Forgot Your Blockchain Second Password? What’s Actually Recoverable

You can log into your wallet, but the moment you try to send anything, a second box appears asking for a password.

Before you touch that login screen, one warning: the “reset password” link does not reset your Blockchain second password, and using it can lock you out of the wallet you’re trying to reach.

Blockchain.com cannot reset the second password

Your DeFi Wallet is self-custodial: you hold the keys, the company holds nothing. Blockchain.com states directly that it cannot reset or recover passwords for non-custodial wallets. The encryption design puts them out of reach. No support agent, no email verification, no route back through them. What it recommends instead is working through every variation you might have used, which is what a proper recovery does systematically, at a scale no person manages by hand.

Do not click “reset password”

That link resets the custodial trading account, not your self-custodial wallet. Blockchain.com’s own recovery guide warns that resetting your password instead of using your recovery phrase creates a new wallet, with a new Wallet ID, and unlinks the original from your account. Your coins stay on the blockchain, and the old wallet still answers to its original Wallet ID, but the route back to them gets much harder.

Write down what you remember first, on paper: length, numbers or symbols, a word you tend to reuse, the year you set it. Every detail removes a large number of wrong answers later.

Two passwords, two different problems

Your primary password logs you in so you can look around. The second password is a separate lock the wallet demands before it releases the private keys and lets funds move. Same door, second lock.

The second password is a legacy feature. It exists only on older wallets, and Blockchain.com’s current documentation doesn’t offer it to new users at all. If yours is still active, you need it to send anything, and recovering the primary password doesn’t replace it. Lost the primary password or your Wallet ID instead? That’s the guide to a lost Blockchain.com password.

If you have your 12-word recovery phrase

This is the strongest position, with one exception.

Restoring from your phrase rebuilds the wallet from the keys themselves, so neither password stands in the way. On the web, choose ‘Login with Recovery Phrase’, enter the words in their original order and set a new password. In the mobile app, the same route is ‘Import Wallet’, then ‘Restore Wallet’. The phrase follows the BIP39 standard: a fixed list of 2,048 words where the last word acts as a checksum, a built-in test that rejects most wrong combinations. An “Invalid Recovery Phrase” error means the words are wrong, not that the wallet is gone. Our guide to an invalid mnemonic phrase covers what to check next.

The exception: a phrase restore does not bring back funds held in imported addresses. Blockchain.com’s recovery guide states this plainly.

Never type your 12 words anywhere other than the official Blockchain.com app or website.

“I restored with my 12 words but my bitcoin is missing”

Before you assume the worst, check whether the missing coins sat at an imported address.

An imported address is one whose private key you brought in from elsewhere, rather than one your wallet generated from the phrase. Your phrase can only regenerate what it created. Imported keys were never derived from it, so the restored wallet looks emptied while the coins sit untouched at addresses it no longer displays.

Check the address on mempool.space before concluding anything. If the balance is still there, you need the original private key or wallet file, not another phrase attempt. Older accounts hit this more often: addresses created before Blockchain.info moved its wallets to a 12-word recovery phrase were never derived from that phrase, which is why long-time users report their oldest addresses going quiet after a restore. Our page on a zero balance after a restore covers the other causes worth ruling out.

If you know your primary password but not the second

Recovery is often possible here.

Your wallet backup, a file named wallet.aes.json, holds an encrypted block sealed by the second password. Open-source software like BTCRecover tests candidates against that block methodically, working through a search space built from what you remember. The main password unlocks the outer layer; the search runs against the inner one. BTCRecover can also run the search on a graphics card. In the benchmark in its GPU guide, a graphics card tested Blockchain.com second passwords about 40 times faster than the processor alone, and main passwords about 10 times faster, though the guide warns that the gain varies with the hardware.

Where the format allows it, the work runs against an extracted hash rather than the live wallet. BTCRecover ships an extract script that uses your main password to open the outer layer, then pulls the second password’s hash, salt and iteration count out of the file as a short base64 string. Everything after that runs against those few characters. The extract holds none of the encrypted private keys, and your wallet file stays with you. That is also how we prefer to work: air-gapped machines, and never before a signed contract.

How to recover the second password, step by step

Here’s what the work actually consists of. It assumes you can still log in with your main password and reach the wallet file.

1. Download your wallet file. You’ll need your Wallet ID, the email inbox linked to the wallet (Blockchain.com asks you to approve the login there) and your 2FA code if two-factor authentication is on. BTCRecover’s documentation covers the process. The file is usually named wallet.aes.json.
2. Make two copies before anything else, and work only with a copy. A damaged working file with no backup ends the attempt there.
3. Write out every password you used in that period, then the variations you’d plausibly have typed. This list is what decides whether the search finishes in hours or never finishes at all.
4. Extract the hash instead of using the live file. The extract script asks for your main password, removes the outer layer of encryption and prints the second password’s hash, salt and iteration count as a short base64 string. The search then runs against those characters rather than your wallet. Where possible, share only that extract, never the wallet file itself.
5. Run the search with typo handling switched on. Case changes, deleted characters and small mistypes get treated as variations of your candidates rather than as separate entries. That setting is what catches a password you’re certain you remember correctly.
6. Stop when the space stops being finite. If your candidates run into the billions with nothing narrowing them, more computing power doesn’t change the answer.

Steps 4 and 5 are the technical part, and handing the work over at that point is a reasonable decision rather than a failure. Our explainer on how wallet password recovery works sets out the method and its limits.

