Exodus Wallet Has No 'Forgot Password' — Just 12 Words

Why Exodus Has No 'Forgot Password' Button

Every exchange account you have ever opened had an escape hatch: an email, a reset link, a support agent who could verify your identity. Exodus deliberately removed all three — and that single design choice is the reason this guide exists.

Exodus has no "Forgot Password" button because it is a non-custodial wallet: the password you set encrypts and gates access to the app on your own device, and it never recovers funds. The 12-word secret key generated on first launch is the only reset path, and Exodus documentation states plainly that no one — including Exodus — can reset a lost password for you . Everything in the steps that follow exists to protect that one phrase.

Quick Answer: Exodus is self-custody software with no account, no KYC, and no email attached to your wallet. Your password only unlocks the local app. Recovery runs entirely through the 12-word secret key created at first launch — always 12 words, never more, never resettable by support .

A non-custodial wallet is one where the private keys are generated and stored on your device rather than on a company's servers. Exodus Movement, Inc. — a public company trading on NYSE American under the ticker EXOD — operates the software, but it does not hold your coins. There is no sign-up flow, no identity check for the core wallet, and no email address linked to your balance, so support has nothing to look up. That is not a gap in the product; it is the product.

The practical consequences are worth stating before you install anything:

• The password is local-only. It encrypts the wallet file on that specific device. Reinstalling Exodus on a second device does not sync your existing wallet — it creates an entirely new one with its own phrase .
• The 12-word key outranks the password. Anyone holding the phrase can restore your wallet and move the funds without ever knowing your password .
• Support will never ask for it. Exodus states its team will never request passwords, private keys, sync QR codes, or 12-word secret keys — so any message that does is a phishing attempt .
• The phrase is portable. Because it follows the BIP39 standard, your funds stay recoverable in any compatible wallet even if Exodus itself ceased to exist .

That last point is the honest trade. Exodus reported 1.4 million monthly active users and a $18.6 million net loss for Q2 2026 on August 10, 2026 , but company performance has no bearing on whether you can reach your coins. Custody risk moves from a corporate balance sheet onto a piece of paper you control. The rest of this guide covers how to install the right version, verify it, and record that paper correctly — in the order a first-time user should actually do it.

Desktop vs. Mobile vs. Web3 Extension: Which Exodus Should You Install?

Exodus ships three separate clients — Desktop, Mobile, and a Web3 browser extension — and they are not interchangeable. Desktop and Mobile each cover 50+ crypto networks, while the Web3 extension manages assets across 12 networks . Pick by use case, not preference: Desktop for larger holdings and staking, Mobile for day-to-day spending and QR-based transfers, the extension purely for connecting to dApps in the browser. All three are self-custody, and all three depend on the same 12-word secret key.

Requirements are specific enough to check before you download. Mobile needs iOS 16 or later on an iPhone 8 or newer (Exodus recommends iOS 26 and an iPhone 11 or later), or Android 10 or later with at least 4 GB of RAM (Android 14 and 6 GB recommended). Desktop needs macOS 12 or later on 64-bit Intel or Apple Silicon, Windows 10 or later on 64-bit x86_64, or 64-bit Linux x86_64 — each with 8 GB of RAM . Desktop installers are published separately for Mac Apple Silicon, Mac Intel, Linux .deb, Linux .zip, and Windows 64-bit, so downloading the wrong architecture is a common first stumble .

Version currency matters more on Desktop than most users assume. The newest desktop release listed by Exodus is 26.8.26, published August 26, 2026, which improves QR syncing from Mobile by automatically enabling all portfolios and adds a Networks tab for assets that exist on more than one network . That Networks tab is a practical fix rather than a cosmetic one: sending USDC or ETH to the wrong network is one of the most frequent ways funds go missing, and an explicit per-asset network view reduces the guesswork. Exodus also publishes PGP-signed SHA256 hashes for each installer in release 26.8.26 — separate values for the Windows x64 .exe, the macOS Intel and Apple Silicon .dmg/.zip builds, and the Linux .deb/.zip builds .

