Forgotten 115-Character Wallet Password Recovered via GPU Typo-Bruteforce
SurvivedWallet passphrase was unavailable — a recovery path existed and access was restored.
In August 2017, a Bitcoin enthusiast created a Bitcoin Core wallet secured by a 115-character sentence-based password and wrote it down. In June 2019, when they attempted to unlock the wallet.dat file, the written password no longer worked. The user was confident no unauthorized party had modified the password, and instead suspected they had introduced typographical errors during initial setup—transposed characters, missing or added spaces, punctuation changes, or extra words never recorded.
The mathematical scope of the problem was daunting: accounting for potential variations including single character swaps, deletions, and insertions, over 330 billion combinations were theoretically possible. A brute-force attempt on the user's GTX 1070 GPU, achieving roughly 8 kilopasses per second, would require approximately 1.3 years to exhaust. Building a multi-GPU rig to accelerate the search was economically unjustifiable for an individual.
The user, experienced with Linux, command-line tools, and Python scripting, sought guidance from the BitcoinTalk community on GPU-accelerated password cracking tools. Community members recommended btcrecover, a Python-based tool designed to generate password variants algorithmically rather than requiring a pre-computed dictionary. The user downloaded the tool and began testing on Windows, though initial performance—5.2 to 6.4 kilopasses per second—underperformed expectations.
The breakthrough came on June 27, 2019, when btcrecover located the correct password in just 3 hours. Post-mortem analysis revealed the cause: the keyboard used during wallet creation had a faulty key that failed to register, causing two character deletions that were never documented in the written password. The btcrecover tool's --typos-delete option, which tests password variations with characters removed, successfully identified and restored access to the wallet.
| Stress condition | Passphrase unavailable |
| Custody system | Software wallet |
| Outcome | Survived |
| Documentation | Present and interpretable |
| Year observed | 2019 |
| Country | unknown |
Why passphrases fail years after they are set
The failure mode documented consistently across observed cases is temporal: the passphrase is set with confidence, not used for an extended period, and then cannot be reproduced exactly when needed. A single character difference — different capitalization, an added space, a slightly different special character — produces a different wallet with a zero balance. The holder may be certain they remember the passphrase while being unable to produce the exact string that was originally set.
What makes this particularly difficult is that there is no signal at the moment of failure. A wrong passphrase does not produce an error message. It opens an empty wallet. The holder sees a zero balance and typically concludes the passphrase was wrong — but without knowing which part was wrong, or by how much.
Professional passphrase recovery services can attempt permutations when the holder has partial information: they remember the general structure, typical patterns they use for passwords, the approximate length, or that it included a specific word. Recovery from total non-recollection is not feasible.
The preventive action is to store a passphrase record — not with the seed phrase, which would defeat its security purpose, but in a separate secure location accessible to the holder and potentially a designated recovery person. A passphrase that exists only in memory has a time horizon: it will eventually be forgotten, and the timing is unpredictable.
Translate