Blockchain.com Second Password (Legacy Wallet): What to Do

You can log into your wallet, but the moment you try to send anything, a second box appears asking for a password.

Before you touch that login screen, one warning: the “reset password” link does not reset your Blockchain second password, and using it can lock you out of the wallet you’re trying to reach.

Blockchain.com cannot reset the second password

Your DeFi Wallet is self-custodial: you hold the keys, the company holds nothing. Blockchain.com states directly that it cannot reset or recover passwords for non-custodial wallets — the encryption design puts them out of reach. No support agent, no email verification, no route back through them. What it recommends instead is working through every variation you might have used, which is what a proper recovery does systematically, at a scale no person manages by hand.

Do not click “reset password”

That link resets the custodial trading account, not your self-custodial wallet. Per Blockchain.com’s own documentation, resetting your password instead of using your recovery phrase creates a new wallet and unlinks the original. Your coins stay on the blockchain. The route back to them gets much harder.

Write down what you remember first, on paper: length, numbers or symbols, a word you tend to reuse, the year you set it. Every detail removes a large number of wrong answers later.

Two passwords, two different problems

Your primary password logs you in so you can look around. The second password is a separate lock the wallet demands before it releases the private keys and lets funds move. Same door, second lock.

The second password is a legacy feature. It exists only on older wallets, and Blockchain.com’s current documentation doesn’t offer it to new users at all. If yours is still active, you need it to send anything — recovering the primary password doesn’t replace it. Lost the primary password or your Wallet ID instead? That’s the guide to a lost Blockchain.com password.

If you have your 12-word recovery phrase

This is the strongest position, with one exception.

Restoring from your phrase rebuilds the wallet from the keys themselves, so neither password stands in the way. Choose ‘Login with Recovery Phrase’, enter the words in their original order, set a new password. The phrase follows the BIP39 standard — a fixed list of 2,048 words where the last word acts as a checksum, a built-in test that rejects most wrong combinations. An “Invalid Recovery Phrase” error means the words are wrong, not that the wallet is gone.

The exception: a phrase restore does not bring back funds held in imported addresses. Blockchain.com states this twice in its own recovery article.

Never type your 12 words into any site other than the official Blockchain.com app.

“I restored with my 12 words but my bitcoin is missing”

This comes up constantly in the recovery forums, and it rarely means what people fear.

An imported address is one whose private key you brought in from elsewhere, rather than one your wallet generated from the phrase. Your phrase can only regenerate what it created. Imported keys were never derived from it, so the restored wallet looks emptied while the coins sit untouched at addresses it no longer displays.

Check the address on mempool.space before concluding anything. If the balance is still there, you need the original private key or wallet file — not another phrase attempt. Older accounts hit this more often: when Blockchain.info migrated its interface, pre-existing addresses were frequently reclassified as imported, which is why long-time users report their oldest addresses going quiet after a restore.

If you know your primary password but not the second

Recovery is often possible here.

Your wallet backup — a file named wallet.aes.json — holds an encrypted block sealed by the second password. Open-source tools such as BTCRecover can test candidates against that block, built from what you remember.

Where the format allows it, the search runs against an extracted hash rather than the live wallet file, so your file stays with you. That is also how we prefer to work: air-gapped machines, and never before a signed contract.

How to recover the second password, step by step

Here’s what the work actually consists of. It assumes you can still log in with your main password and reach the wallet file.

• Download your wallet file. You’ll need your Wallet ID and main password to pull wallet.aes.json from Blockchain.com; BTCRecover’s documentation covers the process.
• Make two copies before anything else, and work only with a copy. A damaged working file with no backup ends the attempt there.
• Write out every password you used in that period, then the variations you’d plausibly have typed. This list is what decides whether the search finishes in hours or never finishes at all.

Where possible, share only an extracted hash — never the wallet file itself.

• Run the search with typo handling switched on — case changes, deleted characters, and small mistypes get treated as variations of your candidates rather than as separate entries. That setting is what catches a password you’re certain you remember correctly.
• Stop when the space stops being finite. If your candidates run into the billions with nothing narrowing them, more computing power doesn’t change the answer.

