Download db from non-rooted Android to recover lost master password

@andora - The Python tool that you found only lets you decrypt the local vault if you still know the master password. To do brute force cracking, you need a tool like Hashcat. If you just want to try some combinations manually, you can also use Bitwarden’s interactive cryptography tool. In both cases, you will need the Master Key Hash, which is stored in the field keyHash in the data.json file. If you use Bitwarden’s interactive tool, you will need to first save a local copy of the HTML and edit it to increase the number of iterations in the final PBKDF2-HMAC-SHA256 hashing from 1 to 2.

So the problem that remains is that you still need a way to at the very least open the local data.json file in a text editor (to get the keyHash value).

1 Like