BIP-38 Explained: Passphrase-Protected Private Keys on Paper

BIP-38 is the standard for encrypting a private key on paper with a passphrase. It exists so a paper wallet can survive being seen: without the passphrase, the printed key is unreadable. In practice, BIP-38 keys show up as old paper wallets, and recovery is a passphrase problem, not a hardware problem.

What a BIP-38 key looks like

• Encrypted BIP-38 keys start with 6P (for example 6PnQ…)
• Plain private keys start with 5, K or L (WIF), or are 64-character hex
• A paper wallet may print the address alongside the encrypted key: the address is the verification target when a passphrase is tested

How the encryption works

• The passphrase is processed through scrypt, the key-derivation function fixed by the standard; the derived key then encrypts the private key with AES-256
• The scrypt parameters are part of the standard, so every attempt costs a deliberate amount of computing power: that is what makes guessing slow
• The salt is not random: it is a four-byte hash of the address the key belongs to, carried inside the 6P string itself
• Decryption checks that hash, so a wrong passphrase is reported as wrong rather than silently handing back a key for some other address

What recovery requires

• The encrypted key (6P string): the file or paper it came from
• The original address, if it was printed or written down: a useful cross-check, though the 6P string already carries the hash that rejects a wrong passphrase
• Everything you remember about the passphrase: length, words, dates, patterns

Test the passphrase offline, against the key itself — never by uploading a paper wallet or a 6P string to a website or 'paper wallet checker'. No legitimate tool asks for that.

Feasibility: the honest scale

• The encrypted BIP-38 key is the recovery target, and because the standard fixes the scrypt cost, what narrows the search is entirely what you remember of the passphrase: a known length rules out every other length, and a remembered word or pattern turns the search into testing variations of it rather than every possible string.
• You remember fragments: the search grows with every unknown character but stays bounded.
• The key itself is lost with no copy: nothing to search.

BIP-38 is a key format, not a wallet: it appears on paper and in some legacy tools. The password recovery reference explains the search side; the paper-wallet guide covers handling and sweeping the funds once the key is decrypted.