Coinomi Wallet Password Recovery

Coinomi has been one of the longest-running multi-currency mobile wallets — first released in 2014 and supporting 1,700+ assets across 125+ blockchains. Most lockouts happen when users forget the spending password set during wallet creation. The good news: if you still have access to the device (or an old backup), the password is recoverable. The bad news: if the phone was wiped and you do not have the 24-word recovery seed, your funds are unrecoverable.

How Coinomi encrypts your seed

Coinomi uses a Bitcoinj-derived wallet format with custom encryption. Each wallet is a Protocol Buffer serialization of accounts, addresses and the master seed; the seed itself is then encrypted with the spending password.

# Simplified Coinomi key derivation
salt        = random(8 bytes)            # stored in wallet
iterations  = 5000 to 16384              # depending on build
key         = PBKDF2-HMAC-SHA512(password, salt, iterations, 32)
iv          = random(16 bytes)           # stored in wallet
ciphertext  = AES-256-CBC(key, iv, plaintext_seed_bytes)
wallet_file = magic | version | salt | iterations | iv | ciphertext

The low iteration count (versus, say, Bitcoin Core's 25,000+) makes Coinomi substantially more brute-forceable than desktop wallets — but only if you have the encrypted file in hand.

Where the wallet file lives

Pulling the file from Android without root

On unrooted Android the wallet file lives inside the protected app sandbox. The only legal way to extract it without root is an unencrypted ADB backup, which works only on Android 6 and older (Google removed this on Android 12+). For Android 7-11 you can still try.

# Enable USB debugging in Developer options first
adb backup -f coinomi.ab -noapk com.coinomi.wallet
# Confirm with NO encryption password on the phone screen

# Convert .ab to .tar (Android Backup Extractor)
java -jar abe.jar unpack coinomi.ab coinomi.tar
tar -xf coinomi.tar
# Wallet file at: apps/com.coinomi.wallet/f/wallets/<UUID>

# Modern Android (12+): backup of third-party apps is blocked.
# Last resort: pay a forensic shop to image the userdata partition,
# OR root via Magisk (data-wiping on most devices).

Brute-forcing the password

Once you have the wallet file, btcrecover is the most reliable path because it understands Coinomi's exact serialization. For pure GPU throughput you can also extract a hashcat hash.

# btcrecover — Coinomi module
python3 btcrecover.py \
    --wallet wallet-uuid.wallet \
    --wallet-type coinomi \
    --tokenlist tokens.txt \
    --typos 2 --typos-case --typos-swap --typos-repeat

# Tokenlist example for "summer2019!" style passwords
# tokens.txt:
# summer winter spring fall
# 2017 2018 2019 2020
# ! @ # $

# Hashcat path (if you can extract a 28200-format hash)
hashcat -m 28200 -a 0 coinomi.hash rockyou.txt -r OneRuleToRuleThemAll.rule

Realistic GPU throughput

Scenarios — recoverable vs not

Why the seed is the only real backup

The Coinomi spending password protects the wallet file on a single device. The 24-word BIP39 seed protects the entire HD tree across all 1,700+ supported assets, on any device, forever. Always write the seed on paper or stamped metal at setup — not in a cloud notes app.

Related guides

• Exodus / Atomic / Trust Wallet recovery — sister guides for other multi-asset wallets.
• BIP39 seed recovery — partial seed recovery techniques.
• btcrecover complete tutorial — tokenlists, typos, expand strategies.
• Recovery scam taxonomy — what to never share.

Frequently asked questions