🦊 MetaMask Recovery Wallet
📸 Screenshot: Banner
Recover your MetaMask wallet from broken, corrupted, or inaccessible browser extensions — without the extension GUI.This tool decompresses and parses Chrome's LevelDB entries used by the MetaMask extension, identifies MetaMask's internal state, and extracts controller data. If you provide the correct MetaMask password, it decrypts the vault and derives your public addresses (ETH/BTC/SOL) — all offline and without leaking your seed phrase.
📸 Screenshot: Main Window
🔍 What it reads from LevelDB:- KeyringController — vault metadata + encrypted vault blob
- AccountsController — internal accounts, selected account, metadata
- AccountTracker — balances by chain
- NotificationServicesController — notifications list
- PermissionLogController — permission history / dApp origins
🔐 Vault Decryption:- PBKDF2-HMAC-SHA256 key derivation (256-bit, salt + iterations from vault metadata)
- AES-GCM decryption with tag length heuristics (16/12/32)
- Shows ONLY public derived addresses + SHA-256 hash of mnemonic (verification fingerprint)
- Never prints or transmits your seed phrase or private keys
🖥️ Terminal UI (Textual TUI):📸 Screenshot: TUI View 1 |
📸 Screenshot: TUI View 2- Summary — vault parameters + derived public addresses + decrypted seed
- Accounts — name/type/address/derivation path
- Balances — per chain & address
- Notifications — transaction summaries
- Permissions — origins + last-approved timestamps
⚙️ Quick Start:# Clone
git clone https://github.com/ipsbruno3/metamask-recovery-wallet.git
cd metamask-recovery-wallet
# Setup
python -m venv .venv
source .venv/bin/activate
pip install plyvel pycryptodome bip-utils textual
# Run (auto-detects Chrome profile path on WSL)
python ui.py
# Or specify LevelDB path manually:
python ui.py --db "/path/to/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/"
- Python 3.10+
- Chrome's LevelDB directory from your profile
- Your MetaMask password (to decrypt the vault)
🛡️ Security & Privacy:- Designed for offline use — no network calls
- Does NOT transmit your vault, password, or mnemonic anywhere
- Shows only public derived addresses and a SHA-256 fingerprint for verification
- Source is open — inspect it yourself
⚠️ Compliance:Use this tool
only for wallets you own or where you have
explicit written authorization. If you're performing recovery for a client, ensure you have documented proof of ownership.
🔗 Links:🏅 Recovery Services:In many cases, wallet recovery can be completed in
minutes through a guided triage process — without ever requesting your seed phrase. I also build dedicated hardware + software solutions tailored to your exact environment and data sources (FPGAs/OpenCL Kernels).
Contributions, feedback, and stars ⭐ on GitHub are welcome!
