MuntashirAkon/AppManager · error · BackupException

Checksums for master key did not match.

Error message

Checksums for master key did not match.

What it means

checkMasterKey() hashes the current keystore master key bytes with the backup's checksum algorithm and compares the result to the checksum recorded at backup time. A mismatch means the master key changed since the backup was made, so encrypted backup data (key store/crypto-protected files) cannot be decrypted with the current key. Currently unreachable in this code version because checkMasterKey() returns early.

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/backup/RestoreOp.java:270

        if (true) {
            // TODO: 6/2/22 MasterKey may not actually be necessary.
            return;
        }
        String oldChecksum = mChecksum.get(MASTER_KEY);
        Path masterKey;
        try {
            masterKey = KeyStoreUtils.getMasterKey(mUserId);
        } catch (FileNotFoundException e) {
            if (oldChecksum == null) return;
            else
                throw new BackupException("Master key existed when the checksum was made but now it doesn't.");
        }
        if (oldChecksum == null) {
            throw new BackupException("Master key exists but it didn't exist when the backup was made.");
        }
        String newChecksum = DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, masterKey.getContentAsString().getBytes());
        if (!newChecksum.equals(oldChecksum)) {
            throw new BackupException("Checksums for master key did not match.");
        }
    }

    private void restoreApkFiles() throws BackupException {
        if (!mBackupFlags.backupApkFiles()) {
            throw new BackupException("APK restore is requested but backup doesn't contain any source files.");
        }
        Path[] backupSourceFiles = mBackupItem.getSourceFiles();
        if (backupSourceFiles.length == 0) {
            // No source backup found
            throw new BackupException("Source restore is requested but there are no source files.");
        }
        boolean isVerified = true;
        if (mPackageInfo != null) {
            // Check signature of the installed app
            List<String> certChecksumList = Arrays.asList(PackageUtils.getSigningCertChecksums(mBackupInfo.checksumAlgo, mPackageInfo, false));
            String[] certChecksums = BackupItems.Checksum.getCertChecksums(mChecksum);
            for (String checksum : certChecksums) {

View on GitHub (pinned to 0152f468fc)

Solutions

1. Restore the backup on the original device/user where the master key matches; keys are typically not portable across devices.
2. Regenerate the backup on the current device if the original key is unrecoverable — old encrypted data cannot be decrypted after key rotation.
3. Verify the checksum file belongs to this exact backup; a swapped checksum file yields a false mismatch.
4. Use the skip/decrypt-unsupported paths or an App Manager version where master-key verification is disabled, if the backup is unencrypted.

// Verify master key checksum yourself before restore:
Path key = null;
try { key = KeyStoreUtils.getMasterKey(userId); } catch (FileNotFoundException ignored) {}
if (key != null && checksums.get(MASTER_KEY) != null) {
    String now = DigestUtils.getHexDigest(info.checksumAlgo, key.getContentAsString().getBytes());
    if (!now.equals(checksums.get(MASTER_KEY))) { /* key rotated: abort early */ }
}

try { restoreOp.runRestore(); } catch (BackupException e) {
    if (e.getMessage().contains("Checksums for master key did not match")) {
        // restore on the original device/user or recreate the backup
    }
}

When it happens

Trigger: During restore, both the keystore key and the recorded old checksum exist, but DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, masterKey.getContentAsString().getBytes()) != oldChecksum.

Common situations: Android keystore keys were rotated/regenerated (clearing credentials, factory reset then restore of keystore, vendor keystore changes); restoring backups on a different device or user profile where a different master key exists; using a backup made before a key reset.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• Master key existed when the checksum was made but now it doe
• Master key exists but it didn't exist when the backup was ma
• Couldn't delete old file <inputFile>
• Failed to setup metadata.
• The app has keystore items and KeyStore backup isn't enabled

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/2d9f7a7840c173e3. Report an issue: GitHub.