How to Recover a Keystore / UTC / JSON File Password for Ethereum

You have the file. It’s a .json keystore, often named something like UTC--2018-03-14T..., and it holds your Ethereum wallet. What you don’t have is the password that opens it. Before you start typing guesses, it’s worth understanding what this file is, because that decides whether your Ethereum keystore file password can be recovered at all.

What a keystore file actually is

A keystore password is not gone the way a lost seed phrase is gone. The file in front of you is your private key, locked inside an encrypted JSON file, and your password is what unlocks it. The blockchain doesn’t store that password anywhere: it only locks this one file. So what’s missing isn’t your key. It’s the password to the copy you’re already holding.

That distinction changes everything. Because you hold the file, you can test a password guess against it on your own computer, offline, as many times as you want. No server decides whether you’re allowed another try. Your ETH sits on the blockchain, untouched, and this file is only the way back in.

Before you try anything: work only on a copy

Copy it first. Make two copies, and put one somewhere you never touch, because a keystore is a single small file with everything inside it and old drives fail at the worst moment.

Two mistakes lock people out for good:

• Keep the original file unchanged and do not edit its contents. A keystore must remain valid JSON. Renaming it or changing .json to another extension does not change the stored data, but may stop software from recognizing it. Editing or deleting the encrypted data inside can make the file unusable.
• Keep it offline, and never paste your keystore file, your password, or your private key into a website that offers to unlock it. Fake MyEtherWallet and MyCrypto clones run on search ads and look identical to the real thing. The moment a scammer has the file and the password, the wallet drains. Real recovery happens on your own machine, never in a browser tab you reached through an ad.

You still know the password: how to open the file

This is the strongest position. If you actually remember the password, you don’t need recovery. You need a current tool, because the one this guide used to recommend is out of date.

The MyCrypto desktop app is no longer actively maintained, by MyCrypto’s own admission, so don’t build your recovery around it. Use one of these instead:

• MetaMask. In the browser extension, click the account selector, then Add wallet and Import an account. Under Select Type, choose JSON File, select your keystore, enter the file’s own password (not your MetaMask password) and click Import (MetaMask’s import guide). JSON import is extension-only. Older versions called the option ‘Import account’. This is the simplest current route.
• MyEtherWallet (MEW). MEW can open a keystore, but download it and run it offline rather than typing your password into the live site. A separate guide covers MEW login problems.
• geth (go-ethereum). For command-line users, geth reads keystore files from its keystore directory. Current versions handle accounts through the separate Clef signer, and the old --unlock flag is deprecated (geth account management).

Once you’re in, move on from the old wallet. A keystore holds one single key, and you’ve now entered its password into software, so send everything to a fresh wallet you control. The forward-protection section below covers how to do that safely.

You’ve forgotten the password: how recovery actually works

Whether this is recoverable depends on what you remember, and the reason matters before you spend a cent on it. The password isn’t written down inside the file for anyone to read: you find it by testing candidates until one decrypts the key. Because the file is yours to test against, that search runs offline, with no lockout and no rate limit. That’s a freedom a completely lost seed phrase never gives you.

There’s a real catch, though. A keystore locks your key behind a deliberately slow function, scrypt or PBKDF2, paired with AES-128-CTR encryption (Web3 Secret Storage definition). The work factor is stored in the file itself; geth’s standard scrypt setting is 262,144. That slowness is a security feature: each guess costs real computing time, by design. Testing a few thousand likely passwords finishes fast. Testing every possible ten-character random string does not. That search space is far too large to exhaust in a human lifetime, even on strong hardware.

So blind brute force is out, and targeted search is what works. The open-source tool for this is BTCRecover, which supports Ethereum UTC keystore files and runs entirely offline. You don’t feed it random strings. You feed it what you remember:

• a base password you think you used, plus rules to try variations: a capital letter, a year on the end, a swapped symbol;
• a short list of words you tend to reuse, tried in different orders;
• the length and character types, if you recall them, to keep the search tight.

BTCRecover then works through those candidates systematically. For some wallet formats, BTCRecover’s extract scripts let a specialist work from a small extract of the wallet data that can’t expose the keys. Ethereum keystores have no such script, so the search runs offline against a copy of the keystore itself.

The best case is a familiar base with a forgotten ending: the right word, but an uncertain capital, digit, or symbol on the end. That’s a small, constrained search. The wider your uncertainty, the larger the search grows.

The limits of recovery

Not remembering any part of the password does not automatically rule out a search. A copy of the keystore can still be tested against a limited list of common passwords and patterns. Whether that is worthwhile depends on the candidates, the file’s encryption settings and the measured testing speed. A long, randomly generated password can be beyond practical recovery; forgetting it does not by itself tell us how strong it was.

The other dead end is having no file at all. With no keystore, no saved private key, and no seed phrase, there is nothing left to decrypt and no way into the wallet for anyone. We’d rather tell you that plainly than take a case we already know can’t work.

Keystore file vs seed phrase: not the same backup

People mix these up, and the difference decides your options. A keystore file is one private key, encrypted with a password and saved as JSON. A seed phrase is a list of words (usually 12 or 24) that can regenerate a whole set of keys under the BIP39 standard. They’re separate backups with separate recovery paths.

The practical upshot: if you have the keystore, you don’t need the seed phrase to get in. You need the password. And if anyone ever asks you for your seed phrase to “recover” a keystore, that’s a scam pattern, not a real step.

After you’re back in: don’t rely on the keystore again

Move on from it. A keystore is a single key with a single password, and one forgotten password is exactly what locked you out. Create a new wallet you control, ideally a hardware wallet, and move your ETH and tokens across to it. A seed-based setup gives you a recovery path a single-file keystore never had.

If you’re locked out of a keystore — whether the password is forgotten or you are unsure about the file — start with a free assessment: an honest read on whether the password can be reconstructed, before any commitment. Crypto Recovers has completed 200+ recoveries since 2019, works on a no recovery, no fee basis, and never handles your money.

If we do recover the password, you unlock the keystore yourself and move the ETH and tokens to the new wallet described above. The agreed fee is a separate payment under the contract, never deducted from the recovered funds.

FAQ

Why does my Ethereum keystore password say it’s incorrect when I’m sure it’s right?

An incorrect password message is not always caused by a forgotten password. You may be opening the wrong wallet, using a different keyboard layout, or entering a small typo such as an incorrect capital letter, symbol, or number.

Can I extract the private key from a keystore file without the password?

No. An Ethereum keystore file stores your private key in encrypted form. Without the correct password, the private key cannot be decrypted or accessed.

Can I recover my wallet if I lost the keystore file?

Only if you have another backup, such as the private key or recovery phrase. If the keystore file was accidentally deleted, file recovery software may be able to restore it from the original storage device.

Is it safe to use MyCrypto to open an Ethereum keystore file?

The MyCrypto desktop app is no longer actively maintained. It is generally safer to use supported wallet software that can import JSON keystore files, and you should only use official wallet applications.

How long does Ethereum keystore password recovery take?

The recovery time depends on the complexity of the password and how much information you remember. Some cases can be completed quickly, while others may require days of testing or may not be recoverable.

Can I brute-force an Ethereum keystore password with Hashcat?

Although it is technically possible, Ethereum keystore files are designed to resist brute-force attacks. Password recovery is much more effective when based on clues or partial knowledge of the original password.

Can old Ethereum presale or legacy JSON wallet files still be recovered?

Yes, if the wallet file still exists and the password can be narrowed down. Older files, such as 2014 presale wallets, use a different JSON format, but they can still be tested offline with tools that support it; see our Ethereum presale wallet guide.