Algorithm for guessing Bitcoin wallet password

[Andrey123]

Hi all!

I found my old flash drive and it turns out I have a couple of coins!
But I don’t remember the password at all, and I can’t install Bitcoin Core with all transactions, since it weighs a lot

What can you use to start password recovery?
Is the Electrum wallet suitable?
Do you need a video card or just a regular laptop will do?

I can't find information on this issue((
Or some paid programs come out and maybe they contain viruses, or just articles on how to protect yourself from the theft of coins.

[Charles-Tim]

Use https://github.com/3rdIteration/btcrecover for the password recovery.

Readthedocs: https://btcrecover.readthedocs.io/en/latest/.


Or use https://github.com/Coding-Enthusiast/FinderOuter

[Andrey123]

Thank you.
That is, do I understand correctly, the more powerful the device on which I run the program, the faster the selection speed will be?

Maybe there is some kind of performance table?
There are a lot of video cards now.

[Charles-Tim]

That is, do I understand correctly, the more powerful the device on which I run the program, the faster the selection speed will be?

The more powerful the device processor, the faster it will be.

Maybe there is some kind of performance table?

If it is just 3 characters that are missing, it will take just few minutes to get the missing words. If it is becoming longer, it will becoming more difficult to brute force.

I do not know of any table about this. Also that devices have different processors.

[ABCbits]

I found my old flash drive and it turns out I have a couple of coins!
But I don’t remember the password at all, and I can’t install Bitcoin Core with all transactions, since it weighs a lot

FYI, you can install Bitcoin Core without downloading blockchain by clicking network icon on bottom right of the GUI application. That way, you can find out list of address and list of transaction (which may be not up to date).

Do you need a video card or just a regular laptop will do?

You can use regular laptop. But video card or GPU let you brute force much faster[1].

[1] https://btcrecover.readthedocs.io/en/latest/GPU_Acceleration

[Andrey123]

I can't run btcrecover, the instructions indicate an old version of Python.

I installed the latest one and the commands don't work.
Then version 2.7.1 and nothing works either.

[SilverCryptoBullet]

Or use https://github.com/Coding-Enthusiast/FinderOuter

It is to find missing words in wallet seed, not to brute force wallet password if I understand the guide of FinderOuter software correctly.
Video on bruteforce passwords. The more characters in the password you remember, higher chance to bruteforce it successfully.
https://www.youtube.com/watch?v=rMtW8vIHHek

[BitMaxz]

I can't run btcrecover, the instructions indicate an old version of Python.

I installed the latest one and the commands don't work.
Then version 2.7.1 and nothing works either.

BTCrecovery tool does not work on the latest version of Python you need to downgrade its version to the recommended version which is 2.7.

Make sure to follow the instructions provided from this link below for Windows users if the 2.7 does not work try the other version mentioned in the guide below.

- https://btcrecover.readthedocs.io/en/latest/INSTALL/

[nc50lc]

But I don’t remember the password at all, -snip-

Even the latest GPU and CPU wont help in that case.
BTCRecover or other wallet password bruteforce tool will only work if the search-space is relatively low.
In other words, you need to provide a good portion of your correct password and BTCRecover will bruteforce the rest.

If it has to bruteforce an 8-character password or missing 8 characters numeral-by-numeral (letters - both case, numbers & common symbols),
that would be 68^8 which is extremely high, even for a multi-GPU rig; there's even more if you count all ASCII printable characters.
And that's only for 8characters, if you do not know how long your password is, the tool will have to search from lower to higher number of possible permutations.

I can't run btcrecover, the instructions indicate an old version of Python.

I'm using 3rdIteration's BTCRecover on Python 3.10.

[ABCbits]

I can't run btcrecover, the instructions indicate an old version of Python.

I installed the latest one and the commands don't work.
Then version 2.7.1 and nothing works either.

You tried the old btcrecover by gurnec, https://github.com/gurnec/btcrecover. But these days we refer to btcrecover by 3rdIteration which use Python 3, https://github.com/3rdIteration/btcrecover. This btcrecover have more feature and better documentation, so usually there's no good reason to use the older one.

Or use https://github.com/Coding-Enthusiast/FinderOuter

It is to find missing words in wallet seed, not to brute force wallet password if I understand the guide of FinderOuter software correctly.

You're right, assuming OP talk about brute-forcing wallet.dat which generated by Bitcoin Core.

[Andrey123]

I can't figure out the instructions on what and how to run(

I seem to remember some of the symbols, I’m looking for a device to install Ubuntu and run it there.

