Keystore JSON Inspector

A wallet keystore is a small JSON file that tells you almost nothing by looking at it, and the one thing people most want from it — which account is this? — sits in plain text near the top. So does the setting that decides how expensive the file is to attack. The Keystore JSON Inspector reads both, along with everything else outside the encrypted part.

There is no password field on this page, and nothing is decrypted. That is deliberate rather than a missing feature: every question here is answerable from the metadata, so asking for a password would buy nothing and would train people to type a wallet password into a web page. A tool that never asks cannot be imitated by one that does.

What it reports instead is the work factor, which is the part no wallet UI shows you. Two files that look identical can differ by a factor of sixty-four in what one password guess costs an attacker.

Walkthrough: What a Wallet File Says About Itself

Load Sample opens on a scrypt keystore. The account comes back as 0xA0883514f7CE46b511A3357C8D67D82Ecfc88BCD, which is worth a second look: the standard stores the address lowercase and without a 0x, so those capitals are not in the file. They are the EIP-55 checksum derived here, and they are what lets you spot a mistyped address later. Below it the work factor reads 256 MiB of memory per password guess, from n = 262144. Press Load Sample again and the second file looks the same but reports 4 MiB, because its n is 4096. Same format, same cipher, sixty-four times cheaper to attack. The third sample switches to PBKDF2 so the parameter table changes from n/r/p to c/prf, and the fourth is broken on purpose.

The Formula Behind the Work Factor

• scrypt memory = 128 × n × r bytes. At the usual n = 262144 and r = 8 that is 256 MiB, and an attacker needs all of it for every single guess. That memory requirement is the entire reason scrypt is preferred here: it is what makes custom cracking hardware expensive rather than merely fast.
• The “light” profile some wallets write for phones drops n to 4096. The file still opens, still looks normal, and costs an attacker 4 MiB a guess instead of 256. The tool names that ratio rather than leaving you to work it out.
• n must be a power of two. If it is not, this is flagged as an error, because a compliant wallet will refuse the file outright regardless of the password.
• PBKDF2 is treated as a finding in itself. It is permitted by the standard and it needs almost no memory, so for the same nominal iteration count it parallelises across GPUs far more cheaply than scrypt. A file using it gets a note saying so.
• dklen is 32 in every ordinary keystore because the derived key is split in half: the first 16 bytes are the AES key, the second 16 feed the MAC. A different value is reported, since it means the file is not laid out the way wallets expect.

Not a Substitute for Opening the File

• “Structure is sound” says nothing about your password. The inspector confirms every field is present, correctly sized and valid hex. Whether the passphrase guarding it is guessable is a separate question this page cannot see and does not pretend to.
• Field sizes are checked against what the format requires, and a truncated file is named precisely: the fourth sample reports “The MAC is 62 hex characters, and it has to be 64 for a 32-byte Keccak-256 digest. This file is truncated or altered.” It also flags that file’s kdf, which is not one of the two the standard defines.
• Both spellings of the container are accepted, since crypto and Crypto both appear in files produced by real tools. A file carrying encseed instead gets told it is a pre-v3 wallet rather than a vague parse failure.
• The address field is optional in the specification. When it is absent the tool says so and explains the consequence: you cannot tell which account the file holds without decrypting it, which is exactly what this page will not do.
• No page should ever ask for your wallet password, including this one. If a site offering to inspect, repair or recover a keystore asks you to type it in, that is the moment to close the tab.