Geth keystore password recovery
If you ran an Ethereum node or used a keystore-based wallet, your key sits in a UTC– file encrypted with your password. Forgot it? With the file and a few hints, it’s recoverable.
Geth (go-ethereum) stores each account as a keystore v3 JSON file, encrypting the private key with a password via scrypt (or PBKDF2) and AES-128-CTR. Recovering access means finding that password — the key is never brute-forced. The strength of scrypt is why hints matter: a targeted search succeeds where blind brute force never would.
Locate the keystore file
Keystores live under the Ethereum data directory in a keystore folder:
- Linux: ~/.ethereum/keystore
- macOS: ~/Library/Ethereum/keystore
- Windows: %APPDATA%\Ethereum\keystore
Each UTC–<timestamp>–<address> file is one account. Open it in a text editor to confirm it contains a crypto block with cipher, kdf and ciphertext.
How Geth password recovery works
We extract the hash from the keystore (with a tool like ethereum2john) and run a hint-driven GPU search using hashcat — the exact mode depends on whether the file uses scrypt or PBKDF2. Candidate passwords are built from what you remember: length, fragments, character habits and reused passwords. A hit is confirmed the instant the keystore decrypts.
When the password “should” work but doesn’t
As with Mist, a lot of failed unlocks are the right password entered on a different keyboard layout, with a smart-quoted character, or a Unicode normalisation difference. We sweep those variants automatically, which recovers accounts that report a wrong password everywhere else.
Frequently asked questions
Do you need my private key to recover a Geth wallet?
No — we work from the encrypted keystore file, never a key in the clear. Your password decrypts it; we search for that password against the file offline.
I only remember part of my password. Can that work?
That is the best case. Partial recall and known fragments let us build targeted masks and rules, which is what makes a scrypt-protected keystore feasible to recover.
Which Ethereum wallets use this keystore format?
Geth, Mist, MyEtherWallet keystore exports, Parity/OpenEthereum and many others all use the keystore v3 format, so the same recovery approach applies.
What does it cost?
Success-based: a percentage of the recovered value only if we succeed, nothing if we fail, and no upfront payment.
Locked out of a Geth keystore?
Send us the UTC– file and what you remember of the password. Honest assessment within 24 hours, and you pay only on success.