We often get questions from clients who wonder what Blockchain.com’s requirements were for creating passwords at the time that they created their wallet. We examined Blockchain’s public code repositories, including older versions, to check how its wallet password requirements changed over time.
One interesting, and perhaps surprising finding is that Blockchain’s developers set different password criteria depending on whether you created your wallet on their website, on an Android app or an iPhone (iOS) app. Password requirements could also vary based on the keyboard that you used — but, we found no explicit differences in password requirements by country.
Blockchain wallet password requirements
Blockchain’s developers required the following in the April 2025 website code:
- At least 8 characters, and no more than 64.
- At least one lowercase letter, such as a, b or c.
- At least one capital letter, such as A, B or C.
- At least one number.
- At least one symbol accepted by the form, such as !, @, # or +.
Look up the rules from when you set or last changed your password. New rules for how to create a password don't affect existing passwords.
Have Blockchain wallets always required at least 8 characters?
You needed at least 10 characters in some older website versions. In certain Android versions, you could use four. Use the year and the app or website version to narrow your guesses.
Android and iPhone launch dates
Web: The web was the original interface to Blockchain’s defi wallet, and it was launched in beta on Dec 1, 2011.
Android: Blockchain’s developer announced the Google Play release on March 24, 2012. Blockchain released a new Android version in July 2014.
iPhone: Owners reported using the wallet by April 6, 2012. The developer confirmed full wallet features in the App Store version on April 20, 2012.
Apple removed the iPhone app from the App Store on two separate occasions:
- 2012: Apple removed it in May. Owners reported its return by September 3, 2012.
- 2014: Apple removed it on February 5. Blockchain returned it to the store on July 28, 2014.
Owners with the app installed could keep using it during the 2014 removal.
Password rules by year
Use the table to check minimum lengths and required character types. “All four types” means a lowercase letter, a capital letter, a number and a symbol.
“Strength checks” are a different approach to encouraging hard-to-guess passwords. Instead of requiring certain types of characters, the app would “grade” passwords, and if a password scored too low, it was rejected (or the user was, at least, discouraged from using it).
We list the developers’ code change dates. You may have received an update on a different date or used an older version. Rows without a month describe versions we checked from that year.
| Year | Web | Android | iOS |
|---|---|---|---|
| 2011 | At least 10; no required character types. | No app released. | No app released. |
| 2012 (March 24–April 4) | At least 10; no required character types. | At least one character in this signup check. | We have not confirmed a release by this date. |
| 2012 (April onward) | At least 10; no required character types. | At least 10; no required character types. | Asked for 10; you could continue past the check with fewer. |
| 2013 (early year) | At least 10; no required character types. | At least 10; no required character types. | Asked for 10; you could continue past the check with fewer. |
| 2013 (late April) | At least 11 from April 27; no required character types. | At least 11 from April 28; no required character types. | Asked for 10; you could continue past the check with fewer. |
| 2013 (May 10 onward) | At least 10; no required character types. | At least 11; no required character types. | Asked for 10; you could continue past the check with fewer. |
| 2014 (early year) | At least 10; no required character types. | We confirmed 11 in older code; we have not verified the next version. | Asked for 10; you could continue past the check with fewer. |
| 2014 (July changes) | At least 10; no required character types. | We have not verified the July update. | At least 10 from July 23; no required character types. |
| 2014 (December 8 onward) | At least 10, including a character other than a number; no six identical characters in a row. | We have not verified the July update. | At least 10; no required character types. |
| 2015 | Newer website: pass a strength check. Older website: at least 10, with the 2014 checks. | At least 9 from March; you could ignore the warning. | At least 10; no required character types. |
| 2016 (before May 12) | Pass a strength check. | At least 9; you could ignore the warning. | At least 10; no required character types. |
| 2016 (May 12 onward) | Pass a strength check. | At least 9; you could ignore the warning. | Pass a strength check. |
| 2016 (September 12 onward) | Pass a strength check. | At least 4; you could ignore the warning. | Pass a strength check. |
| 2017 | Pass a strength check. | At least 4; you could ignore the warning. | Pass a strength check. |
| 2018 | Pass a strength check. | At least 4; you could ignore the warning. | Pass a strength check. |
| 2019 | Pass a strength check. | At least 4; you could ignore the warning. | Pass a strength check. |
| 2020 (before November 26) | Pass a strength check. | At least 4; you could ignore the warning. | Pass a strength check. |
| 2020 (November 26 onward) | Pass a strength check. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2021 | Pass a strength check. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2022 (before April 27) | Pass a strength check. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2022 (April 27 onward) | At least 12, with all four types. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2022 (June 8 onward) | At least 8, with all four types. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2023 (before July changes) | At least 8, with all four types. | At least 4; you had to pass a strength check. | Pass a strength check. |
| 2023 (July Android change) | At least 8, with all four types. | At least 8, with all four types. | Pass a strength check. |
| 2023 (August iOS change) | At least 8, with all four types. | At least 8, with all four types. | At least 8, with all four types. |
| 2024 | At least 8, with all four types. | We have not verified newer versions. | We have not verified newer versions. |
| 2025 (through April 9) | At least 8, with all four types. | We have not verified newer versions. | We have not verified newer versions. |
| 2026 | We have not verified the 2026 rules. | We have not verified newer versions. | We have not verified newer versions. |
Early iPhone warning: You could continue past the length check with fewer than 10 characters in the 2012–2013 iPhone code. In July 2014, the developers added code to stop shorter passwords.