One structural detail decides how you should think about running more than one client: installing Exodus on a second device does not sync your existing wallet. It creates an entirely new wallet with its own 12-word phrase . To run the same funds on Desktop and Mobile, you either use the QR sync flow that release 26.8.26 improved, or you restore the same 12-word key on the second device. Treat every fresh install as a fork unless you have deliberately synced or restored.

• Holding more than you would carry in cash? Start with Desktop — it is the only client that pairs with Trezor and the only one with the full staking interface.
• Sending and receiving small amounts weekly? Mobile, with biometrics enabled, plus a written phrase stored at home.
• Interacting with DeFi protocols? The Web3 extension, funded with only what a given session needs, and kept separate from your main balance.
• Using two devices? Sync or restore deliberately; do not assume a second install is the same wallet.

Step 1: Download and Verify Exodus From an Official Source Only

The install source is the single highest-risk moment in an Exodus setup, because a counterfeit installer can capture a 12-word secret key before the wallet ever holds funds. Only four distribution channels are legitimate: exodus.com's download page, the Apple App Store, Google Play, and the official Chrome/Brave listing for the Web3 extension. That list is not paranoia — a page titled "Getting Started | Exodus Knowledge Base" was observed being served from a wasmer.app subdomain rather than exodus.com, and search results, sponsored ads, and support pop-ups are all vectors that route users to a lookalike.

Desktop builds are published separately for Mac Apple Silicon, Mac Intel, Linux .deb, Linux .zip, and Windows 64-bit. Pick the wrong architecture and the installer simply fails; download from the wrong domain and it may install silently and work. The current desktop release is 26.8.26, published August 26, 2026, which improves QR syncing from mobile by automatically enabling all portfolios and adds a Networks tab for assets that exist on more than one network. Check the version number against the official releases page before installing anything you downloaded more than a few days ago.

The verification step most people skip costs about two minutes. Exodus publishes PGP-signed SHA256 hashes for every desktop installer, with separate values for the Windows x64 .exe, the macOS Intel and Apple Silicon .dmg/.zip files, and the Linux .deb/.zip builds — release 26.8.26 has its own hash file. Compute the hash of your download locally and compare it character-for-character against that file:

Windows (PowerShell):  Get-FileHash .\exodus-windows-x64-26.8.26.exe -Algorithm SHA256
macOS / Linux:         shasum -a 256 exodus-26.8.26.dmg

A mismatch means the file was altered or truncated in transit — delete it and download again from exodus.com. A match means the binary is the one Exodus signed. This is the cheapest security step in the entire setup, and it is the only one that catches a tampered installer before it runs.

Once installed, one behavioral rule prevents most of what remains. Exodus states that Support will never ask for your password, private keys, sync QR code, or 12-word secret key. Any message, chat widget, Telegram account, or "wallet validation" form requesting one of those four items is fraudulent by definition, with no exceptions for outages, upgrades, or account verification.

"Exodus support will never ask you for your password, private keys, sync QR codes or 12-word secret keys," — Exodus Support documentation, Exodus Movement, Inc. (source: Exodus Knowledge Base)

For the Web3 browser extension, add one final step: pin it to the toolbar immediately after install. Spoofed lookalike extensions with near-identical names and icons are a recurring problem in browser stores, and a pinned extension gives you a fixed, known launch point instead of hunting through an extensions menu where an impostor can sit one row away. Install it only through the official Chrome/Brave path linked from exodus.com, and treat any extension that appears without your having installed it as a compromise. If you are running Desktop, confirm your machine meets the stated floor first — macOS 12+ on 64-bit Intel or Apple Silicon, Windows 10+ 64-bit x86_64, or 64-bit Linux x86_64, each with 8 GB RAM — so a failed launch never tempts you toward an unofficial "patched" build.

Step 2: Create Your Wallet and Set a Password (What It Actually Protects)

Creating an Exodus wallet takes one click and no account. The wallet is generated instantly on your device the first time you launch the app — there is no sign-up form, no email verification, and no KYC for the core wallet, because nothing about your wallet is created or stored on Exodus servers . The password you set immediately afterward is not part of that generation process. It encrypts and gates the local copy of the wallet on that one machine, and nothing more .