Steps 4 and 5 are where most people stop, and handing it over at that point is a reasonable decision rather than a failure.

“It’s asking for a second password I never set”

This isn’t your memory failing.

Users with 2016-era wallets have reported for years that an upgrade prompt demanded a second password they never created, or that a working one was suddenly rejected with nothing changed at their end. Blockchain.com support was generally unable to help, which matches what its documentation says about non-custodial wallets.

So don’t stop at “I never set one.” If a second password exists on the wallet, something set it — often a variation of the primary password or one you reused in the same period. Recovery tools test exactly that: case changes, deleted characters, small typos against your known passwords.

If your backup phrase has 17 words, or 15, or 21

You have a legacy recovery mnemonic, and it does something different from what you expect.

Before BIP39, Blockchain.info issued phrases that encoded your password rather than your keys. They ran from six to twenty-five or more words on non-standard word lists, which is why the current site rejects them. Blockchain.com still provides a route to reveal the password from one.

Two limits: it returns your first password, not your second, and it returns that password as it stood when the phrase was generated. Change it afterward and what comes back is out of date.

When there’s no path forward

We’d rather tell you now than take you through weeks of work that can’t succeed.

Losing both passwords and the 12-word phrase does not by itself rule out recovery. If a usable encrypted wallet backup survives, a search for the primary password may be assessable; after opening it, the second-password search is a separate step. Blockchain.com cannot reset those non-custodial wallet passwords. Without usable wallet data, keys or a backup, there is no material to test.

The second closed door is a password you recall nothing about — no length, no characters, no habit, no era — with no access to the wallet file. With nothing to constrain the search and nothing to test against, no technique finds the answer, and anyone promising otherwise is selling something.

The people who reply to these threads

Read any public thread on this problem and the same replies sit underneath it. Free email addresses and Telegram handles offering to crack any password. Percentages quoted upfront. Accounts posting a story about losing coins and naming the “expert” who got them back. Requests to send over your wallet file.

The pattern holds every time: unsolicited replies, consumer email addresses, no company behind the name. A legitimate service works from your encrypted file or an extracted hash under a signed contract, never from your seed phrase, and never charges before a recovery succeeds.

Once you’re back in

Write the 12 words on paper — or stamp them into metal, which survives water and fire — and store them offline, away from the device. If any funds sit at imported addresses, back up those private keys separately. Your recovery phrase will never cover them, and that gap is what turns a forgotten password into a five-year problem.

If your situation involves a forgotten second password, a wallet file you can’t unlock, or an old account with imported addresses, request a confidential assessment: an honest read on whether it’s recoverable, before any commitment. You pay only on success, and you move the funds yourself, to a wallet you created.

FAQ: Blockchain.com Second Password

Can Blockchain.com reset my second password?

No — and clicking it makes things worse, not better. Blockchain.com’s own documentation is explicit that non-custodial passwords are outside its reach; the “reset password” link only touches the custodial trading side, and running it against your wallet replaces it with a new one, severing your only path back to the original.

What is the second password for?

A second, separate lock: the wallet won’t release the private keys or move funds until it’s satisfied, even after your primary password gets you in. It only exists on wallets old enough to predate the current sign-up flow — Blockchain.com stopped issuing it to new wallets some time ago.

I restored with my 12 words but my bitcoin is missing. Why?

Most likely imported addresses: a phrase can only regenerate addresses it created, and imported keys were never derived from it — pre-migration accounts run into this most often. Check the balance directly on mempool.space; if it’s still there, recovery needs the original private key or wallet file, not another phrase attempt.

How is the second password actually recovered?

Your wallet backup, wallet.aes.json, holds an encrypted block sealed by the second password. Tools like BTCRecover test a candidate list against it, with typo handling switched on, so case changes and small mistypes are treated as variations of your candidates.

I never set a second password, but it asks for one. Is my memory wrong?

Not necessarily. Users with older wallets have reported upgrade prompts demanding a second password they never created. If one exists on the wallet, something set it - often a variation of the primary password. Recovery tools test exactly those variations.