable you will be told that rather than sold a subscription.