Unconfirmed periods: We have not verified the July 2014 Android update or mobile code after 2023. We reviewed website code through April 2025.
You could face different checks when creating a wallet, changing a password or restoring a wallet, even within the same app.
Were very short passwords possible in older wallets?
You could set a four-character (or even a four-digit!) main wallet password in some older Android versions.
We found a four-character minimum in the September 2016 Android code. You could dismiss the warning about a weak password and create the wallet. The developers kept that option in the August 2017 version and removed it in November 2020.
Rules for letters, numbers and symbols
You needed at least 10 characters in the early website code. But, you could choose any character types.
Blockchain added a requirement for a small letter, a capital letter, a number and a symbol in April 2022.
You could count an exclamation mark ! or plus sign + toward the symbol requirement in the April 2025 website version. If you used a hyphen - or question mark ?, you needed another symbol from the accepted list.
Country and keyboard differences
We found no separate rules for different countries in the code we reviewed — however, the keyboard you used could matter. In tests of the older website password check, a password of １２３４ could pass; but a password of 1234 would fail. (The first set of numbers uses full-width digits, common in Chinese and Japanese text. They take up more horizontal space and have different character codes — and therefore these two sets of numbers generate different passwords).
Wallet passwords, PINs and recovery phrases
You may have used several passwords or codes with your wallet:
- Main wallet password: The password used to open your wallet.
- App PIN: A separate code used to open the phone app. The PIN is unrelated to the primary password and/or secondary password.
- Second password: An extra password you could set on some older wallets and enter when sending funds. Second passwords can be as short as 4 characters, and do not enforce requirements on which characters are used. There is a suggestion in the code that second passwords can potentially be shorter than 4 characters as well.
Help with a forgotten Blockchain wallet password
If you have forgotten your Blockchain wallet password, don’t despair! Gather your password clues:
- Dates: Note when you created the wallet and when you last changed its password. Use the date of the last change to look up the rules.
- Website or app: Note whether you used Blockchain.info or Blockchain.com in a browser, an Android phone or an iPhone.
- Password clues: List possible words and fragments, the length you remember, and any capital letters, numbers or symbols.
- Backups: Make copies of your original wallet files (if you have them). Also, keep notes on the email address associated with your wallet (even if you no longer control that email address).
Before you reset your password
Blockchain.com offers two different ways to store crypto to its clients: a custodial account and a non-custodial (or self-custody) defi wallet. Blockchain can reset the password to your custodial account after you verify your identity. But, Blockchain can’t reset the password to your non-custodial wallet.
Resetting your Trading Account password will not unlock your defi wallet.
Blockchain cannot change the password to your defi wallet. (Unless you know your password — if that’s the case you can log into your defi wallet and change to a new password).
Password recovery without a recovery phrase
A recovery service may be able to test likely password variations if you have the necessary wallet data and remember parts of your password. You may have little chance of recovering a long, random password without useful clues.
Request a wallet recovery assessment from Crypto Asset Recovery. Tell us what you remember about the password, the approximate year you created the wallet and whether you used the website or a phone app.
About our research
We examined Blockchain’s public wallet code and its recorded changes from 2011 onward. Our main sources included:
- Website: The original wallet website, the V3 website, the V4 website and the shared wallet code.
- iPhone: The original iPhone app and a saved copy of the later iOS app.
Some original phone app repositories were no longer available under Blockchain’s account. Copies saved by other developers preserved parts of that history. We examined Blockchain’s original changes in those copies, distinguishing them from changes made by the developers who saved them.
We checked minimum and maximum lengths, required types of characters and password strength checks. We also checked whether a warning actually stopped someone from creating a wallet. A message asking for a longer password did not always mean the app enforced that rule.
We treated creating a wallet, changing its main password and setting or entering a second password as separate actions. The table above covers main passwords. A rule for creating a new password does not tell us what an existing password must look like.
We ran selected password checks on our own computer using made-up examples, including ordinary digits and full-width digits. These tests checked how particular pieces of code behaved. They did not involve creating live Blockchain accounts or testing every app release.
The dates in the table refer to recorded code changes, with release versions checked where available. They are not guaranteed dates when every wallet owner received an update. We checked app launch dates and App Store removals against announcements and reports published at the time.
The newest website code we examined is dated April 9, 2025. The saved Android and iOS histories extend to August 8, 2023 and November 23, 2023, respectively. These sources establish historical rules; they do not confirm every rule used by Blockchain’s live services today.