That distinction matters because it determines what a lost password costs you and what a stolen phrase costs you. Exodus documentation is explicit that no one — not support, not the company — can reset your password for you, and the only path back into a locked wallet is the 12-word secret key . On mobile, the same role is played by a passcode, Face ID, Touch ID, or a fingerprint. These are convenience gates over the same encrypted local file, not separate keys to your funds.

Here is the practical split worth internalizing before you deposit anything:

• Password / biometrics — protects the wallet copy on this device against someone who picks up your unlocked laptop or phone. Useless to an attacker on any other device.
• 12-word secret key — controls the funds themselves on every chain. Anyone holding the phrase can drain the wallet on their own hardware without ever seeing your password .
• Neither one encrypts the blockchain record. Balances and history live on public networks; the app is only an interface with signing authority.

Exodus also lets you fund and use the wallet before you have written the phrase down, which surprises people coming from exchange onboarding. That is deliberate, not an oversight. The backup prompt surfaces after your first deposit — an orange warning triangle on Desktop, a pop-up on Mobile and the Web3 extension — rather than blocking the interface up front . The design assumption is that you may be testing the app with a small amount. The risk is that the small amount stops being small while the phrase is still unwritten.

The most common beginner failure at this step is treating a strong password as the backup. A 20-character passphrase in a password manager feels like the serious option, and on an exchange it largely is. Here it protects nothing beyond the device it was set on: a wiped drive, a lost phone, or a factory reset takes the encrypted local wallet with it, and the password has no meaning without that file . Installing Exodus on a second device does not pull the old wallet down either — it generates an entirely new wallet with its own 12 words . Set a password you can remember without a manager as a secondary lock, then treat the phrase backup in Step 3 as the actual security work.

Step 3: Back Up the 12-Word Secret Key the Right Way

An Exodus secret key is always exactly 12 words, and every private key on every supported network is derived from that single phrase . Backing it up correctly is therefore the only step in this tutorial that is genuinely irreversible if skipped: anyone holding those 12 words can move the funds without the password, and nobody without them — including Exodus support — can restore access . Exodus deliberately lets you fund the wallet before backing up, then surfaces the reminder as an orange warning triangle on Desktop and a pop-up on Mobile and the Web3 extension after your first deposit .

The Desktop flow is short and worth doing before any deposit rather than after. Open the Backup tab, set your password, click Next, tick the risk acknowledgement, choose View secret phrase, write down all 12 words in order while checking each spelling, then click Done . Order matters as much as the words themselves — a phrase transcribed correctly but sequenced wrong resolves to a different wallet, which is the failure mode covered in Step 4.

Two assumptions carried over from exchange accounts cause most avoidable losses here:

• Cloud device backups do not include your wallet. Standard iOS and Android cloud backups do not automatically preserve an Exodus wallet . Restoring a new phone from an iCloud or Google backup will reinstall the app, not the keys.
• You cannot screenshot the phrase. Exodus Mobile actively blocks screenshots and screen recording while the secret key is on screen, and the same protection extends to capture tools such as Windows Recall . This is a feature, not a bug — a screenshot lands in a photo library that syncs to a cloud account protected only by an email password.

Official guidance is to write the phrase on paper, keep no unencrypted digital copy, and store more than one written copy in separate physical locations so a single fire, flood, or burglary does not end the wallet . Do the transcription in private, away from cameras and public Wi-Fi . Password managers, notes apps, email drafts, and cloud documents all fail the same test: they convert a physical secret into a credential that a remote attacker can reach.

Mobile offers one sanctioned middle path. The passkey backup encrypts your secret key into a backup file stored in iCloud on iOS or Google Drive on Android, with the decryption passkey held in your passkey manager and gated by the device's biometrics or PIN . The constraints are strict: it requires a passkey-capable iOS or Android device, restoration must stay inside the same operating-system family, and both the backup file and the passkey are required — losing either one blocks restoration entirely . That two-of-two requirement is why it belongs on top of a written phrase, never instead of one. An iPhone user who moves to Android, or who loses their passkey manager, is left with whatever they wrote on paper.

