BlueWallet Password Recovery

BlueWallet is one of the most popular mobile Bitcoin wallets, supporting both on-chain transactions and the Lightning Network. It is available for iOS and Android. Because it is a mobile-first wallet, the encrypted seed material lives inside the app sandbox — which makes extraction significantly harder than desktop wallets. However, BlueWallet's Export Wallet feature provides a path to obtain an encrypted JSON backup that can be attacked offline.

About BlueWallet

Developed by BlueWallet Services, BlueWallet is an open-source, MIT-licensed mobile Bitcoin wallet. It was one of the first mobile wallets to integrate Lightning Network support through embedded LND nodes. Key characteristics:

• React Native — cross-platform mobile framework (iOS and Android)
• BIP39 seeds — standard 12 or 24-word recovery phrases for HD wallets
• Lightning Network — embedded LND nodes with AEZ-encrypted channel state
• AsyncStorage — React Native's persistence layer (SQLite on iOS, RocksDB on Android)
• End-to-end encrypted vault — wallet seeds encrypted at rest with user password

BlueWallet encryption details

Extracting the wallet data

Unlike desktop wallets, BlueWallet's data is locked inside the mobile app sandbox. There are three extraction paths, listed from easiest to hardest:

Method 1: Export Wallet (recommended)

If you can still open BlueWallet (you remember your PIN / Face ID but not the wallet password), navigate to Settings → Wallets → Select a wallet → Export Wallet. This creates a JSON file containing the encrypted seed material. Save this file to cloud storage or email it to yourself.

# Exported BlueWallet JSON structure (example)
{
  "label": "My Bitcoin Wallet",
  "type": "bitcoin",
  "derivationPath": "m/84'/0'/0'",
  "encryptedSeed": "U2FsdGVkX1...base64...",
  "encryptedMnemonic": "U2FsdGVkX1...base64...",
  "masterFingerprint": "a1b2c3d4",
  "network": "mainnet"
}

# The encryptedSeed and encryptedMnemonic fields contain
# AES-256-CBC encrypted data with the password-derived key

Method 2: iCloud / Google Drive backup

BlueWallet optionally backs up encrypted data to iCloud (iOS) or Google Drive (Android). If enabled, you can restore the backup to another device and then export the wallet JSON. This is useful if your phone is lost or damaged but you still have cloud backup access.

Method 3: Device extraction (advanced, root required)

On a rooted Android device, you can pull the AsyncStorage database directly via ADB:

# Android (rooted) — pull BlueWallet storage
adb root
adb pull /data/data/io.bluewallet.bluewallet/databases/react-native-database

# iOS (jailbroken) — locate the SQLite database
# Usually at: /var/mobile/Containers/Data/Application/[UUID]/Library/Preferences/
# File: io.bluewallet.bluewallet.plist or react-native database

# The data is encrypted at rest — you still need the password

Attacking the exported wallet JSON

Once you have the exported JSON, the encrypted seed field can be attacked with a custom Python script. BlueWallet uses AES-256-CBC with a password-derived key. The exact KDF parameters depend on the app version:

# Custom Python attack on BlueWallet exported JSON
pip install pycryptodome

python3 << 'PY'
import json, base64, hashlib
from Crypto.Cipher import AES

with open("bluewallet-export.json") as f:
    data = json.load(f)

# The encrypted seed is typically in "encryptedSeed" or "encryptedMnemonic"
enc_data = base64.b64decode(data["encryptedSeed"])

# BlueWallet uses OpenSSL's EVP_BytesToKey with MD5 for key derivation
# Salt is the first 8 bytes of the encrypted data
SALT_MAGIC = b"Salted__"
if enc_data[:8] == SALT_MAGIC:
    salt = enc_data[8:16]
    ciphertext = enc_data[16:]
else:
    # Some versions use raw PBKDF2
    salt = enc_data[:32]       # first 32 bytes = salt
    iv = enc_data[32:48]       # next 16 bytes = IV
    ciphertext = enc_data[48:]

with open("wordlist.txt", encoding="utf-8", errors="ignore") as f:
    for line in f:
        pw = line.strip()
        if not pw:
            continue
        try:
            # Try PBKDF2-SHA256
            key = hashlib.pbkdf2_hmac("sha256", pw.encode(), salt, 20000, 32)
            cipher = AES.new(key, AES.MODE_CBC, iv)
            pt = cipher.decrypt(ciphertext)
            pad = pt[-1]
            if 1 <= pad <= 16 and pt[-pad:] == bytes([pad]) * pad:
                print(f"PASSWORD FOUND: {pw}")
                break
        except Exception:
            pass
PY

Lightning Network recovery — additional complexity

If you used BlueWallet's Lightning Network feature, recovery is more complex than on-chain Bitcoin. Lightning wallets have two components that must both be recovered:

• On-chain wallet — recovered from the BIP39 seed phrase or the encrypted seed field
• Lightning channel state — stored in the LND data directory with AEZ encryption

Even if you recover the BlueWallet password, Lightning channel state is encrypted separately with LND's AEZ scheme. The practical path for Lightning recovery is:

1. Recover the on-chain wallet (password or seed phrase)
2. Use LND's chanbackup or SCB (Static Channel Backup) to restore channels
3. If no SCB exists, each channel must be force-closed individually — requiring the channel state file

Recovery feasibility

Step-by-step recovery guide

1. If the app still opens, export every wallet JSON via Settings → Wallets → Export Wallet. Save each JSON file to a secure location.
2. Extract the encryptedSeed field from each JSON file. Identify the KDF parameters based on file structure (look for "Salted__" prefix or explicit salt/IV fields).
3. Build a candidate wordlist from your remembered password habits and any hints.
4. Run a custom Python attack or use btcrecover if a BlueWallet module is available.
5. If Lightning funds are involved, check for Static Channel Backup files in any app backup. Without SCB, Lightning recovery requires the LND channel database file.
6. If all else fails, submit the exported JSON files to a professional recovery service.

Related guides

• Electrum wallet password recovery — desktop Bitcoin wallet with better extraction options.
• Bitcoin Core wallet.dat recovery — older but more standard file format.
• Phantom wallet recovery — another mobile-first wallet with similar challenges.

Frequently asked questions