XTLS/Xray-core · error

bad encrypt request packet id

Error message

bad encrypt request packet id

What it means

The Encryption Request was expected to have packet ID 0x01, but the server sent a different ID. In the Minecraft login state after Login Start, the next packet is either Encryption Request (0x01) or Login Disconnect / Compression (0x00/0x03); a different ID means the peer is not following the expected login sequence.

Source

Thrown at transport/internet/finalmask/xmc/client.go:127

	if err != nil {
		return fmt.Errorf("select profile: %w", err)
	}
	selectedProfile := c.profiles[randomProfile.Int64()]
	username := String(selectedProfile.Username)

	err = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)
	if err != nil {
		return fmt.Errorf("write login start: %w", err)
	}

	// Encryption Request
	pkt, err := readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read encryption request: %w", err)
	}

	if pkt.packetID != 0x01 {
		return fmt.Errorf("bad encrypt request packet id")
	}

	var (
		serverId    String
		publicKey   Bytes
		verifyToken Bytes
	)

	err = pkt.readFields(&serverId, &publicKey, &verifyToken)
	if err != nil {
		return fmt.Errorf("read encryption request fields: %w", err)
	}

	if !bytes.Equal(publicKey, c.rsaPublicKey) {
		return fmt.Errorf("server public key mismatch")
	}

	k, err := x509.ParsePKIXPublicKey(publicKey)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Confirm the server enables encryption for login (online-mode-equivalent setup).
2. Read the disconnect reason: if the ID was 0x00, the server sent a ChatComponent explaining the rejection (banned, full, whitelist).
3. Match protocol expectations: the client pins protocol version 775, so the server must support it.

if err := cc.Handshake(); err != nil {
	if strings.Contains(err.Error(), "bad encrypt request packet id") {
		return fmt.Errorf("server did not send Encryption Request (id 0x01); it may have disconnected us or run without encryption: %w", err)
	}
	return err
}

When it happens

Trigger: Server responding with Login Disconnect (0x00, e.g. banned/whitelisted/full), Set Compression (0x03) because it skips encryption, or arbitrary data because the port is not a Minecraft login server. The check fires before any fields are parsed.

Common situations: Target server in offline mode or configured without encryption; server rejecting the username (disconnect packet arrives instead); protocol version drift where packet IDs shifted.

Related errors

• write handshake packet: %w
• write login start: %w
• read encryption request: %w
• read encryption request fields: %w
• No available name server could be created from

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/ad47fa8bfdcc5d0c. Report an issue: GitHub.