A practical standard for retail holdings: two handwritten copies in different buildings, each verified word-by-word against the phrase shown in the app before you fund the wallet meaningfully, plus the passkey backup if you are on Mobile and want a faster same-platform recovery. That combination survives a lost phone, a wiped laptop, and a single-location disaster, and it costs nothing beyond ten minutes and a pen. The phrase's real portability is the payoff — those 12 words open the same wallet in any BIP39-compatible software, so your access does not depend on Exodus Movement, Inc. continuing to operate .

Step 4: Restoring a Wallet Without Accidentally Opening an Empty One

Restoring an Exodus wallet means typing your 12-word secret key into a fresh install, and the process will not tell you when you get it wrong. A single misspelled word, a swapped word order, or a stray capital letter does not throw an error — it deterministically derives a different valid wallet, which loads as an empty balance . Most "my crypto disappeared" reports are this, not theft. Before you conclude anything is missing, work the phrase itself.

The second trap is destructive. Restoring a phrase into an Exodus install that already holds a wallet overwrites that wallet — it does not merge the two sets of balances into one portfolio . If the resident wallet holds funds and its own phrase was never written down, that restore is unrecoverable. The safe sequence is: back up the existing wallet's 12 words first, confirm them, and only then restore the other phrase.

When a restore opens an apparently empty wallet, run the official checklist before assuming loss:

• All 12 words present. Exodus secret keys are always 12 words — never 18 or 24 .
• Correct order. Word position is part of the derivation; two transposed words produce a different wallet entirely.
• Lowercase only. Capitalization introduced by phone keyboards or autocorrect is a common failure.
• English keyboard characters. No accented characters, no non-Latin input methods.
• Every word on the BIP39 list. If a word is not in the standard 2,048-word English BIP39 wordlist, it was transcribed wrong — check for near-neighbors such as "acess"/"access" or "recieve"/"receive".
• Try your other stored phrases. Users who created wallets on several devices often restore the wrong one; installing Exodus on a new device generates a brand-new wallet with its own phrase rather than syncing an existing one .

If the phrase checks out and the wallet is still empty, the next question is whether the asset is displayed rather than missing. Assets on a network Exodus does not surface by default, or custom tokens that need to be added manually on EVM networks, can exist on-chain while showing nothing in the interface . Check the receiving address on a block explorer before escalating.

One rule has no exceptions: never import a 12-word secret key or private key that somebody else supplied. It is a standard honeypot pattern — a scammer shares a phrase for a wallet visibly holding tokens, but the tokens are on a chain with no gas in the wallet, and any gas you deposit to move them is swept instantly by an automated script watching that address . The same logic covers inbound "support" contact: Exodus states its Support team will never ask for your password, private keys, sync QR code, or 12-word secret key, in either direction . A phrase moves one way only — from your paper into your device, never across a chat window.

Sending, Swapping, and Staking: Where the Real Costs Hide

Exodus charges nothing to send or receive crypto — 100% of the fee you pay goes to the blockchain network itself . Network fees scale with transaction data size and the current fee rate, not with the amount you send, so a $50 Bitcoin transfer and a $50,000 one can cost the same. The real costs sit elsewhere: in swap spreads, in third-party fiat ramps, and in staking lockups you cannot exit on demand.

Two send-side details are worth knowing before your first outbound transaction. On Bitcoin, any remaining balance below 0.00001501 BTC is folded into the fee rather than returned as change, because the dust output would cost more to spend later than it is worth . On Ethereum and other EVM networks, Exodus Desktop displays a Max Network Fee — a ceiling, not a charge. The settled fee is frequently lower, so judge the cost from the confirmed transaction, not the pre-send estimate . When receiving, open the specific asset wallet, pick the correct network if the token exists on several, and copy the plain-text address or QR into the sending platform; assets sent on an unsupported network may not display and can require a separate recovery process .

