You open MetaMask, type what you think is the right password, and the extension shakes its head. You try a few more variations. Nothing. The wallet stays locked, and the feeling shifts from mild annoyance to genuine concern, because behind that password sits every token, every NFT, and every network connection you have built up over months or years.
The good news is that your funds are not gone. Your crypto lives on the blockchain, not inside MetaMask. The password only encrypts the local vault on your device. What matters now is which recovery path is open to you, and that depends on one thing: whether you still have your 12-word Secret Recovery Phrase.
What the MetaMask Password Actually Protects
MetaMask creates an encrypted vault file the moment you set up the wallet. That vault contains your Secret Recovery Phrase and every private key derived from it. The password you chose during setup is the encryption key for that vault. It works only on the specific browser and device where you created it. A different browser, a different computer, or a reinstalled extension means a different vault, even if the underlying wallet is the same.
This is fundamentally different from a website login. MetaMask does not store your password on a server, and there is no “forgot password” email link. The password exists only in your head and, ideally, in whatever backup system you use. If you forget it, MetaMask cannot retrieve it for you, because MetaMask never had it.
MetaMask Password Requirements
MetaMask enforces a minimum password length of 8 characters. Beyond that, it does not impose specific complexity rules such as mandatory uppercase letters, numbers, or special characters. In practice, many users choose a password that balances memorability with some degree of complexity, often mixing uppercase and lowercase letters, digits, and one or two special characters. Knowing what MetaMask allows and does not require can help you narrow down what you might have chosen when you first set up the wallet.
Path 1: Reset with Your Secret Recovery Phrase
If you still have your 12-word Secret Recovery Phrase, resetting the password is straightforward and takes less than two minutes. This is the path MetaMask was designed for, and it works regardless of which device or browser you are using now.
Open MetaMask and click the “Forgot password?” link on the login screen, or uninstall and reinstall the extension and choose “Import using Secret Recovery Phrase” during setup. Enter all 12 words in the exact order you received them, in lowercase, with single spaces between words. Set a new password, and MetaMask rebuilds your wallet from the phrase. All accounts derived from that phrase will be accessible again, though you may need to click “Create Account” to regenerate any additional accounts you had beyond the first one.
If the phrase is rejected, the most common causes are a misspelled word, two words in the wrong order, or a word that does not appear in the BIP-39 wordlist. Double-check each word against your written backup. Every word must match exactly. A single character difference, “acces” instead of “access” or “abandom” instead of “abandon,” makes the entire phrase invalid.
Lost your password and your recovery phrase?
Crypto Recovers specialises in MetaMask vault extraction and password recovery. Request a free assessment. MetaMask recovery service
Path 2: Recover the Password from the Encrypted Vault
If you have lost your Secret Recovery Phrase, or if you are not sure it is correct and do not want to risk entering it wrong, the second path is to recover the password itself. This only works if the vault file still exists on a device you have access to. That means MetaMask must still be installed in the same browser, or the browser profile data must still be on the drive.
The vault is a JSON structure containing your seed phrase encrypted with the PBKDF2 key derivation function. With the vault file in hand, it becomes possible to test password candidates against it offline, without interacting with MetaMask at all. This is what the crypto community calls a brute-force approach, though in practice it is rarely pure brute force. The more you know about what your password might have been, the smaller the search space becomes.
Building a Password Hint List
Before any recovery attempt, whether you do it yourself or work with a specialist, write down everything you can remember or guess about the password. Think about the patterns you tend to use across other services. Common elements include names of family members, pets, dates of birth or anniversaries, favourite words or phrases, the year you created the wallet, and any special characters you habitually add. Check your password manager, old notebooks, notes apps, and any browser where you might have accepted an offer to save the password. Even a partial memory, “I think it started with a capital letter and ended in a year,” dramatically reduces the number of candidates that need to be tested.
Doing It Yourself: Hashcat and John the Ripper
Two open-source tools can test password candidates against a MetaMask vault: Hashcat and John the Ripper. Hashcat is the faster option because it runs on GPU hardware and can test millions of candidates per second, but it requires a reasonably powerful graphics card and some comfort with the command line. John the Ripper runs on CPUs and is somewhat more accessible to non-technical users, though significantly slower.
Both tools need the vault data extracted from the browser’s extension storage and converted into a format they can read. That extraction step, and the correct invocation of the tool, is where most people without a technical background get stuck. If you are not comfortable navigating browser profile directories and running command-line tools, this is the point where professional help makes sense.
Working with Crypto Recovers
We run the same tools, but on dedicated, always-offline hardware optimised for exactly this type of work. You provide the vault file (or ship us a copy of the drive), along with your password hint list. We build a customised attack configuration around your hints and run it until the password is found or the search space is exhausted. The entire process happens on air-gapped machines, and you retain full control of your wallet throughout.
What If You Have Lost Both the Password and the Phrase?
This is the hardest scenario, but it is not always hopeless. If the vault file still exists on a device, the password is technically all that stands between you and the phrase, because the phrase is inside the vault. Recovering the password gives you the phrase as well. The question is whether enough of the password’s structure can be reconstructed to make the search computationally viable.
If the vault file is gone too, because the extension was uninstalled and the browser data was cleared, recovery becomes extremely difficult. The vault may survive as fragments in the drive’s unallocated space, but that depends on how much new data has been written since the deletion. In our experience, cases where both the phrase and the vault are entirely gone, with no partial memory and no backup anywhere, are the ones we have to turn away. We would rather be honest about that than take on work with no realistic prospect of success.
Not sure which situation you are in? We will tell you whether recovery is viable and what it would involve. Request a free assessment
MetaMask Password FAQ
How do I log into MetaMask with my password?
Open the MetaMask extension in your browser or the MetaMask app on your phone and type the password you set during wallet setup. The password is case-sensitive, so check your keyboard language and Caps Lock before concluding it is wrong. If you are using a different browser or device from the one where you set up the wallet, you will need your Secret Recovery Phrase instead.
Can I change my MetaMask password?
MetaMask does not have a “change password” option in its settings. The only way to set a new password is to reset the wallet using your 12-word Secret Recovery Phrase. That process creates a new vault with the new password. The old password ceases to work.
Why is my MetaMask password not working?
The most common causes are a typo, an unexpected keyboard layout, Caps Lock being active, or invisible trailing spaces from pasting. If you are certain the password is correct and it still fails, the vault file may be corrupted, usually due to a browser crash or a forced shutdown during a MetaMask update. In that case, resetting with your Secret Recovery Phrase is the cleanest fix.
Can I recover my MetaMask password without the seed phrase?
Only if the encrypted vault file still exists on the original device. The password can then be recovered by testing candidates against the vault data using specialised tools. Without the vault and without the seed phrase, there is no path to recovery, because there is nothing left to decrypt.
Is the MetaMask password the same as the Secret Recovery Phrase?
No. The password is a locally chosen string that encrypts the vault on one specific device. The Secret Recovery Phrase is a 12-word master key that can rebuild the entire wallet on any device. You need either one to regain access, but they serve entirely different functions. Losing the phrase is far more consequential than losing the password, because the phrase cannot be recovered from anywhere but your own backup.
