I'm pretty sure he will be more than willing to tip anyone who is willing to help. I'm getting a pretty decent tip for helping however I only get it if I'm successful. the last resort if we can't get anything working is to go to the dave bitcoin which takes a 20% cut which is pretty big and we would both agree that doing it ourselves may be a better option.
Of course the next solution is telling him about the script I'm using and him using it on his wallet, but because he's not very technical I'm trying to avoid that also as that would be a very long process in explaining it to him.
Both pywallet and extract scripts are perfectly safe, they're open source and very well trusted, there is no harm to use them, your friend should not have worried that much. Actually they do similar things, they extract some information from a bitcoin wallet (mkey, salt etc..). But based on my experience it's easier to use extract scripts to recover a forgotten password rather than pywallet. I did a successful password recovery on my own using btcrecover (it took 8 hours for me to find the password on 3 intel core i7 computers)
so here are what your friend should do (for bitcoin core wallet):
1. Download extract scripts at https://github.com/gurnec/btcrecover/raw/master/extract-scripts/extract-bitcoincore-mkey.py
2. Make a copy of wallet.dat file into the same folder as extract scripts.
3. Run this command
Bitcoin Core encrypted master key, salt, iter_count, and crc in base64:
lV/wGO5oAUM42KTfq5s3egX3Uhk6gc5gEf1R3TppgzWNW7NGZQF5t5U3Ik0qYs5/dprb+ifLDHuGNQIA+8oRWA==
That's all. When you (or someone else) try to search for his forgotten passwords, you will not need his wallet file, therefore his money is safe. You only need the output from extract-bitcoincore-mkey.py above (bolded part).
If you need more help, I can assist you.