Ethereum keystore (UTC--) files after a death

An Ethereum keystore (or “JSON”) file is an encrypted copy of a private key, usually created by MyEtherWallet or similar tools. Files of this type typically have names starting with UTC-- followed by a timestamp and an address. Finding one after a death means the estate may hold ETH or ERC-20 tokens, and that the password is as important as the file.

What the file actually is

• Per MyEtherWallet’s own documentation, a keystore file holds an encrypted version of the private key, protected by a password chosen when it was created.
• Without the password, the file alone is not usable. With the password, whoever holds both controls the assets, which is why the file and the password must each stay protected and never be sent anywhere.
• MyEtherWallet itself advises that keystore files are not a recommended way to access a wallet, a caution that matters doubly after a death, when nobody can answer for mistakes.

The wrong-network and empty-wallet traps

Opening a keystore in the wrong wallet software, on the wrong network, or with the wrong “custom token” settings can display an empty balance even when the assets are intact. An empty screen proves very little. Similarly, fresh software can create a new, empty account that looks related but is not the found one. Preserve everything and conclude nothing from a first glance.

How to preserve it

• Leave the file on its original medium. Do not upload it to a service that offers to “check” or “help” with it, and never send it to anyone, you open the file yourself, in the official wallet program, and only after authority is confirmed.
• Keep the file and any written password separately. The only time either is entered into an online service is when you yourself open the wallet in the official wallet service (for example MyEtherWallet), never into a website, app or message that asks for them to “help” or “verify”.
• Record only that you found a keystore file, where, and when, never its contents.

What to do with it

• Access is the file plus its password. The keystore file alone is unusable; the password unlocks it. Keep them separate, and never enter either online except in the official wallet service you opened yourself.
• When the estate is ready (authority confirmed, password found): the file is opened in an Ethereum wallet program, MyEtherWallet or another program that supports keystore files. The program asks for the password, and the password unlocks the wallet.
• The classic mistake: opening the file in the wrong program or on the wrong network shows an empty wallet even when the assets are intact. Never conclude “there is nothing” from an empty first screen.
• If the password is missing: a standard keystore file is always encrypted, so the password is required (read what is realistically possible in wallet recovery. (If the file turns out not to be encrypted, it is not a keystore) it is a plain private key, and the file itself is the secret.)
• Until authority is confirmed, leave the file exactly as found and record only that it exists.

What happens next

1. Identify what else exists, see what did you find.
2. Understand passwords and passphrases, see wallet passwords and passphrases.
3. Confirm legal authority before anything else is attempted, see legal authority vs technical access.

For the full index of every wallet format and its deep guide, see the wallet format library.