OP's trying to live his best life & trying to solve this riddle sametime.
Got another programmer mate helping me out now & making some progress.
Hey Chonk. Welcome to the game & special thanks to those who have been putting up with my nonsense. I'm a man of my word & you will be compensated.
Now for the latest new folks. Has to go on the forum...
What you're doing is using a password-based KDF (key derivation function) to generate a 256-bit number (which is ultimately all a Bitcoin private key really is: just a 256-bit number [1]), and then
using that number to generate a Bitcoin address.
The thing to be aware of with a process like this is that there are lots of degrees of freedom:
(*) The capitalization and spacing of your 8 words (and, obviously, the spelling and the order).
(*) The choice of KDF algorithm (PBKDF2, scrypt, etc.)
(*) The KDF's iteration count.
(*) The KDF's salt (which you're using for your password).
(*) The KDF's other parameters (PBKDF2's PRF choice, scrypt's "cost factor", etc.)
If any of the above is slightly off, even in some small way that you wouldn't be able to tell just from looking at the user interface (like whether or not the salt is being used directly, or is being hashed before use), then you'll land on the wrong private key.
For example, using Python interactively:
Code:
>>> import hashlib
>>> hashlib.pbkdf2_hmac('sha256', b'word1 word2 word3 word4 word5 word6 word7 word8', salt=b'password', iterations=10000).hex()
'fbd68e537134cf6c5010bdb735b47f5c225691b2edeb60a429187863268b3959'
But, maybe the tool you used back in ~2010 had an iteration count of 20000 instead of 10000, leading to a completely different private key:
Code:
>>> import hashlib
>>> hashlib.pbkdf2_hmac('sha256', b'word1 word2 word3 word4 word5 word6 word7 word8', salt=b'password', iterations=20000).hex()
'1a119eddcf2cdb9e436e52610b0d9859f883fd8868300d1653063b6e34a66820'
Or maybe it used an iteration count of 10000 but with HMAC-SHA-512 instead of HMAC-SHA-256 as its PRF:
Code:
>>> import hashlib
>>> hashlib.pbkdf2_hmac('sha512', b'word1 word2 word3 word4 word5 word6 word7 word8', salt=b'password', iterations=10000)[:32].hex()
'd20930a0feccd38b09899706017f08e3d2b651156a0f7c75b3dd05204f3648f0'
Actually, working through these examples, maybe the tool you used wasn't making use of any KDF at all, and instead just used HMAC-SHA-256 directly (eliminating the need to have to specify an iteration count):
Code:
>>> import hmac
>>> hmac.digest(b'password', b'word1 word2 word3 word4 word5 word6 word7 word8', 'sha256').hex()
'9f8d5306645d444619ec124f89c2b34c8596b21614c18b3fac72362687fbe0d0'
Anyway, you get the idea.
And, even if you do manage to find the set of choices that lands you on the right private key, if you then mess up the Bitcoin address derivation part, like by generating the wrong kind of Bitcoin address, you'll incorrectly conclude that the private key leads to no balance.
So, your best bet, IMO, is to either find exactly the same tool that you originally used (even if it's now defunct, I can probably reconstruct it for you if there are enough surviving details on the Internet archive), or to follow my advice and set up Tails so that you're in a position to safely execute any scripts that I send you (for example, I could write you a script that would do basically what you're trying to do on your own, but in a more exhaustive/reliable way: take your 8 words + password and then try multiple derivation techniques to produce a set of Bitcoin addresses that you could then check for balance).
[1] More or less, anyway. Technically, it should be an integer greater than 0 and smaller than 115792089237316195423570985008687907852837564279074904382605163141518161494337 (which means that there are 256-bit numbers which don't make valid Bitcoin private keys, but that's not a detail worth worrying about: the chance of a random 256-bit integer not being within that range is something like 1 in ~2.7e+38).
---‐‐----------------------------------------------------------------------------------------------
Unfortunately I don't have the knowledge to smashed that out but my "quest buddie" does & couldn't have said it better myself.