Wallet
Ethereum Keystore Recovery Service
Forgot the password to your Ethereum keystore (UTC/JSON) file, or is the file damaged or deleted? We test password candidates against a copy, offline. Free assessment; no recovery, no fee.
Request an assessment+31 85 109 1211
- Since 2019Recovery specialist
- KvK 75927276Registered in the Netherlands
- AmsterdamPhysical office
- Non-custodialYou move the coins
Quick answers
Is a keystore file enough to recover ETH?
Not by itself. The keystore is the encrypted private key: only the correct password decrypts it, so the file plus what you remember of the password is what a search works from.
Does scrypt vs PBKDF2 matter?
Yes. PBKDF2 files test candidates faster than scrypt, which changes how large a search is realistic.
Can the password be reset?
No. There is no reset button or support ticket for a keystore; recovery is a password search on a copy.
Our Ethereum keystore recovery services
Forgotten keystore password
The UTC/JSON file is intact, but the password will not come back. Recovery is a password search: candidates are tested against the file's own key derivation (scrypt or PBKDF2), always on a copy, offline. What you remember, such as a base word, the length, a year, the symbols you tend to use or the keyboard layout, decides how large that search is and whether it is realistic. How keystore password recovery works
Keystore password rejected
A rejected password is not always a forgotten one. A typo, a capital letter, a different keyboard layout or an accented letter entered another way produces a different password, and testing the wrong file gives the same error. Testing variations of a password you know is one of the more recoverable cases. Wallet password rejected
Lost or deleted keystore file
Without the file or a backup there is nothing to test, and an address alone cannot be turned back into a key. A deleted file can sometimes be brought back from the drive that held it, as long as nothing has overwritten it. Search old drives, USB sticks, email attachments and cloud folders for file names that start with UTC--. Wallet on a broken computer or drive
Damaged or corrupted keystore file
Damage to the formatting around an intact encrypted key can usually be repaired. If the encrypted key itself was overwritten, no one can bring it back. Corrupted wallet file
Old MyEtherWallet, Mist or Geth keystore
The software that created the file does not have to run, and the coins never lived inside it. A current wallet that imports JSON keystores opens the account with the file's password. When the password is the problem, the file's own encryption settings show how expensive each candidate is, which shapes the search. MyEtherWallet recovery
Several keystore files, unsure which one is funded
A keystore usually carries its address in plain text, in the file and in its name. That address can be checked on a block explorer without the password, so the funded file is identified before any search starts. We match old files and notes to the address that holds the funds. How wallet files are identified
Before you contact us
Mistakes to avoid
- Don't upload a keystore file to a website or an online "checker", and don't paste its contents anywhere. Work only on copies, offline.
- Don't rename the file or edit its contents. It has to stay valid JSON to open.
- Don't send the keystore file or its password through a contact form, email or chat, not even to us.
- Don't keep using, format or reinstall a computer whose drive held a deleted keystore file.
- Don't download recovery or cracking tools from search results, ads or direct messages. A fake tool can steal both the file and the password.
- Never give your recovery phrase to anyone who says a keystore needs it. It does not.
Information that helps the assessment
- Which software created the file, such as MyEtherWallet, Mist, Geth or another client, and roughly when.
- The wallet address, if you can see it in the file name or the file. It can be checked on a block explorer without the password.
- What you remember about the password, such as its length, the character types, a year or symbols in it, the keyboard layout you used then and whether it followed a pattern you used elsewhere. Describe it; don't send it.
- Whether you have several keystore files or copies, and where each one came from.
- What happened, and what you have already tried.
Boundaries
What we do not do
Theft, scams or a wrong address
A confirmed blockchain transaction cannot be reversed, cancelled or redirected, by us or by anyone.
A completely lost recovery phrase
With no phrase, wallet file, device, backup or partial information left, there is nothing to reconstruct from.
Guaranteed outcomes
No honest service can guarantee success. Whether recovery is possible depends on what you still have, and the assessment tells you before you commit.
We tell you honestly what is realistic before you commit — including when the answer is no.
How it works
A clear process from first contact to handover.
Tell us what happened
Share the wallet or software name, approximate year, device, problem and what material still exists. Do not send a seed phrase, private key, password, wallet file or ID document.
