You can log into your wallet, but the moment you try to send anything, a second box appears asking for a password.
Before you touch that login screen, one warning: the “reset password” link does not reset your Blockchain second password, and using it can lock you out of the wallet you’re trying to reach.
Blockchain.com cannot reset the second password
Your DeFi Wallet is self-custodial: you hold the keys, the company holds nothing. Blockchain.com states directly that it cannot reset or recover passwords for non-custodial wallets — the encryption design puts them out of reach. No support agent, no email verification, no route back through them. What it recommends instead is working through every variation you might have used, which is what a proper recovery does systematically, at a scale no person manages by hand.
Do not click “reset password”
That link resets the custodial trading account, not your self-custodial wallet. Per Blockchain.com’s own documentation, resetting your password instead of using your recovery phrase creates a new wallet and unlinks the original. Your coins stay on the blockchain. The route back to them gets much harder.
Write down what you remember first, on paper: length, numbers or symbols, a word you tend to reuse, the year you set it. Every detail removes a large number of wrong answers later.
Two passwords, two different problems
Your primary password logs you in so you can look around. The second password is a separate lock the wallet demands before it releases the private keys and lets funds move. Same door, second lock.
The second password is a legacy feature. It exists only on older wallets, and Blockchain.com’s current documentation doesn’t offer it to new users at all. If yours is still active, you need it to send anything — recovering the primary password doesn’t replace it. Lost the primary password or your Wallet ID instead? That’s the guide to a lost Blockchain.com password.
If you have your 12-word recovery phrase
This is the strongest position, with one exception.
Restoring from your phrase rebuilds the wallet from the keys themselves, so neither password stands in the way. Choose ‘Login with Recovery Phrase’, enter the words in their original order, set a new password. The phrase follows the BIP39 standard — a fixed list of 2,048 words where the last word acts as a checksum, a built-in test that rejects most wrong combinations. An “Invalid Recovery Phrase” error means the words are wrong, not that the wallet is gone.
The exception: a phrase restore does not bring back funds held in imported addresses. Blockchain.com states this twice in its own recovery article.
Never type your 12 words into any site other than the official Blockchain.com app.
“I restored with my 12 words but my bitcoin is missing”
This comes up constantly in the recovery forums, and it rarely means what people fear.
An imported address is one whose private key you brought in from elsewhere, rather than one your wallet generated from the phrase. Your phrase can only regenerate what it created. Imported keys were never derived from it, so the restored wallet looks emptied while the coins sit untouched at addresses it no longer displays.
Check the address on mempool.space before concluding anything. If the balance is still there, you need the original private key or wallet file — not another phrase attempt. Older accounts hit this more often: when Blockchain.info migrated its interface, pre-existing addresses were frequently reclassified as imported, which is why long-time users report their oldest addresses going quiet after a restore.
If you know your primary password but not the second
Recovery is often possible here.
Your wallet backup — a file named wallet.aes.json — holds an encrypted block sealed by the second password. Open-source software like BTCRecover tests candidates against that block methodically, working through a search space built from what you remember. The main password unlocks the outer layer; the search runs against the inner one. BTCRecover’s own documentation says OpenCL acceleration on these wallets can deliver at least a tenfold improvement over processor-only searching.
Where the format allows it, the work runs against an extracted hash rather than the live wallet. BTCRecover ships a script that pulls the second password’s hash, salt, and iteration count out of the file as a short base64 string, and everything after that runs against those few characters. Your wallet file stays with you and the password itself never has to be seen — where technically possible, that’s how we prefer to work. Recovery happens on always air-gapped machines, and we never start before a contract is signed.
How to recover the second password, step by step
Here’s what the work actually consists of. It assumes you can still log in with your main password and reach the wallet file.
- Download your wallet file. You’ll need your Wallet ID and main password to pull
wallet.aes.jsonfrom Blockchain.com; BTCRecover’s documentation covers the process. - Make two copies before anything else, and work only with a copy. A damaged working file with no backup ends the attempt there.
- Write out every password you used in that period, then the variations you’d plausibly have typed. This list is what decides whether the search finishes in hours or never finishes at all.
- Extract the hash instead of using the live file. A script in BTCRecover’s extract folder pulls the second password’s hash, salt, and iteration count out as a short base64 string, and the search then runs against those characters rather than your wallet.
- Run the search with typo handling switched on — case changes, deleted characters, and small mistypes get treated as variations of your candidates rather than as separate entries. That setting is what catches a password you’re certain you remember correctly.
- Stop when the space stops being finite. If your candidates run into the billions with nothing narrowing them, more computing power doesn’t change the answer.
Steps 4 and 5 are where most people stop, and handing it over at that point is a reasonable decision rather than a failure.
“It’s asking for a second password I never set”
This isn’t your memory failing.
Users with 2016-era wallets have reported for years that an upgrade prompt demanded a second password they never created, or that a working one was suddenly rejected with nothing changed at their end. Blockchain.com support was generally unable to help, which matches what its documentation says about non-custodial wallets.
So don’t stop at “I never set one.” If a second password exists on the wallet, something set it — often a variation of the primary password or one you reused in the same period. Recovery tools test exactly that: case changes, deleted characters, small typos against your known passwords.
If your backup phrase has 17 words, or 15, or 21
You have a legacy recovery mnemonic, and it does something different from what you expect.
Before BIP39, Blockchain.info issued phrases that encoded your password rather than your keys. They ran from six to twenty-five or more words on non-standard word lists, which is why the current site rejects them. Blockchain.com still provides a route to reveal the password from one.
Two limits: it returns your first password, not your second, and it returns that password as it stood when the phrase was generated. Change it afterward and what comes back is out of date.
When there’s no path forward
We’d rather tell you now than take you through weeks of work that can’t succeed.
If you’ve lost your primary password, your second password, and your 12-word phrase, no recovery route exists. Blockchain.com requires both passwords to move funds and cannot restore either, and without the phrase there’s no key underneath to rebuild from.
The second closed door is a password you recall nothing about — no length, no characters, no habit, no era — with no access to the wallet file. A search needs constraints to be a search. With none, and nothing to test against, no technique finds the answer, and anyone promising otherwise is selling something.
The people who reply to these threads
Read any public thread on this problem and the same replies sit underneath it. Free email addresses and Telegram handles offering to crack any password. Percentages quoted upfront. Accounts posting a story about losing coins and naming the “expert” who got them back. Requests to send over your wallet file.
The pattern holds every time: unsolicited replies, consumer email addresses, no company behind the name. A legitimate service works from your encrypted file or an extracted hash under a signed contract, never from your seed phrase, and never charges before a recovery succeeds.
Once you’re back in
Write the 12 words on paper — or stamp them into metal, which survives water and fire — and store them offline, away from the device. If any funds sit at imported addresses, back up those private keys separately. Your recovery phrase will never cover them, and that gap is what turns a forgotten password into a five-year problem.
If your situation involves a second password you partly remember, a wallet file you can reach but can’t unlock, or an old account with imported addresses, Crypto Recovers offers a free assessment: tell us what you have and you’ll get an honest read on whether it’s recoverable, before committing to anything, on a No Cure No Pay basis. Your coins never pass through our hands and we hold no access to them at any stage. When a recovery lands, you make the transfer yourself into a wallet you set up, and you send the agreed percentage yourself in the same session, with both parties present.
