Budibase/budibase · error

Files are encrypted but no password has been supplied.

Error message

Files are encrypted but no password has been supplied.

What it means

After optional decryption, importApp lists the extracted directory and checks for residual .enc files. If any remain, decryption was skipped or incomplete (typically because no password was supplied) and the import aborts rather than importing half-encrypted data.

Source

Thrown at packages/server/src/sdk/workspace/backups/imports.ts:275

    ...opts,
  }
  const prodAppId = dbCore.getProdWorkspaceID(appId)
  const objectStoreWorkspaceId = importOpts.objectStoreAppId ?? appId
  const objectStoreProdAppId = dbCore.getProdWorkspaceID(objectStoreWorkspaceId)
  let dbStream: fs.ReadStream
  const isTar = template.file && template?.file?.type?.endsWith("gzip")
  const isDirectory =
    template.file && (await fsp.lstat(template.file.path)).isDirectory()
  let tmpPath: string | undefined = undefined
  if (template.file && (isTar || isDirectory)) {
    tmpPath = isTar ? await untarFile(template.file) : template.file.path
    if (isTar && template.file.password) {
      await decryptFiles(tmpPath, template.file.password)
    }
    const contents = await fsp.readdir(tmpPath)
    const stillEncrypted = !!contents.find(name => name.endsWith(".enc"))
    if (stillEncrypted) {
      throw new Error("Files are encrypted but no password has been supplied.")
    }
    const isPlugin = !!contents.find(name => name === "plugin.min.js")
    if (isPlugin) {
      throw new Error("Supplied file is a plugin - cannot import as app.")
    }
    const isInvalid = !contents.find(name => name === DB_EXPORT_FILE)
    if (isInvalid) {
      throw new Error(
        "App export does not appear to be valid - no DB file found."
      )
    }
    // have to handle object import
    if (importOpts.importObjStoreContents) {
      const promises = []
      const excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE]

      for (let filename of contents) {
        const path = join(tmpPath, filename)

View on GitHub (pinned to a81a902e9a)

Solutions

1. Re-run the import supplying the export password via template.file.password
2. If the password is unknown, obtain a non-encrypted export from the source environment
3. Verify the export's encryption setting and re-export without a password if encryption was unintentional
4. Confirm the archive fully extracted — a partially extracted dir can leave .enc files behind

Example fix

// before
await importApp({ file: { path: p, type: "text/plain", password: "" } })
// after
await importApp({ file: { path: p, type: "text/plain", password: "correct-horse-battery-staple" } })

const names = await fsp.readdir(tmpPath)
if (names.some(n => n.endsWith(".enc")) && !password) {
  throw new Error("Encrypted export requires a password")
}

try {
  await importApp(template)
} catch (err: any) {
  if (err.message.includes("no password has been supplied")) {
    // retry with password supplied
  } else {
    throw err
  }
}

When it happens

Trigger: importApp receives a tar export whose contents include *.enc files, isTar is true, but template.file.password is empty/undefined, so decryptFiles is never called and the .enc check trips.

Common situations: Importing an app that was exported with encryption enabled while the caller omits the password field; export encryption defaults changed between Budibase versions and older import scripts do not pass passwords; UI flow where the password prompt is skipped.

Related errors

• File cannot be imported
• Files are encrypted but no password has been supplied.
• Unable to determine delimiter
• TableImportError(errors)
• Invalid import url

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/ec67ba405672428d. Report an issue: GitHub.