“It’s asking for a second password I never set”

You’re not imagining it.

Some users with older wallets have reported that an upgrade prompt demanded a second password they never created, or that a working one was suddenly rejected with nothing changed at their end. Either way, Blockchain.com cannot reset it for you.

So don’t stop at “I never set one.” If a second password exists on the wallet, something set it, often a variation of the primary password or one you reused in the same period. Recovery tools test exactly that: case changes, deleted characters, small typos against your known passwords.

If your backup phrase has 17 words, or 15, or 21

You have a legacy recovery mnemonic, and it does something different from what you expect.

Before it adopted BIP39, Blockchain.info issued phrases that encoded your password rather than your keys. They come in lengths other than 12 words, on word lists of their own, which is why the current site rejects them as a recovery phrase. Blockchain.com still provides a route to reveal the password from one, for wallets created before 2016.

Two limits: it returns your first password, not your second, and it returns that password as it stood when the phrase was generated. Change it afterward and what comes back is out of date.

When there’s no path forward

We’d rather tell you now than take you through weeks of work that can’t succeed.

The first closed door is missing wallet data. Losing both passwords and the 12-word phrase does not by itself rule out recovery: if the encrypted wallet survives, as a wallet.aes.json backup or as the copy Blockchain.com still serves under your Wallet ID, a search for the primary password may be assessable, and the second-password search follows as a separate step. But Blockchain.com cannot reset either password, and without usable wallet data, keys or a backup, there is no material to test.

The second closed door is a password you recall nothing about: no length, no characters, no habit, no era. A search needs constraints to be a search. With nothing to constrain it, no technique finds the answer, and anyone promising otherwise is selling something.

The people who reply to these threads

Read any public thread on this problem and the same replies sit underneath it. Free email addresses and Telegram handles offering to crack any password. Percentages quoted upfront. Accounts posting a story about losing coins and naming the “expert” who got them back. Requests to send over your wallet file.

The warning signs repeat: unsolicited replies, consumer email addresses, no company behind the name. A legitimate service works from your encrypted file or an extracted hash under a signed contract, never from your seed phrase, and never charges before a recovery succeeds. Our guide on how to find a legitimate crypto recovery company lists the checks worth making.

Once you’re back in

Write the 12 words on paper, or stamp them into metal, which resists water and fire, and store them offline, away from the device. If any funds sit at imported addresses, back up those private keys separately. Your recovery phrase will never cover them, and that gap is what turns a forgotten password into a five-year problem.

If your situation involves a second password you partly remember, a wallet file you can reach but can’t unlock, or an old account with imported addresses, request a confidential assessment: an honest read on whether it’s recoverable, before any commitment. The first assessment is free and we work on a no recovery, no fee basis. Your coins never pass through our hands: you move the funds yourself, to a wallet you created.

FAQ: Blockchain.com second password

Why is my Blockchain.com wallet asking for a second password I never set?

Some older Blockchain.com wallets have asked for a second password after upgrades or interface changes, and some users say they never created one. If the wallet has a second password, something set it. Start with variations of your main password and other passwords you used at the time, rather than something completely different. Recovery tools test exactly those variations.

Can Blockchain.com reset my second password?

No. The wallet is self-custodial, so Blockchain.com does not know your second password and cannot reset it; its own documentation says it cannot reset or recover passwords for non-custodial wallets. The “reset password” link only touches the custodial account, and using it creates a new wallet and unlinks the original from your account. If you cannot remember the second password, your options are the 12-word recovery phrase or, in some cases, a password search against your wallet backup file.

Why did my Blockchain.com second password stop working?

Some users of older Blockchain.com wallets have reported a second password that suddenly stopped working after software updates. Before assuming the wallet changed, rule out small differences: capitalization, a different keyboard layout or an extra space. If you have the wallet file and your main password, those variations can be tested systematically during password recovery.

Why is my Bitcoin missing after restoring my Blockchain.com wallet?

Your bitcoin may be held at an imported address. A recovery phrase can only regenerate addresses it created, and imported keys were never derived from it; older accounts run into this most often. Check the balance directly on a block explorer such as mempool.space. If it’s still there, recovery needs the original private key or wallet file for that address, not another phrase attempt.

Why does my Blockchain.com backup phrase have 17 words?

A 17-word backup phrase is a legacy Blockchain.info recovery mnemonic, created before the wallet adopted the BIP39 standard. It encodes your password rather than your keys, so modern 12- or 24-word recovery tools cannot use it. Blockchain.com still offers a legacy route that reveals the password as it stood when the phrase was created. That is your main password, not your second password.

What are the requirements for a Blockchain.com second password?

Blockchain.com’s current help center does not document the second password at all, so there are no published rules to narrow a search. What narrows it is what you remember: the approximate length, numbers, symbols and the password patterns you commonly used at the time. Each detail you can describe makes a successful password recovery more realistic.

What is the second password for?

A second, separate lock: the wallet won’t release the private keys or move funds until it’s satisfied, even after your primary password gets you in. It only exists on wallets old enough to predate the current sign-up flow, and Blockchain.com’s current security options no longer include it.

How is the second password actually recovered?

Your wallet backup, wallet.aes.json, holds an encrypted block sealed by the second password. Tools like BTCRecover open the outer layer with your main password and test a candidate list against the inner one, with typo handling switched on, so case changes and small mistypes are treated as variations of your candidates. Where possible, the search runs on an extracted hash rather than the wallet file itself.