Forgetting the password to your own crypto wallet can feel like watching your funds disappear behind a locked door — but the assets are still on the blockchain, waiting for the right key. At Crypto Wallet Recovery Guide, we specialize in verified methods for recovering lost passwords and seed phrases from Bitcoin, Ethereum, Electrum, MetaMask, Ledger, and more. In this tutorial, we walk you through the complete RainbowHashCat password cracking workflow: combining rainbow-table-style precomputed wordlists with HashCat's powerful GPU engine to crack your own wallet password safely and offline.

⚠️ Legal Notice: Only use these techniques on wallets and files that you legally own. Cracking someone else's credentials is illegal in virtually every jurisdiction.

What Does "RainbowHashCat" Actually Mean?

"RainbowHashCat" isn't a single downloadable program — it's a practical strategy that merges two classic password-recovery concepts:

  1. Rainbow tables – giant precomputed databases mapping hashes back to plaintext passwords. They were revolutionary against unsalted hashes, but modern wallets (Bitcoin Core, Electrum, MetaMask, Ethereum keystores) all use salted, iterated key derivation (PBKDF2, Scrypt, AES). Classic rainbow tables are useless against them.
  2. HashCat – the world's fastest open-source password recovery tool, which regenerates the "rainbow" effect on the fly using rule-based mutations, mask attacks, and hybrid modes on your GPU.

In other words: instead of a static rainbow table, you build a smart, personalized candidate dictionary and let HashCat mutate it millions of ways per second. That's the modern rainbow approach — and it's the core of every serious wallet recovery operation.

Before You Begin: Safety Rules We Enforce

Security is everything in wallet recovery. Follow these rules without exception:

  • Work on an air-gapped machine. Disconnect Wi-Fi/Ethernet before handling wallet files or hashes. Your password candidates should never touch the internet.
  • Never upload your wallet file or hash to online "cracking services" or cloud GPU rentals — that's handing a stranger the keys to your vault.
  • Make forensic backups first. Copy wallet.dat, Electrum wallet files, or keystore JSON to at least two offline USB drives before touching anything.
  • Verify every download. Get HashCat only from the official site (hashcat.net) and check the PGP signature/checksum.

Step 1: Extract the Crackable Hash From Your Wallet

HashCat doesn't attack the wallet file directly — you first convert it into a hash string. Common extraction tools (all from the open-source John the Ripper suite or community scripts):

| Wallet Type | File | Extraction Tool |
|---|---|---|
| Bitcoin Core / Litecoin Core | wallet.dat | bitcoin2john.py |
| Electrum | default_wallet | electrum2john.py |
| Ethereum (Geth/MyEtherWallet) | UTC--...json keystore | Use the JSON file directly |
| MetaMask | Browser extension vault data | metamask2john.py or community extractors |

Example for Bitcoin Core:

python2 bitcoin2john.py wallet.dat > btchash.txt

Example for Electrum:

python electrum2john.py default_wallet > electrumhash.txt

Ethereum keystore cracking

Copy the resulting hash into a plain text file (e.g., hash.txt) — one hash per line. If you're also dealing with a damaged wallet.dat, pywallet can dump keys and salvage records before extraction.

Step 2: Install and Benchmark HashCat

  1. Download the latest release from hashcat.net and extract it (no installer needed — it's portable).
  2. Install current GPU drivers: NVIDIA (CUDA), AMD (ROCm/OpenCL), or Intel OpenCL runtime. HashCat can run on CPU, but a GPU is typically 10–100x faster.
  3. Verify your devices are detected:
hashcat -I
  1. Run a quick benchmark for your target mode (example: Bitcoin wallet mode 11300):
hashcat -m 11300 -b

Step 3: Choose the Correct Hash Mode

Using the wrong mode is the #1 beginner mistake — HashCat will simply never crack it. Reference table:

| Wallet | HashCat Mode |
|---|---|
| Bitcoin / Litecoin wallet.dat | 11300 |
| Ethereum Keystore (PBKDF2-SHA256) | 15600 |
| Ethereum Keystore (Scrypt) | 15700 |
| Ethereum Presale wallet | 16300 |
| Electrum wallet (Salt-Type 1–3) | 16600 |
| Electrum wallet (Salt-Type 4) | 21700 |
| Electrum wallet (Salt-Type 5) | 21800 |
| MetaMask vault | 26600 / 26610 |

Note that Scrypt-based modes (15700) are extremely slow by design — even a top GPU may only try a few thousand candidates per second. That's why candidate quality beats raw speed.

