You have the file. It’s a .json keystore, often named something like UTC--2018-03-14T..., and it holds your Ethereum wallet. What you don’t have is the password that opens it. Before you start typing guesses, it’s worth understanding what this file is, because that decides whether your Ethereum keystore file password can be recovered at all.
What a keystore file actually is
A keystore password is not gone the way a lost seed phrase is gone. The file in front of you is your private key, locked inside an encrypted JSON file, and your password is what unlocks it. The blockchain doesn’t store that password anywhere: it lives only inside this one file. So what’s missing isn’t your key. It’s the password to the copy you’re already holding.
That distinction changes everything. Because you hold the file, you can test a password guess against it on your own computer, offline, as many times as you want. No server decides whether you’re allowed another try. Your ETH sits on the blockchain, untouched, and this file is only the way back in.
Before you try anything: work only on a copy
Copy it first. Make two copies, and put one somewhere you never touch, because a keystore is a single small file with everything inside it and old drives fail at the worst moment.
Two mistakes lock people out for good:
- Don’t rename the file or edit what’s inside it. A keystore has to stay valid JSON. Change
.jsonto another extension or “tidy up” the text, and it can break in a way that’s hard to reverse. - Keep it offline, and never paste your keystore file, your password, or your private key into a website that offers to unlock it. Fake MyEtherWallet and MyCrypto clones run on search ads and look identical to the real thing. The moment a scammer has the file and the password, the wallet drains. Real recovery happens on your own machine, never in a browser tab you reached through an ad.
You still know the password: how to open the file
This is the strongest position. If you actually remember the password, you don’t need recovery. You need a current tool, because the one this guide used to recommend is out of date.
Heads up on that. The MyCrypto desktop app is no longer actively maintained, by MyCrypto’s own admission, so don’t build your recovery around it. Use one of these instead:
- MetaMask. Install the extension, then open ‘Import Account’ > ‘JSON File’, select your keystore, and enter the password. This is the simplest current route for most people.
- MyEtherWallet (MEW). MEW can open a keystore, but download it and run it offline rather than typing your password into the live site. A separate guide covers MEW login problems.
- geth (go-ethereum). For command-line users: place the
UTC--file in your keystore folder and unlock the account with the--unlockflag.
Once you’re in, move on from the old wallet. A keystore holds one single key, and you’ve now entered its password into software, so send everything to a fresh wallet you control. The forward-protection section below covers how to do that safely.
You’ve forgotten the password: how recovery actually works
This is often recoverable, and the honest reason matters before you spend a cent on it. The password isn’t written down inside the file for anyone to read: you find it by testing candidates until one decrypts the key. Because the file is yours to test against, that search runs offline, with no lockout and no rate limit. That’s a freedom a completely lost seed phrase never gives you.
There’s a real catch, though. A keystore locks your key behind a deliberately slow function: scrypt (with a work factor around 262,144) or PBKDF2, paired with AES-128-CTR encryption. That slowness is a security feature: each guess costs real computing time, by design. Testing a few thousand likely passwords finishes fast. Testing every possible ten-character random string does not. That search space is far too large to exhaust in a human lifetime, even on strong hardware.
So blind brute force is out, and targeted search is what works. The open-source tool for this is BTCRecover, which supports Ethereum UTC keystore files and runs entirely offline. You don’t feed it random strings. You feed it what you remember:
- a base password you think you used, plus rules to try variations: a capital letter, a year on the end, a swapped symbol;
- a short list of words you tend to reuse, tried in different orders;
- the length and character types, if you recall them, to keep the search tight.
BTCRecover then works through those candidates systematically. Where the wallet format allows it, a specialist works from the password hash extracted from the encrypted file rather than the plaintext password. The search runs against that hash offline, so no one ever handles your actual password directly.
In the cases we see most, the winning password is a familiar base with a forgotten ending: the right word, but an uncertain capital, digit, or symbol on the end. That’s a small, constrained search, and it lands. The wider your uncertainty, the larger the search grows.
When a keystore password can’t be recovered
Some situations have no path, and it’s better to hear that now than after weeks of computing. No memory, no pattern, no length, no character set, and a long random password together mean an unconstrained search space: one that no amount of hardware finishes. That door is closed, and pretending otherwise helps no one.
The other dead end is having no file at all. With no keystore, no saved private key, and no seed phrase, there is nothing left to decrypt and no way into the wallet for anyone. We’d rather tell you that plainly than take a case we already know can’t work.
Keystore file vs seed phrase: not the same backup
People mix these up, and the difference decides your options. A keystore file is one private key, encrypted with a password and saved as JSON. A seed phrase is a list of words (usually 12 or 24) that can regenerate a whole set of keys under the BIP39 standard. They’re separate backups with separate recovery paths.
The practical upshot: if you have the keystore, you don’t need the seed phrase to get in. You need the password. And if a scenario ever asks you for your seed phrase to “recover” a keystore, that’s a scam pattern, not a real step.
After you’re back in: don’t rely on the keystore again
Move on from it. A keystore is a single key with a single password, and one forgotten password is exactly what locked you out. Create a new wallet you control, ideally a hardware wallet, and move your ETH and tokens across to it. A seed-based setup gives you a recovery path a single-file keystore never had.
If you’re locked out of a keystore, whether you half-remember the password or you’re unsure about the file, Crypto Recovers offers a free assessment: describe what you have, and we give you an honest read on whether the password can be reconstructed, before any commitment. We’ve recovered access to 200+ wallets since 2019, on always air-gapped machines and only after you sign a contract. We never handle or even see your money: if we reconstruct the password, you open the wallet and move the funds yourself, to a new wallet you created, and you send the agreed percentage yourself (No Cure No Pay), with both of us present.
