12

I have a Windows installation that cannot be booted anymore.

I'd like to copy the file containing the Metamask wallet seed to another machine and have that Metamask installation use it.

The same Metamask accounts were installed on both Firefox and Chrome on that Windows installation.

Does anyone know where the Metamask plugin stores its keys or wallet seed?

(I do not have the wallet recovery phrase, I do have the password)

Edit: I put together a python script that can extract the vault data from the Firefox data files: https://github.com/JesseBusman/FirefoxMetamaskWalletSeedRecovery Read the code. Don't run it if you don't understand it.

3
  • I tried to follow both suggestions and I can not find this vault or data value. What am I missing? The drive I have is from a Windows 7 build
    – Aesedai
    Mar 2, 2021 at 19:02
  • Question, what happens if I know that the seed phrase is correct but it is giving me access to a wallet that is empty? May 18, 2021 at 1:25
  • What about linux distros or specifically ubuntu? I find hard to allocate the directory where all these information reside.
    – NinjaMAN
    Aug 13, 2021 at 5:16

3 Answers 3

12

If you were using the Google Chrome browser in Windows 10, you should be able to find the location of the Vault by going to this folder location (you need to be able to see the hidden files):

C:\Users\USER_NAME\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn

In that folder you'll see a file called 000003 (or something like that), open that file with a text editor or code editor software like Atom (https://atom.io/).

MetaMask vault location in Windows 10 for Chrome

In the text editor search for the word "vault" and copy this part that looks like the one pasted below:

{"vault":"{\"data\":\"wwpXXtFCqZkYsWfeEwItZjJ0Cc7mRVjG47Dqh+ztL1PiCG6Izhg+zG0mM+H2ykyjz3X0RNhAE6IVsWFZamcZ47B4sVi4SvUxrMhARm5L3yHPxr3UsyGrOXmthyVMgEGmjwlmnFCNd2nMZ2o8/sRMra8FupurqevnBv57FiYpEEs7gPpFHv6587aL44MmKD8Snv4JLFqiqmlK82Waq5F+Iv9mw2sFVAL9mgZBSgFgbWdB3TsKVB2k\",\"iv\":\"rkUQlNcGTxBE0My7a/bCXw==\",\"salt\":\"HcKyNfGzaRALRQ0DlKgcIe5Uk30iI/M//oG6w8vX8Nk=\"}"}

Remove the two parts in bold. Now use the Search and Replace feature of the editor to change all the \" to "

You would now have something like this:

{"data":"wwpXXtFCqZkYsWfeEwItZjJ0Cc7mRVjG47Dqh+ztL1PiCG6Izhg+zG0mM+H2ykyjz3X0RNhAE6IVsWFZamcZ47B4sVi4SvUxrMhARm5L3yHPxr3UsyGrOXmthyVMgEGmjwlmnFCNd2nMZ2o8/sRMra8FupurqevnBv57FiYpEEs7gPpFHv6587aL44MmKD8Snv4JLFqiqmlK82Waq5F+Iv9mw2sFVAL9mgZBSgFgbWdB3TsKVB2k","iv":"rkUQlNcGTxBE0My7a/bCXw==","salt":"HcKyNfGzaRALRQ0DlKgcIe5Uk30iI/M//oG6w8vX8Nk="}

You can now go to the Vault Decryptor https://metamask.github.io/vault-decryptor/ and paste that in the textfield there, enter the password you set for the extension when you created your MetaMask wallet. You should be able to see your seed phrase and any manually imported private key below if you click the Decrypt button.

2

You have to find metamask chrome-extension local storage file, you can find relevant info here: https://github.com/MetaMask/metamask-extension/issues/2749 For windows I think it is : %AppData%\Google\Chrome\User Data\Default\Local Storage

and then use vault decryptor tool to get seed back.

1

As for Firefox on the Mac, this is what I've found so far:

  1. You type about:support as a URL, and can find some application basics, in which you locate the Profile Folder, which would lead you to a path like this:

    /Users/yourusername/Library/Application Support/Firefox/Profiles/e1609rfy.default-release

  2. To locate the storage of the extensions go inside here:

    /Users/yourusername/Library/Application Support/Firefox/Profiles/e1609rfy.default-release/storage/default

and you will find some folders whose name starts with moz-extension+++. To know which one we want we can type this in the browser: about:debugging#/runtime/this-firefox, which will give us info about the internal UUID of the MetaMask extension.

  1. So, inside this path:

    /Users/yourusername/Library/Application Support/Firefox/Profiles/e1609rfy.default-release/storage/default/moz-extension+++f7cb631f-2aa4-3b46-a3aa-403bad620ed2^userContextId=4294967295/

you can just find a subfolder called "idb", and inside that you find a file with an .sqlite extension and another subfolder which is likely empty.

I guess that the .sqlite file is the one we're after, because if I close Firefox and I remove it, my metamask loses the wallet and asks me if I want to create a new one or import one.

Documentation about this kind of files seem to be here: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API or https://stackoverflow.com/questions/54920939/parsing-fb-puritys-firefox-idb-indexed-database-api-object-data-blob-from-lin . I haven't investigated further, please expand this answer or create a new answer copy+pasting this content and amplifying it, I don't mind.

3
  • I inspected the sqlite DB. Removing MM results in records being deleted from the object_data table, which seems to be the extension storage managed by firefox. Removing the extensions won't remove the file though, leaving an indication of a past installation. ( on Linux, Firefox ESR )
    – tux_mind
    Dec 14, 2021 at 1:29
  • @tux_mind: maybe you prefer to edit my answer? I'm not sure what your comment means; btw did you access the sqlite DB via the method posted here?: stackoverflow.com/a/59923297/1623521 Dec 15, 2021 at 10:22
  • Forgive me if I wasn't clear @user1623521 . No, I didn't inspect the value of the stored objects, I just confirmed that by removing the extension from FF, that record is deleted from the sqlite3 DB.
    – tux_mind
    Dec 16, 2021 at 11:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.