Search key, WIF, mnemonic across 18 chains CtrlK

Wallet.dat Vulnerability Scanner

Upload a Bitcoin Core wallet.dat and scan it for every weakness — then dump the recoverable private keys.

Detects unencrypted keys, weak KDF, slack-space / deleted keys and HD-seed exposure; for encrypted wallets it extracts the hashcat -m 11300 hash. All analysis is local — your file never leaves the browser.

Click to select or drag & drop

wallet.dat file (Bitcoin Core / BDB or descriptor)

-
-
Optional. If you know the passphrase, the scanner will decrypt and dump the keys (no brute-forcing). For the encrypted sample below, the passphrase is test123.
Sample Wallet Files (crafted test fixtures)

Synthetic wallets built to demonstrate the scanner. They contain real key material (test keys, no funds) so every check produces a live result.

test-unencrypted.dat
UNENCRYPTED Plaintext key → V1 critical, keys dumped
test-encrypted.dat
ENCRYPTED $bitcoin$ hash • passphrase test123
Scanning wallet for vulnerabilities...
Format
-
Encrypted
-
Recoverable Keys
0
Vulnerabilities
0
Vulnerabilities Found
Recovered Private Keys
Private Key (HEX) WIF Address Source
Security Warning:
  • This tool is for authorized security testing and education — only scan wallets you own or are authorized to analyze.
  • All analysis is done locally — your wallet file never leaves your browser (no upload).
  • The extracted $bitcoin$ hash is for offline passphrase auditing with hashcat / John; the tool does not brute-force here.
  • For maximum safety, run this on an offline / air-gapped computer, and move funds to a fresh wallet after any recovery.
Wallet Viewer Mnemonic Converter

What does the Wallet.dat Vulnerability Scanner do?

It performs a security audit of a Bitcoin Core wallet.dat file entirely in your browser. Instead of only viewing keys, it raw-scans the Berkeley DB (or SQLite descriptor) structure for every recoverable weakness and classifies each finding by severity, then dumps the private keys it can recover without a passphrase.

Which vulnerabilities are detected?

Unencrypted wallets (V1): plaintext key records mean anyone with the file can spend — every key is dumped as hex, WIF and address. Offline-crackable KDF (V2): for encrypted wallets the master-key mkey is turned into a hashcat -m 11300 $bitcoin$ hash for offline passphrase auditing. Weak KDF iterations (V3): a low SHA-512 round count is flagged. Slack-space / deleted keys (V4): leftover plaintext keys recovered by byte-scan even in an "encrypted" wallet. HD-seed exposure (V5): an hdseed/hdchain record that controls every derived key.

How is the encrypted-wallet hash built?

Bitcoin Core encrypts private keys with AES-256-CBC using a master key derived from your passphrase via many rounds of SHA-512 (EVP_BytesToKey). The scanner reads the encrypted master key, salt and iteration count from the mkey record and one ckey + public key, and formats them exactly like bitcoin2john.py so the hash drops straight into hashcat mode 11300 or John the Ripper.

Is my wallet file uploaded anywhere?

No. The file is read with the browser's FileReader API and all parsing, hashing and decryption happen in JavaScript / WebCrypto on your machine. Nothing is sent to a server. For sensitive wallets, use the tool on an offline computer.