Step 4: Build Your "Rainbow" Wordlist

This is where the rainbow-table mindset pays off. Since real rainbow tables don't work on salted wallet hashes, you build a targeted dictionary from everything you know about your own password habits:

  • Old passwords you've used on exchanges, email, or forums
  • Names, birthdays, phone numbers, pet names, favorite teams
  • Common substitutions you favor: a→@, o→0, e→3, s→$
  • Year suffixes: 2017, 2018, 2020!

Bitcoin wallet.dat password crack

  • Keyboard patterns: qwerty, 1qaz2wsx

Start from a base list like rockyou.txt, then stack your personal candidates on top. HashCat's rule engine multiplies a modest list into billions of variants — your on-the-fly rainbow table:

# Popular rule sets shipped with HashCat:
rules/best64.rule
rules/dive.rule
rules/OneRuleToRuleThemStill.rule

Step 5: Run the Attacks (In This Order)

Attack 1 — Straight Dictionary (-a 0)

hashcat -m 11300 -a 0 -w 3 hash.txt mycandidates.txt

Attack 2 — Dictionary + Rules (the "rainbow mutation" step)

hashcat -m 11300 -a 0 -w 3 hash.txt mycandidates.txt -r rules/best64.rule

Scale up to dive.rule or OneRuleToRuleThemStill.rule if the first pass fails.

Attack 3 — Hybrid: Wordlist + Mask (-a 6)

Perfect if you remember the base word but not the trailing digits/symbols:

hashcat -m 11300 -a 6 -w 3 hash.txt mycandidates.txt ?d?d?d?d

Attack 4 — Pure Mask / Brute Force (-a 3)

Only practical for short passwords or when you recall the structure (e.g., capital letter + 5 lowercase + 2 digits):

hashcat -m 11300 -a 3 -w 3 hash.txt ?u?l?l?l?l?l?d?d

Session management for long runs:

crypto wallet recovery guide

hashcat -m 11300 -a 0 hash.txt mycandidates.txt -r rules/dive.rule --session walletjob
hashcat --session walletjob --restore   # resume after interruption

Press s during a run to see live speed and progress.

Step 6: Read Your Recovered Password

When HashCat cracks the hash, it writes the result to the potfile. View it anytime with:

hashcat -m 11300 hash.txt --show

The output shows hash:password. Test the password on a copy of your wallet offline first, then move funds to a fresh wallet with a brand-new, properly backed-up password.

Realistic Speed Expectations

  • Mode 11300 (Bitcoin Core): tens to hundreds of thousands of attempts/sec on a modern GPU.
  • Mode 15700 (Ethereum Scrypt): often only a few thousand/sec — your wordlist quality decides everything.
  • If cracking will take years at your rate, don't despair: use btcrecover with token lists (fragments of what you remember) to dramatically shrink the search space. btcrecover is also the go-to tool for seed phrase recovery — fixing typos, missing words, or wrong word order in a BIP39 12/24-word mnemonic.

Offline Security During and After Recovery

  1. Keep the cracking machine offline for the entire operation.
  2. After success, securely wipe temporary files, wordlists containing personal data, and the potfile (shred -u on Linux, cipher /w on Windows).
  3. Sweep funds to a new wallet immediately — assume the old password is now "burned."

Prevent the Next Lockout

Recovery is stressful; prevention is free:

  • Multiple redundant backups of seed phrases on paper and stamped metal plates, stored in separate locations.
  • Shamir/sharded storage (e.g., SLIP-39 or manual 2-of-3 splitting) so no single point of failure exists.
  • Record password hints (not the password itself) alongside backups.
  • Test-restore your wallet from backup at least once a year.

Conclusion

The RainbowHashCat approach — personalized wordlists, rule-driven mutation, and disciplined offline execution — gives you the best odds of reclaiming a password-locked Bitcoin, Ethereum, Electrum, or MetaMask wallet. Combined with btcrecover for BIP39 seed phrase issues and pywallet for damaged wallet.dat files, you have a complete, self-custodied recovery toolkit.

Want the full walkthrough with downloadable checklists, hash-mode cheat sheets, and seed phrase repair tutorials? Visit Crypto Wallet Recovery Guide today — from basic troubleshooting to advanced scripted recovery, we help you minimize loss and take back control of your assets.