Bitcoin Forum

what is grep command in Linux to find hex private key in my .txt file? i saved it somewhere on a backup drive, im not talking about WIF privatekey

please help!

Not an expert but I think this will work:

grep -E '[a-fA-F0-9]{64,64}[^a-fA-F0-9]' <file>

thanks a lot, will give it a try and let you know, i tried googling this first only came up for WIF not hex private keys

grep -E -o '[1234567890abcdefABCDEF]{64}' also does the job and using the -o option, only prints the part of the line that actually matches the private key. This avoids printing extremely large lines or perhaps an entire binary file that happens to have a matching string.

You should probably redirect the output to a file because most terminals' output buffers are fairly small, only holding he last 1000 or so lines of output.

@NotATether
I don't understand, every private key is Hex type but they showed with A-Z 0-9 characters !?
How about finding a public or private key in wallet files (specially those are not encrypted) dose this technic works on them?

If you are seeing characters from G - Z, then it is NOT hex.  Hex generally only uses numeric digits (0-9) and the first 6 characters of the alphabet in either capital or lowercase form  (A - F and a - f).

Additionally, you only want to use grep if the key is stored as UTF-8 encoded string of characters representing the key in a human-readable format.


That depends on the file and which wallet software it came from.  Many wallets store the key in binary format rather than an encoded string.  In that case, using grep will be more complicated and messy and probably isn't the best tool for the job.

Right private keys are Hex but why there is  K, w, y and .... in private key ? Aha, they turn 128bit binary to hex then find it's related Characters ! and show set of characters !!

If you see a private key with those kind of characters then that is not a hexadecimal formatted key, it is a WIF private key encoded in Base58 (or if it begins with "bc1", bech32).

This regex should find Base58 keys:



Additionally, the following regex will find bech32 private keys addresses:

BIP173 said that addresses can be up to 90 characters long, including the human readable part and separator. The data part after bc1 is at least 6 characters long, and 90 when the length of bc1 is taken out is 87.

Granted, I haven't seen Bech32 addresses that small in practice, because the hash160 has a fixed length.

Cripes, I must've posted the regex for bech32 address instead  :-[ there is no such thing as a Bech32 WIF private key.