Initial feasibility view
Once we have enough information, we usually explain the likely recovery route, the main uncertainties and an initial indication of duration.
Verify and agree
We verify identity and ownership or legal authority. Scope, working method, fee and sensitive-material handling are agreed in writing before sensitive work begins.
Transfer or hand over material
PGP, our secure encrypted upload environment, in-person handover or agreed shipment may be used. We request only what is needed and work with copies where possible.
Technical recovery
We test the agreed recovery route in a controlled environment. You receive meaningful updates when findings affect the outlook, scope or next decision.
Client-controlled handover
Access is handed back through the agreed route. You open the wallet and move the assets to a wallet you control; case material is then handled according to the agreement and privacy policy.
Trust
A real company with a verifiable process.
Registered & named
Registered in the Netherlands (KvK 75927276) with a named team and a physical office in Amsterdam.
A written agreement first
Scope, fee and security measures are agreed in writing before any work. If you prefer, we can sign an NDA before you share substantive case details.
Always non-custodial
We restore access; you move the coins yourself. We never hold, manage or transfer your assets.
Ownership is verified
Identity, ownership and legal authority are verified with risk-based KYC/AML checks.
Good to know about Ethereum keystore recovery
- What is inside the file. A keystore is a small JSON document: the encrypted private key, the cipher, the key derivation function (kdf) with its parameters, and a MAC that confirms whether a password is right. It usually also holds the wallet address. The password is not stored anywhere in the file.
- scrypt and PBKDF2. Geth writes scrypt by default; some clients, such as Parity, used PBKDF2. The function and its work factor, such as the number of iterations, are stored in the file itself. Fewer iterations or a lighter setting mean candidates test faster, so more of them fit in the same time. The wallet's age remains a useful clue, both to the software that wrote the file and to the passwords you used then.
- The honest limits. A password with no remembered base, habit or fragment leaves a search too large to finish. If the coins already left the address, no one can undo that transfer: the keystore opens what it opens. How password recovery works
- After access is restored. Create a fresh wallet and move the funds yourself. An old keystore with a reused password is a risk, and it protects a single key with a single password.
Ethereum keystore recovery FAQ
Where are Ethereum keystore files stored?
Geth, and Mist, which ran on Geth by default, keep them in the keystore folder of the Ethereum data directory: ~/Library/Ethereum/keystore on a Mac, ~/.ethereum/keystore on Linux, and AppData\Roaming\Ethereum\keystore or AppData\Local\Ethereum\keystore on Windows. A MyEtherWallet keystore was a file you downloaded, so check old download folders and USB sticks. The file name usually starts with UTC--.
Can I open my keystore file in MetaMask?
Yes, if you know the password. The MetaMask browser extension imports a JSON file with the file's own password, not your MetaMask password; the mobile app cannot. The imported account is not covered by MetaMask's Secret Recovery Phrase, so keep the keystore and its password safe, or move the funds to a new wallet.
Do I need my recovery phrase to open a keystore file?
No. A keystore is a separate backup of one private key, and it only needs its own password. Anyone who asks for your recovery phrase to "recover" a keystore is following a scam pattern.
Is a 2014 presale wallet file a keystore file?
No. The presale file is an older format with fields such as encseed and ethaddr and its own password, while a keystore has fields such as crypto, kdf and mac. A wallet that imports keystores will not necessarily accept a presale file. Ethereum presale wallet recovery
How much does crypto wallet recovery cost?
It depends on the wallet's value and how complex the case is: our success fee runs from 20% of the recovered amount down to 2%. The exact rate is agreed in writing before any work starts — no hidden costs and no hourly rates.
Do you take custody of the assets at any point?
No. We restore access; you open the wallet and move the funds yourself. We cannot initiate a transaction on your behalf.
Do I need to send my seed phrase or password?
No — first contact needs no sensitive material, and we never ask for it through forms or chat. Under a written agreement we can work with copies of wallet files in a controlled environment, so your keys stay under your control.
What if my wallet was stolen or I was scammed?
We do not take stolen-crypto or scam cases, and blockchain transactions cannot be reversed. That is a police and legal matter.
