MuntashirAkon/AppManager · error · BackupException

Master key exists but it didn't exist when the backup was ma

Error message

Master key exists but it didn't exist when the backup was made.

What it means

checkMasterKey() throws this when a keystore master key currently exists but the backup's checksum file has no checksum entry for the master key (mChecksum.get(MASTER_KEY) == null). This means the key was provisioned after the backup was taken, so the backup's encrypted data was not made with (or verified against) the current key. Like error 111, it is currently unreachable due to the early return in checkMasterKey().

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/backup/RestoreOp.java:266

        }
    }

    private void checkMasterKey() throws BackupException {
        if (true) {
            // TODO: 6/2/22 MasterKey may not actually be necessary.
            return;
        }
        String oldChecksum = mChecksum.get(MASTER_KEY);
        Path masterKey;
        try {
            masterKey = KeyStoreUtils.getMasterKey(mUserId);
        } catch (FileNotFoundException e) {
            if (oldChecksum == null) return;
            else
                throw new BackupException("Master key existed when the checksum was made but now it doesn't.");
        }
        if (oldChecksum == null) {
            throw new BackupException("Master key exists but it didn't exist when the backup was made.");
        }
        String newChecksum = DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, masterKey.getContentAsString().getBytes());
        if (!newChecksum.equals(oldChecksum)) {
            throw new BackupException("Checksums for master key did not match.");
        }
    }

    private void restoreApkFiles() throws BackupException {
        if (!mBackupFlags.backupApkFiles()) {
            throw new BackupException("APK restore is requested but backup doesn't contain any source files.");
        }
        Path[] backupSourceFiles = mBackupItem.getSourceFiles();
        if (backupSourceFiles.length == 0) {
            // No source backup found
            throw new BackupException("Source restore is requested but there are no source files.");
        }
        boolean isVerified = true;
        if (mPackageInfo != null) {

View on GitHub (pinned to 0152f468fc)

Solutions

1. Restore the matching checksum file that accompanied the original backup; do not mix checksum files across backup sets.
2. If the backup predates master-key usage, upgrade App Manager to a build where checkMasterKey is skipped (early return) or restore with a version contemporary to the backup.
3. If decryption is needed and the key is wrong, re-create the backup on the device/profile holding the correct key.
4. Confirm the backup directory contains all companion files (checksums, metadata) — a partial copy can lose the MASTER_KEY checksum entry.

// Ensure the checksum set matches key state before restoring:
boolean keyExists = true;
try { KeyStoreUtils.getMasterKey(userId); } catch (FileNotFoundException e) { keyExists = false; }
if (keyExists && checksums.get(MASTER_KEY) == null) {
    // backup predates key: use matching tooling/backup set
}

try { restoreOp.runRestore(); } catch (BackupException e) {
    if (e.getMessage().contains("Master key exists but it didn't exist when the backup was made")) {
        // use App Manager version contemporary with the backup, or restore without key verification
    }
}

When it happens

Trigger: KeyStoreUtils.getMasterKey(mUserId) succeeds, but oldChecksum = mChecksum.get(MASTER_KEY) is null during a restore.

Common situations: Backups taken before App Manager ever created a master key are restored on a device where the key now exists (e.g. after an earlier backup created it); mixing backup sets from an older App Manager version with a newer install; copying checksum files from one backup to another.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• Master key existed when the checksum was made but now it doe
• Checksums for master key did not match.
• Couldn't delete old file <inputFile>
• Failed to setup metadata.
• The app has keystore items and KeyStore backup isn't enabled

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/5adef021f34580f2. Report an issue: GitHub.