Swaps are where the spread lives. Exodus Swap routes crypto from your self-custody wallet to third-party swap API providers — ChangeHero, Changelly, ChangeNOW, and SimpleSwap — and returns the received asset to your wallet. The provider fee and spread are embedded in the quote you see before confirming, so there is no separate line item to inspect . Minimums and maximums move with liquidity and market conditions rather than sitting at fixed thresholds, and the Web3 extension additionally exposes a slippage setting. Advertised rates start "as low as 0.5%" on large, liquid pairs, but independent review puts the realistic all-in cost closer to 2.2% on mid-size trades and as high as roughly 5% on very small amounts .

The practical read: use Exodus Swap for convenience on amounts where a couple of percent is noise, and move size through a lower-cost venue when the spread outweighs the friction of transferring out.

Buying and staking add their own constraints. Fiat purchases route through third-party providers that vary by country and even by U.S. state — XO Ramp, MoonPay, Banxa, Blockchain.com Pay, BTC Direct, PayPal, Ramp Network, and Robinhood Connect . XO Pay was renamed XO Ramp in May 2026; it serves the United States and Puerto Rico, is unavailable in New York and Vermont, and accepts USD via Visa/Mastercard debit or Apple Pay across assets including BTC, ETH, SOL, XRP, and USDC . Staking is built in for roughly ten assets — ETH, ADA, SOL, ATOM, XTZ, POL, INJ, KAVA, APT, and AXL — with rules set per protocol rather than by Exodus . Some staked assets cannot be sent or swapped while staked, and unstaking waits are protocol-imposed: ATOM takes roughly 21 days, while SOL depends on the epoch boundary . Any advertised APY is an estimate that shifts with validator performance, not a quoted rate — and staking from a Trezor-connected portfolio is not supported at all . Because provider lists, supported staking assets, and regional availability drift between releases, check the official Exodus support pages before assuming a feature is live in your jurisdiction.

Which Exodus Setup Fits You? A Decision Framework

The right Exodus setup is decided by two variables: how much value you hold and how often you interact with dApps. Exodus ships Desktop, Mobile, and a Web3 browser extension from the same official download page, and all three derive every private key from a single 12-word secret key . Match the platform to the balance, not to convenience, and the rest of the configuration follows.

• Casual holder moving under $1,000. The Mobile app alone is sufficient. Write the 12 words on paper, store two copies in separate physical locations, then add the passkey backup — an encrypted backup file in iCloud or Google Drive that only your passkey can decrypt — as a second layer. Both the file and the passkey are required to restore, and restoration must stay within the same OS family, so it never replaces the written phrase .
• Active trader touching DeFi and dApps. Run the Web3 extension for daily connections — it manages assets across 12 networks and exposes slippage settings the other clients do not . Keep the larger balance in a separate Desktop wallet with its own 12-word key, and treat the extension wallet as a hot spending account you can afford to lose.
• Large holdings or multi-year storage. Pair Desktop with a Trezor. Initialize the Trezor in Trezor Suite first so the device generates its keys offline; the Trezor recovery phrase and the Exodus 12-word key are separate, non-interchangeable, and both must be written down . Importing your Exodus phrase into the Trezor is discouraged because it gives up offline key generation entirely . On Mobile, the equivalent path is Ledger Nano X or Flex over encrypted Bluetooth, with the device already configured in the Ledger Wallet app.
• Frequent swapper. Price the route before you use it. Exodus Swap advertises rates from 0.5% on large liquid pairs, but independent review puts realistic all-in cost near 2.2% on mid-size trades and roughly 5% on very small ones, against 0.875% for MetaMask Swaps and 0.00–0.60% taker on Coinbase Advanced . On a $5,000 trade that spread is the difference between roughly $44 and $110.

