Ideas for remembering your forgotten Bitcoin password

People assume that recovering a wallet password is a brute-force problem, and that the answer depends on how much hardware you can point at it. It mostly does not. A modern GPU rig can try an enormous number of candidates, and that enormous number is still a rounding error against the space of all possible passwords. What decides these cases is how well the search is aimed.

So the useful work is not buying more hardware. It is remembering more. This article is about how to do that systematically, because "I do not remember it" is almost never literally true. What people mean is that they cannot produce the password on demand, which is a very different thing from having no information about it.

Think in fragments, not in passwords

Here is the mental shift that matters most.

You do not need to recall the password. You need to produce the ingredients. A recovery search takes a set of fragments, patterns, and rules and generates the combinations from them. If the true password is Tr0ub4dor&2013 and you can tell me that you used a musical word, that you replaced o with 0 and a with 4, that you often ended with an ampersand and a year, then the search that finds it is small. Being 90 percent sure of five separate things beats being 100 percent sure of nothing.

So keep a running text file, and put things in it even when you are unsure. Nothing gets discarded at this stage. Wrong guesses cost almost nothing; a forgotten true fragment costs the wallet.

Mine your own habits from that era

Passwords are not chosen freshly each time. People have a scheme, and the scheme changes slowly. Reconstruct the scheme you were using in the year the wallet was created.

• What were your other passwords then? Go find them. Old accounts you no longer use, forum logins, an old router, an old Wi-Fi key. You are not looking for the wallet password itself; you are looking for the shape: length, capitalisation, where the digits go, which punctuation you reach for.
• What was your base word? Most people have a small pool: a pet, a band, a childhood street, a game character, a nickname. List every one you were using at the time, including the ones you are embarrassed by.
• What was your decoration? A trailing !, a trailing year, a leading capital, doubled letters, a 123, leetspeak substitutions. Write down the rules, not just the examples.
• How long were your passwords then? If everything else you used in 2013 was eight to ten characters, the search does not need to look at twenty-character candidates.
• Were you being unusually careful? People often used a longer, more random password specifically because it was for Bitcoin. If you remember making a deliberate exception, say so, because that changes the search entirely.

Reconstruct the moment

Memory is context-dependent. You will recall more by rebuilding the scene than by staring at a prompt.

Where were you living? Which computer was it, which operating system, which keyboard? What were you into that month, what were you listening to, what was in the news? Which exchange had you just bought from? Was anyone else in the room, and did you tell them anything about it?

Two specifics that come up repeatedly and are easy to overlook:

Keyboard layout. If you were on a non-US layout, or switched layouts around then, the characters you typed may not be the characters you think you typed. z and y swap on a German keyboard, punctuation moves everywhere, and a password typed on one layout and retyped on another silently becomes a different password.

Language. A word in your first language, transliterated, is extremely common and almost never mentioned unprompted.

Search the machines, not just your head

A large share of solved password cases are solved by finding something written down, not by remembering it. Before you spend a week on recall, spend a day on archaeology.

• Browser password stores. Chrome, Firefox, Safari, and Edge profiles from that era, including on old laptops and old profile backups. Even if the wallet password is not in there, everything else you used at the time is, and that gives you the scheme.
• Operating-system keychains. macOS Keychain, Windows Credential Manager, GNOME Keyring.
• Password managers. Old KeePass .kdbx files, 1Password and LastPass exports, even ones you abandoned. An abandoned vault is still a snapshot of your habits.
• Plain text files. Search old drives and backups for files named like pass, pw, notes, crypto, btc, wallet, and for .txt, .rtf, .docx files last modified around the relevant date. Sorting an old drive by modification date around the wallet's creation date is often more productive than searching by name.
• Notes apps and email. Apple Notes, Evernote, OneNote, and above all emails you sent to yourself. Search your own sent mail for the wallet's address, the exchange name, or the word "wallet" around that date.
• Phone backups. iTunes and iCloud backups, Android backups, and old screenshots. People screenshot things they intend to write down properly later.
• Physical places. Notebooks, the inside cover of a book, a filing cabinet, a safe deposit box, the back of a printed photo, a card in a wallet. Ask your partner or family whether you gave them anything to hold.

Let your hands remember

Muscle memory outlasts recall. If you typed a password hundreds of times, your fingers may still know it even when you cannot say it.

Open a text editor and type, fast, without deliberating, the way you would have typed it into the wallet. Do it a dozen times. Do not correct yourself. Then look at what came out. This produces real results surprisingly often, and it also produces near-misses that reveal the pattern.

The same trick works with the near-misses themselves. If you keep almost-typing the same six characters, those six characters are probably real, and everything around them is the part in doubt.

Do not burn your attempts

Two hard warnings before you start trying things.

Hardware wallets count wrong guesses and eventually wipe. A Trezor erases itself after a fixed number of incorrect PIN entries, and each wrong entry also imposes an increasing delay by design. If your problem is a hardware wallet PIN rather than a software wallet password, guessing at the device is not a free action, and running out of attempts destroys the only copy of the key you have. Stop, and read about Trezor recovery and repair before you try again.

Log every attempt. Whatever you try, write it down in the same file. Otherwise you will spend day three re-trying day one's candidates, and worse, you will lose track of which variations you have genuinely ruled out. A recovery search built on top of an unlogged guessing spree wastes time re-covering ground.

Software wallet files are different in one important respect: a copy of an encrypted wallet.dat or keystore can be tested offline, as many times as you like, without touching the original or the network. Which is exactly why the first step is always making copies and working only from those.

Turning fragments into a search

Once you have the file, the fragments become a structured search: token lists combined under rules, with the substitutions, capitalisations, prefixes, suffixes, and typo variants you described, tested against the encrypted wallet on a GPU. Open-source tooling exists for this and is worth knowing about even if you never run it yourself, and there is a survey of it in the wallet and key recovery tools guide.

The part that cannot be automated is the part you supply. A well-aimed search of a few billion candidates finds passwords that an unaimed search of a trillion never will.

When to hand it over

If you have a wallet file and a page of honest fragments, you have a real case. If you have a wallet file and nothing at all, the odds are poor and you should be suspicious of anyone who tells you otherwise before looking.

That distinction is the whole assessment, and it is free. I will tell you which of those two you are in, and the fee only applies if the recovery actually succeeds. The specifics of what I can work with are on the forgotten wallet password recovery page.

Before you get in touch, go and write the file. It is the single highest-value hour you can spend on your own case.