Bitcoin2john < Official >

Bitcoin Core uses AES-256-CBC to encrypt the wallet’s master key. When you unlock the wallet, Bitcoin Core decrypts the master key, which then decrypts private keys.

Encryption flow:

Situation: You have old_wallet.dat, 5 years old, encrypted. You think password is password123 but not sure. Bitcoin2john

# 1. Extract hash
python3 bitcoin2john.py old_wallet.dat > hash.txt
If you remember the structure (e.g., "My dog's name + 2 numbers + a symbol"), you can tell Hashcat: Bitcoin Core uses AES-256-CBC to encrypt the wallet’s
hashcat -m 11300 -a 3 ?u?l?l?l?l?l?d?d?s

This tries: 1 capital, 6 lowercase, 2 digits, 1 symbol. Situation:  You have  old_wallet
Cause: You have a descriptors wallet or a newer Hierarchical Deterministic (HD) wallet format (post-2020).
Fix: Newer Bitcoin Core versions (22.0+) use different encryption schemas. Look for bitcoin2john forks that support BIP 38 or modern descriptors, or use the --old flag if available.
If you remember part of your password (e.g., you know it started with "Satosh" but ended with a 4-digit year):
hashcat -m 11300 -a 3 btc.hash Satosh?d?d?d?d