Two constraints cut across all four profiles. Installing Exodus on a new device creates a brand-new wallet rather than syncing an existing one, so device migration always runs through the 12-word key . And the company behind the app is a going concern with ordinary business risk — Exodus Movement reported 1.4 million monthly active users, $26.2 million revenue and a net loss of $18.6 million for Q2 2026 on August 10, 2026 . That is precisely why self-custody matters: those 12 words open your funds in any BIP39-compatible wallet, with or without Exodus.

The concrete takeaway: pick the client that matches your balance, write the 12 words on paper before your first deposit, keep a second copy in a different building, and move anything you would not casually risk onto a Trezor or Ledger. Everything else in Exodus — swaps, staking, fiat on-ramps — is optional convenience layered on top of that one irreversible backup step.

Frequently asked questions

Can I reset my Exodus wallet password if I forget it?

No. The Exodus password (or passcode, Face ID, Touch ID, or fingerprint on Mobile) only gates access to the app's local data on that one device — it is not an account credential, and Exodus support cannot reset it because the company never holds it. The documented recovery path is the only one: uninstall or reset the app, then restore from your 12-word secret key, which regenerates every private key in the wallet . If you have neither the password nor the 12 words, the funds are unreachable. Exodus also states that its support team will never ask for passwords, private keys, sync QR codes, or 12-word secret keys — anyone who does is running a phishing attempt (Exodus Support).

Does Exodus back up my wallet automatically through iCloud or Google Drive?

No — standard iOS and Android device cloud backups do not capture an Exodus wallet, so restoring a phone from an iCloud or Google Drive image will not bring your funds back . Mobile does offer a separate, opt-in passkey backup: the 12-word key is encrypted into a backup file stored in iCloud or Google Drive and decrypted by a passkey held in your passkey manager, gated by device biometrics or PIN (Exodus Support). That feature works only on passkey-capable devices, restoration must stay inside the same OS family, and both the backup file and the passkey are required — losing either one blocks recovery. Treat it as a convenience layer above a handwritten phrase, not a replacement for one.

Is it safe to use the same 12-word secret key on a new phone or computer?

Yes — restoring the same 12 words on a new device is exactly what the phrase is designed for, and it works in any BIP39-compatible wallet, not just Exodus . Two conditions apply. First, restoring into a device that already holds an Exodus wallet overwrites it rather than merging balances, so back up the existing phrase first. Second, the words must be entered exactly — correct order, correct spelling, lowercase, English keyboard characters, checked against the BIP39 word list. A single wrong word does not throw an error; it silently derives a different wallet that appears empty (Exodus Support). Never import a phrase or private key that someone else supplied — that is a standard honeypot setup.

How much does it cost to swap crypto inside Exodus?

Exodus Swap routes your assets to third-party providers — ChangeHero, Changelly, ChangeNOW, and SimpleSwap — and embeds the provider fee and spread inside the quote you see before confirming, so there is no separate line item to inspect . Advertised rates start as low as 0.5% on large, liquid pairs, but independent review puts realistic all-in cost near 2.2% on mid-size trades and up to roughly 5% on very small amounts (Coin Bureau). For comparison, MetaMask Swaps charges 0.875% and Coinbase Advanced taker fees run 0.00–0.60%. Minimums and maximums are dynamic and set by liquidity, and the Web3 extension additionally exposes slippage settings. Check the quoted output amount against a spot rate before confirming any swap above trivial size.

Should I use Exodus Desktop, Mobile, or the Web3 browser extension?

Match the client to the job. Desktop suits larger balances and staking, supports Trezor pairing, and requires macOS 12+, Windows 10+ 64-bit, or 64-bit Linux with 8 GB RAM . Mobile suits day-to-day amounts with biometric unlock and Ledger Nano X or Flex support over Bluetooth, needing iOS 16+ or Android 10+ with 4 GB RAM. The Web3 extension is for direct dApp and DeFi interaction and manages assets across 12 networks, against 50+ on the first-party wallet (Exodus Support). Critically, each install generates an independent wallet with its own 12 words unless you link them via QR sync — desktop release 26.8.26, published August 26, 2026, improved that sync flow by auto-enabling all portfolios (Exodus Releases).

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe