How I Recover a Forgotten Bitcoin Core wallet.dat Password

If you can open Bitcoin Core but it rejects your passphrase, or you have an old wallet.dat file and no longer remember the password that encrypted it, the situation is usually better than it feels. A forgotten passphrase is not a lost wallet. As long as you still have the wallet file, the private keys are inside it. They are encrypted, but they are there, and the job is to find the passphrase that unlocks them.

This is a different problem from the two that people often confuse it with. If your wallet.dat is deleted, corrupt, or will not load at all, start with how to recover a corrupt or deleted Bitcoin Core wallet instead. If the wallet opens fine but shows no balance, that is an address or derivation problem, not a password problem, and the corrupt-wallet guide covers the "restored but no balance" case as well. This article is specifically about the case where the file is intact and the only missing piece is the passphrase.

Before anything else, two safety rules. Do not upload your wallet.dat to any website that offers to "decrypt" or "recover" it for you, and do not hand the file or your password clues to anyone who contacted you first. An intact encrypted wallet is worth exactly as much as the coins inside it, and uploading it is how a recoverable wallet becomes a stolen one. If you are deciding who to trust, read how to tell a legitimate recovery service from a scam first.

How Bitcoin Core encryption actually works

Bitcoin Core added wallet encryption in version 0.4.0 in 2011, and the design has stayed essentially the same since. Understanding it tells you exactly what a password search is testing and why some wallets crack in minutes while others never will.

When you set a passphrase, Bitcoin Core does not encrypt each private key with your password directly. Instead it generates a single random master key, encrypts every private key in the wallet with that master key using AES-256-CBC, and then encrypts the master key itself with a key derived from your passphrase. That encrypted master key record is stored in the wallet as mkey. (You can read the mechanism in Bitcoin Core's crypter.cpp and the CMasterKey structure in crypter.h.)

Two consequences follow, and both matter for recovery:

• A password search only has to crack the master key, not every private key. One correct passphrase unlocks the whole wallet at once. This is why a wallet with a thousand addresses is no harder to crack than a wallet with one.
• The key-derivation cost is baked into your specific wallet, not fixed by the software. When you first encrypted the wallet, Bitcoin Core benchmarked your machine and chose an iteration count (nDeriveIterations) so that deriving the key takes roughly a tenth of a second on that computer. A fast 2013 desktop produced a much higher iteration count than a slow laptop. The derivation uses repeated SHA-512 rounds over your passphrase and a per-wallet salt.

This is the key difference from a Blockchain.info wallet, whose modern format uses a fixed 5,000 PBKDF2 iterations. A wallet.dat iteration count is whatever your old machine settled on, commonly in the tens or hundreds of thousands. It is stored in the file, so a recovery tool reads it rather than guessing, but it does set how many candidate passwords per second are possible: the higher the count, the slower each guess.

Step 1: preserve the file

Copy the original wallet.dat to a safe location and work only on copies. Never run recovery tooling against your one and only wallet file. If Bitcoin Core is running, close it first so nothing is writing to the file. On a default install the wallet lives at %APPDATA%\Bitcoin\wallet.dat on Windows, ~/Library/Application Support/Bitcoin/wallet.dat on macOS, or ~/.bitcoin/wallet.dat on Linux, and inside a wallets/ subfolder on newer versions.

One structural note: legacy encrypted wallets are Berkeley DB files, and that is what the extraction tools below expect. Very new descriptor wallets created in Bitcoin Core 0.21 or later can be SQLite instead; if you created the wallet years ago, it is almost certainly the Berkeley DB kind, which is the case these tools handle.

Step 2: extract the hash

You do not feed wallet.dat to a cracker directly. You first extract a single compact string that represents the encrypted master key and its derivation parameters. The standard tool is bitcoin2john.py, which ships with the "jumbo" build of John the Ripper. It reads the Berkeley DB, finds the mkey record, and prints a line that starts with $bitcoin$:

python3 bitcoin2john.py wallet.dat > hash.txt

That $bitcoin$... string contains the encrypted master key, the salt, and the iteration count. It contains no private keys and no coins, which makes it far safer to handle than the wallet file itself, but treat it as sensitive anyway: anyone who cracks it and gets your file has your wallet.

Step 3: run the search

There are two good tools, and which one fits depends on how much you remember.

hashcat, when you want raw speed and can describe your passwords with rules or masks. Bitcoin Core's wallet.dat is hash-mode 11300 ("Bitcoin/Litecoin wallet.dat"):

hashcat -m 11300 -a 0 hash.txt wordlist.txt -r rules/best64.rule

Here -a 0 is a dictionary attack, wordlist.txt is your candidate list, and the rule file mutates each word (capitalization, appended digits, common substitutions). For a password you remember the rough shape of, a targeted mask attack (-a 3) is often better than any wordlist.

John the Ripper, using the same extracted hash:

john --format=bitcoin hash.txt

btcrecover, when the strength of your case is memory rather than a wordlist. btcrecover reads wallet.dat natively and is built around a token list: you give it the fragments you remember (base words, a favorite number, an approximate year, capitalization habits) and it combines and mutates them. This is the same craft described in the Blockchain.info brute-force guide, and for a real person's forgotten password it usually beats a generic dictionary by a wide margin.

What actually determines your odds

People assume password recovery is a hardware problem, that a faster GPU is the answer. It almost never is. It is a search-space problem.

The number of possible passwords grows exponentially with length and character variety. A genuinely random 12-character password with mixed case, digits, and symbols is beyond any hardware and always will be. What makes real wallets recoverable is that almost nobody memorizes a truly random password. They use structure: a base word or phrase, a capital at the front, a number or a year at the end, a symbol they favor, a small variation on a password they used elsewhere.

The whole craft is turning what you remember into a token list, so the correct password sits inside the set actually being tested. Get that right and a search that would take millennia by blind brute force finishes in hours. Get it wrong and infinite hardware will not help, because the answer was never in the set.

So the factors that decide the outcome, in order:

1. How much you remember. Fragments, approximate length, "it was probably one of these three base words," a rough year. This is worth more than any graphics card. If you genuinely remember nothing and the password was long and random, be honest with yourself: that one may not be recoverable.
2. The wallet's iteration count, which sets how many candidates per second are possible. You do not control this, and a very high count on a weak set of clues is the hard combination.
3. Hardware, which matters least and only scales a search that is already well defined.

That ordering is why, when I take a case, my intake questions are all about what you remember, not about your equipment.

When to bring it to me

If you have the wallet file and a real memory of your old password habits, this is often a case worth attempting, and it is one I take on a recover-first basis through the forgotten wallet password recovery service. What I do that a wordlist cannot is design the token list and the mutation rules around your specific recollection, run it on hardware suited to the wallet's iteration count, and tell you honestly when a case is not viable rather than billing you to search a space the password was never in.

If you would like an assessment, describe what you have and what you remember through the free assessment form. Bring the encrypted wallet file (kept safe, never uploaded to a stranger), the wallet software and rough era it came from, and an honest description of how you tended to build passwords at the time. For the related cases, see Bitcoin Core wallet recovery for a damaged or deleted file, and forgotten wallet password recovery for password cases across other wallet types.