Wasabi Wallet Password Recovery

Wasabi Wallet is a Bitcoin-focused, privacy-first wallet that routes all traffic through Tor and uses Chaumian CoinJoin for trustless mixing. Unlike general multi-chain wallets, Wasabi is Bitcoin-only and designed with strong privacy guarantees. Its wallet encryption, however, follows a relatively standard pattern: a password-derived key protects the master private key inside a .ckf file.

About Wasabi Wallet

Developed by zkSNACKs, Wasabi Wallet launched in 2018 as one of the first Bitcoin wallets with built-in CoinJoin functionality. Its key features include:

• Chaumian CoinJoin — trustless Bitcoin mixing through the WabiSabi protocol
• Tor by default — all network traffic routes through the Tor network
• BIP39 seed phrases — standard 12 or 21-word recovery phrases
• .ckf wallet files — encrypted wallet containers stored locally
• Hardware wallet support — ColdCard, Trezor, and Ledger compatible

Wasabi Wallet encryption details

Locating the Wasabi wallet file

Extracting the encrypted seed

The .ckf file is a JSON document with encrypted fields. The most important field isEncryptedSeed, which contains the BIP39 seed encrypted with the password-derived key:

# Inspect a Wasabi .ckf wallet file
$ cat MyWasabiWallet.ckf | python3 -m json.tool
{
  "EncryptedSeed": "MIIGrTBX...base64...",
  "ChainCode": "A8f...base64...",
  "MasterKeyFingerprint": "a1b2c3d4",
  "SegwitExtPubKey": "zpub...",
  "AccountKeyPath": "m/84'/0'/0'",
  "Network": "MainNet",
  "CreationTime": "2025-03-15T10:30:00Z"
}

# The EncryptedSeed field is a PKCS#12/PFX blob
# Extract it to a binary file for analysis:
python3 -c "
import json, base64
with open('MyWasabiWallet.ckf') as f:
    data = json.load(f)
raw = base64.b64decode(data['EncryptedSeed'])
with open('encrypted_seed.pfx', 'wb') as out:
    out.write(raw)
print(f'Extracted {len(raw)} bytes of PKCS#12 data')
"

Attacking the encrypted seed

Wasabi uses a PKCS#12 (PFX) container to encrypt the seed material. The password is converted to a key via PKCS#12's key derivation (which uses multiple rounds of SHA-1 or SHA-256 depending on the build). There is no dedicated hashcat mode, so the attack options are:

# Option 1: Use btcrecover with custom Wasabi module
# (if available in your btcrecover build)
python3 btcrecover.py \
    --wallet-type wasabi \
    --wallet MyWasabiWallet.ckf \
    --passwordlist candidates.txt \
    --typos-capslock --typos-case

# Option 2: Custom Python attack script
pip install pycryptodome pyopenssl

python3 << 'PY'
import json, base64
from OpenSSL import crypto

# Load the encrypted PKCS#12 blob
with open("MyWasabiWallet.ckf") as f:
    data = json.load(f)
pfx_data = base64.b64decode(data["EncryptedSeed"])

# Try each candidate password
with open("candidates.txt") as f:
    for line in f:
        pw = line.strip()
        try:
            pfx = crypto.load_pkcs12(pfx_data, pw)
            # If we get here, the password is correct
            print(f"PASSWORD FOUND: {pw}")
            break
        except (crypto.Error, Exception):
            pass
PY

# Option 3: Extract hash for John the Ripper
# (if a Wasabi-specific format exists in your JtR build)
python3 wasabi2john.py MyWasabiWallet.ckf > wasabi.hash
john wasabi.hash --wordlist=candidates.txt

Recovery feasibility

Step-by-step recovery guide

1. Do not uninstall Wasabi. Find the .ckf file first — once the app is gone and the data directory cleaned, the file is unrecoverable.
2. Back up the entire WalletWasabi directory to external storage.
3. Identify your .ckf file — it will be named after your wallet label (e.g.,MyWallet.ckf).
4. Extract the EncryptedSeed field and save it as a binary PFX blob.
5. Build a candidate wordlist from your password habits. Wasabi is often used by privacy-conscious users who may have distinctive password patterns.
6. Run btcrecover or custom Python scripts against the extracted blob. Use GPU where possible for PBKDF2 acceleration.
7. If unsuccessful, submit the .ckf file to a professional recovery service. We have custom tooling for Wasabi's PKCS#12 encryption scheme.

Related guides

• Bitcoin Core wallet.dat recovery — the most common Bitcoin wallet format.
• Electrum wallet password recovery — another Bitcoin-focused wallet with different encryption.
• Hardware wallet recovery — if you used Wasabi with a ColdCard/Trezor/Ledger.

Frequently asked questions