Budibase/budibase · error · HTTPError

Files are encrypted but no password has been supplied.

Error message

Files are encrypted but no password has been supplied.

What it means

After extracting the package, extractProjectPackage() lists the root entries and, if any file ends with .enc while no encryptPassword was provided, it throws this HTTP 400 at imports.ts:938. Encrypted packages cannot be processed without the password, so the import is rejected before any docs are touched.

Source

Thrown at packages/server/src/sdk/workspace/projects/backups/imports.ts:938

  if (encryptPassword && encryptPassword.length > MAX_ENCRYPT_PASSWORD_LENGTH) {
    throw new HTTPError("Project package password is too long.", 400)
  }

  await validateProjectPackageBeforeExtraction(file)
  const tmpPath = await untarFile(file)
  try {
    if (encryptPassword) {
      try {
        await decryptFiles(tmpPath, encryptPassword)
      } catch {
        throw new HTTPError("Project package could not be decrypted.", 400)
      }
    }

    const packageFiles = await readDirectoryRecursively(tmpPath)
    const rootEntries = await fsp.readdir(tmpPath)
    if (rootEntries.some(entry => entry.endsWith(".enc")) && !encryptPassword) {
      throw new HTTPError(
        "Files are encrypted but no password has been supplied.",
        400
      )
    }
    if (rootEntries.includes("db.txt")) {
      throw new HTTPError(
        "Workspace exports cannot be imported as Project packages.",
        400
      )
    }
    if (
      rootEntries.some(
        entry =>
          ![
            PROJECT_MANIFEST_FILE,
            PROJECT_FILE,
            PROJECT_DEPENDENCY_INDEX_FILE,
            PROJECT_DOCS_DIRECTORY,

View on GitHub (pinned to a81a902e9a)

Solutions

1. Re-run the import passing the encryptPassword parameter used at export time
2. Check the package contents (list the tarball) to confirm it contains .enc files and ask the exporter for the password
3. If you don't need encryption, re-export the package without a password and import that

Example fix

null

import { createReadStream } from 'fs'
import { parse } from 'tar'
const hasEncFiles = await new Promise<boolean>((resolve, reject) => {
  const ws = parse({ onReadEntry: (e: any) => { if (e.path.endsWith('.enc')) { resolve(true); ws.abort?.() } }, onEnd: () => resolve(false) })
  createReadStream(packagePath).pipe(ws as any)
  ws.on('error', reject)
})
if (hasEncFiles && !password) throw new Error('package is encrypted; encryptPassword is required')

function isEncryptedImportReady(p: { hasEncFiles: boolean; password?: string }): p is { hasEncFiles: true; password: string } {
  return p.hasEncFiles ? typeof p.password === 'string' && p.password.length > 0 : true
}

try {
  await importProjectPackage(file, password)
} catch (err) {
  if (err instanceof HTTPError && err.status === 400 && err.message.includes('no password has been supplied')) {
    // re-run with the encryptPassword used at export time
  } else {
    throw err
  }
}

When it happens

Trigger: Importing an encrypted project package (files exported with encryption, leaving .enc files in the archive root) without passing the encryptPassword parameter to the import endpoint.

Common situations: Forgetting the password flag in curl/CI scripts after exporting with encryption; sharing an encrypted export without telling the importer it needs a password; UI/API clients that strip empty password params.

Related errors

• datasourceId and authConfigId are required
• siteId is required
• driveId is required with parentItemId
• Either file or key is required.
• File cannot be imported

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/df012df58af26702. Report an issue: GitHub.