Bitcoin Core dumpwallet RPC: Human-Readable Recovery Guide

This guide explains Bitcoin Core dumpwallet RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Server-side path

The filename is interpreted by bitcoind and can be absolute or relative to its process environment. Resolve the returned absolute path and confirm it is outside web roots, shared directories and the active wallet location. Create a restrictive destination before export and reject symbolic links or mount paths not covered by the recovery policy.

No-overwrite guard

The historical call refused to overwrite an existing file, reducing accidental destruction. Use unique immutable names instead of deleting a prior dump to make a job pass. Verify failures visibly and retain several encrypted generations; a no-overwrite error is not proof that the existing file is current or complete.

Imported key coverage

A seed covers only keys derived under its wallet scheme. Independently imported keys must be preserved through a wallet backup or dump and cannot be recreated from the HD seed. Inventory imported-key presence without exposing secrets, and test that restoration finds known historical outputs before declaring seed-only recovery enough.

Imported scripts and Bech32 gap

Core 0.16 included imported scripts in dump files, but importwallet might not automatically add corresponding BIP 173 addresses and could require a manual rescan. Preserve the exact scripts, network and intended address type in a separate recovery manifest, then compare receive and change scripts after import rather than relying on displayed address counts.

Plaintext secret handling

The dump contains material capable of spending funds. Encrypt it immediately under an approved recovery key, restrict ownership and remove unencrypted temporary copies through a verified process. Do not attach it to support systems, sync it through consumer storage or include its content in checksums, logs or evidence reports.

Integrity and restoration

Record encrypted artefact size, authenticated digest, wallet version, export time and chain height. In an isolated environment, import into compatible software, rescan from a conservative point and compare known keys, scripts and transactions. Prove a disposable signature or regtest spend without broadcasting production funds.

Rotation and incident response

Run exports under a controlled schedule after imported material or script policy changes and retain older verified generations. If the file location, permissions or transport were exposed, treat every contained key as potentially compromised and plan a wallet-wide migration, not a single-address fix. Recovery evidence must never reveal the dump itself.

Conclusion

dumpwallet can preserve keys and scripts a seed alone misses, but it creates an exceptionally sensitive recovery artefact. Its value depends on protected storage, explicit script context and a complete isolated import and rescan test.