[nc50lc]

I can't figure out the instructions on what and how to run

There are already well-detailed youtube videos of installation for each Operating Systems in their documentary page.
If you come across an error, you can always ask here for a possible fix or workaround but you must indicate the specs and OS of the machine you're working on.

I seem to remember some of the symbols,

"Seem" doesn't look promising since it has to be as accurate as possible.
You must also know the number of characters, how many are missing and uncertain.
This is so you can get a heads-up if it's possible or not before committing to purchase GPU/PC and set everything up.

About the actual bruteforce, your token file must be created specifically for your case.
The positions of the known characters and possible characters must be indicated accurately and in a way that it'll create as little search space as possible.
Refer to this doc: btcrecover.readthedocs.io/en/latest/tokenlist_file/

If you can't create a token file yourself, you must provide an example of the situation in full-detail so we can make it for you (change the characters in the example)
But it must be as accurate as possible or the token file will be just a waste of time and resources.

BTW, BTCRecover's GPU support is still experimental so you might not get the performance boost that you're expecting with a GPU.

--enable-gpu          enable experimental OpenCL-based GPU acceleration (only supports Bitcoin Core wallets and extracts)

[NotATether]

Have you actually put together a regular expression for all of the possibilities that your password could be?

The reason why this is so important is because BTCrecover requires you to specify such a regex when you run it.

[Doth4t]

I have this same problem, although with litecoin..

But i remember i changed my password because it was to easy.  May there be a way i can recover the old wallet file, with the old easy password? Like when you delete a file you can reproduce it, is the same posssible when i change  password for a wallet.dat file ? (And yes i still have the original HDD where it was)


Thnx for your replies! i have about 15K USD there, so would be nice to get it open

[nc50lc]

-snip- May there be a way i can recover the old wallet file, with the old easy password? Like when you delete a file you can reproduce it, is the same posssible when i change  password for a wallet.dat file ? (And yes i still have the original HDD where it was)

Usually, HDDs keep the old data on a can-be-overwritten state rather than "zero-filled",
I'm not sure on litecoin specifics but theoretically, it may still be available for recovery if it's not overwritten by the new data and any other data that's being written on the disk.

But that's a job for professional data recovery service/tool rather than password-recovery tools that's being discussed here.

Doing the data recovery yourself may even worsen the chance of recovering a copy of your old wallet.dat file.
If you have to do it yourself with tools like pywallet or other "premium" file-recovery software, you must not use the HDD until you have a clone of it (WiKi), use a cloned drive if you have one.

For pywallet, you can try pywallet --recover on the cloned drive to check if your (correct) old weak password can decrypt deleted keys from that drive.
Here's an example: /index.php?topic=5408068.msg60653031#msg60653031 (OP is using Windows)

[Cricktor]

Don't get me wrong, I don't want to blame you, I want to highlight for others what goes wrong here. Maybe give you a hint or two...

But i remember i changed my password because it was to easy.

OK, and you didn't document your new and more complex password? Why is that?

Did you use any tools for the new password or did you just use your own password schemes in a more complex way. I ask, because many people have personal ways to construct their passwords, sometimes good, more often not so much. Schemes are schemes and you can use this to your advantage for such a password recovery, if you remember enough details, of course.

May there be a way i can recover the old wallet file, with the old easy password? Like when you delete a file you can reproduce it, is the same posssible when i change  password for a wallet.dat file ?

This depends heavily on how the wallet software writes changes to an existing wallet file. Does it write a new file, saving the changes and deleting the old file afterwards? Does it write the changes directly into the existing file, overwriting already allocated sectors for the existing file (probably the worst case for your recovery attempt)?

What kind of filesystem was used because this also affects how new data is written to disk and how old or deleted files are handled?
Any further writes on that filesystem diminish your chances for recovery!


Before any attempt for recovery: you should make multiple forensic bit-by-bit copies of your storage device, the original media should be mounted read-only. Never work with the original media, only with a copy of the forensic copy! You always need to be able to get back to the original state, no matter what, without ever risking to change the original media state.

i have about 15K USD there, ...

That's not a small sum... the less I understand the sloppy handling of the wallet's new password.

[Doth4t]

Because i had a psycothic break, i was really paranoid at that time, so i changed the password to "secure" my coins better, but i was in another mental state. So i just remember wanting to making it a little more complex, than the usual password i used.. But in my mind at the time it wasnt a huge change anyway, it was just a bit smarter... And this was 8 y ago, so it wasnt worth 15k then, so i didnt take it too seriously(or 50-60k at one point, as litecoin lost a lot of value)

And at the same time i had my other 1/3 of coins at  btc-e which all got seized.. (Did anyone get anything back from the feds? How can they take my money because the owner of the exchange was laundering money?)


aah, Bitcoin, i wouldve been a billionaire today if i just trusted my self, and stored it locally(Wish i had a trezor back then)

Don't get me wrong, I don't want to blame you, I want to highlight for others what goes wrong here. Maybe give you a hint or two...

But i remember i changed my password because it was to easy.

OK, and you didn't document your new and more complex password? Why is that?

Did you use any tools for the new password or did you just use your own password schemes in a more complex way. I ask, because many people have personal ways to construct their passwords, sometimes good, more often not so much. Schemes are schemes and you can use this to your advantage for such a password recovery, if you remember enough details, of course.

May there be a way i can recover the old wallet file, with the old easy password? Like when you delete a file you can reproduce it, is the same posssible when i change  password for a wallet.dat file ?

This depends heavily on how the wallet software writes changes to an existing wallet file. Does it write a new file, saving the changes and deleting the old file afterwards? Does it write the changes directly into the existing file, overwriting already allocated sectors for the existing file (probably the worst case for your recovery attempt)?

What kind of filesystem was used because this also affects how new data is written to disk and how old or deleted files are handled?
Any further writes on that filesystem diminish your chances for recovery!


Before any attempt for recovery: you should make multiple forensic bit-by-bit copies of your storage device, the original media should be mounted read-only. Never work with the original media, only with a copy of the forensic copy! You always need to be able to get back to the original state, no matter what, without ever risking to change the original media state.

i have about 15K USD there, ...

That's not a small sum... the less I understand the sloppy handling of the wallet's new password.

[Doth4t]

-snip- May there be a way i can recover the old wallet file, with the old easy password? Like when you delete a file you can reproduce it, is the same posssible when i change  password for a wallet.dat file ? (And yes i still have the original HDD where it was)

Usually, HDDs keep the old data on a can-be-overwritten state rather than "zero-filled",
I'm not sure on litecoin specifics but theoretically, it may still be available for recovery if it's not overwritten by the new data and any other data that's being written on the disk.

But that's a job for professional data recovery service/tool rather than password-recovery tools that's being discussed here.

Doing the data recovery yourself may even worsen the chance of recovering a copy of your old wallet.dat file.
If you have to do it yourself with tools like pywallet or other "premium" file-recovery software, you must not use the HDD until you have a clone of it (WiKi), use a cloned drive if you have one.

For pywallet, you can try pywallet --recover on the cloned drive to check if your (correct) old weak password can decrypt deleted keys from that drive.
Here's an example: /index.php?topic=5408068.msg60653031#msg60653031 (OP is using Windows)

The HDD hasnt been used much since then... So i guess if litecoin start really gaining value i will hire some professionals to extract it, But for 15k it probably just cover the cost. I wont try it my self, i am trying to bruteforce the password though, tried with rainbow tables, and so on, but it is to too complex for me to understand,. Iam hoping AI will become smart enough to help me one day

[nc50lc]

I wont try it my self, i am trying to bruteforce the password though, tried with rainbow tables, and so on, but it is to too complex for me to understand -snip-

Try to compile a couple of possible parts of the password that you could've used on a "token" file to be used in BTCRecover. (documentation is in the link in the 1st reply)
Because otherwise, you'll just waste your time and resources to bruteforce it if you don't have the slight clue on the majority of the characters.
But if you have a list of possible parts of the password, then it's worth the try.

As for "Rainbow Tables", this isn't recommended to attack a Bitcoin wallet.dat's encryption since the 256-bit "master key" which is the key used to encrypt the wallet's private keys/hd keys is not simply encrypted with a key from weak hash function, but a result from PBKDF2 HMAC - SHA512 of the password and random salt with a number of iterations.
If litecoin uses the same scheme, then your attack is ineffective.

The HDD hasnt been used much since then...

This doesn't sound promising.

For further discussion, you may ask the Litecoin community or in the Altcoin boards since this is a Bitcoin section.

[Cricktor]

I have another recommendation if you try to recover a "real case": construct a test case with which you can verify that your password recovery attempt will yield a correct result if applied properly.

Create a wallet and encrypt it with a known and documented password. This password should've elements that you expect in your "real case".

Construct your token file accordingly or at least how you understand it.

Fire up the password cracking tool and feed the token file in. If you've done everything properly the tool should generate your test wallet's password sooner or later and find the correct password for the test case wallet.

If it can't find the correct test password, you've done something wrong somewhere. Analyse and improve.

If you can't solve your test case, how do you think are your chances for the "real case"?

Practice gives you experience, don't forget this.