How to Recover Your Electrum Wallet Password Using Hashcat

What is Hashcat and electrum2john?

electrum2john is a tool that extracts the password hash from your Electrum wallet file. Once you have the hash, you can use **Hashcat**, a popular password recovery tool, to attempt to recover your wallet password using brute-force techniques.

This guide will show you how to set up **Hashcat**, run it, and recover your wallet password, especially if you’ve forgotten it or need to crack it after losing access.

Step-by-Step Guide

Step 1: Download and Set Up Hashcat

Hashcat is a free tool available for Windows, macOS, and Linux. You can download it from the official site: hashcat.net.

After downloading, extract the files to a folder on your computer. You don’t need to install anything – just ensure that the **hashcat** binary is accessible from your terminal or command prompt.

Step 2: Find Your Electrum Wallet File

To use Hashcat, you first need to locate your Electrum wallet file. Here's where you can typically find it:

• Windows:

  C:\Users\YourUsername\AppData\Roaming\Electrum

• Mac:

  /Users/YourUsername/Library/Application Support/Electrum

• Linux:

  ~/.electrum

If you're having trouble finding the folder (especially on macOS or Windows), make sure to enable "Show Hidden Files" or use the "Go to Folder" feature on macOS to access hidden directories.

Step 3: Extract the Password Hash Using electrum2john

Once you've located your Electrum wallet file, you need to extract the password hash. This is where the electrum2john tool comes in.

Open your terminal or command prompt and navigate to the folder where you have downloaded **electrum2john** (usually in the John the Ripper directory). Run the following command:

python electrum2john.py /path/to/your/electrum_wallet_file

This command will output a password hash to the screen. Copy the entire hash because you’ll need it for Hashcat in the next step.

Step 4: Run Hashcat to Crack the Password

Now that you have the hash, you can use **Hashcat** to attempt to recover your Electrum wallet password. Open a terminal or command prompt and use the following command to start the cracking process:

hashcat -m 13600 -a 3 /path/to/hashfile ?a?a?a?a?a?a

Here’s what each part of this command means:

• -m 13600: This tells Hashcat that you're using an Electrum wallet hash.
• -a 3: This specifies a brute-force attack, where Hashcat will try all possible combinations of characters.
• /path/to/hashfile: The path to the file where you saved the extracted hash.
• ?a?a?a?a?a?a: This defines the character set and the length of the password. In this case, it's a brute-force attack with 6 characters (the `?a` indicates all possible characters: lowercase, uppercase, numbers, and symbols). You can adjust the length depending on your password length.

Step 5: Adding Prefixes or Suffixes (Optional)

If you remember part of your password (for example, a common word or a prefix/suffix), you can help speed up the process by telling Hashcat to add this remembered part of the password during the brute-force process.

For example, if you remember that your password starts with "bitcoin" and ends with "123", you can modify the Hashcat command like this:

hashcat -m 13600 -a 3 /path/to/hashfile bitcoin?l?l?l123

This command tells Hashcat to try the word "bitcoin" followed by 3 random lowercase letters (`?l?l?l`) and then the "123" suffix.

Step 6: Wait for Hashcat to Finish

Brute-forcing can take a long time, depending on your computer’s processing power and the complexity of your password. You’ll need to be patient and let Hashcat run its course. If the password is cracked, Hashcat will display the result in the terminal or command prompt.

Step 7: Access Your Wallet

Once Hashcat has successfully recovered the password, you can use it to access your Electrum wallet. Open your Electrum wallet and enter the password to unlock it.

Important Tips

• Brute-force Attacks Take Time: The more complex your password, the longer it will take. If you remember part of your password (such as a word or phrase), you can significantly reduce the time needed by including it as a prefix or suffix.
• Adjusting Hashcat Parameters: The above example uses a 6-character brute-force attack. If you think your password is longer or shorter, adjust the number of `?a` in the command accordingly.
• Ensure You Have the Legal Right: Only attempt to recover passwords for wallets that belong to you or that you have permission to access.