{"record":{"id":"485878d4c0602ab7","repo":"atuinsh/atuin","slug":"wrongkey","errorCode":null,"errorMessage":"WrongKey","messagePattern":"WrongKey","errorType":"error_code","errorClass":"SyncError","httpStatus":null,"severity":"error","filePath":"crates/atuin-client/src/record/sync/mod.rs","lineNumber":223,"sourceCode":"        let sample = remote_index\n            .hosts\n            .iter()\n            .flat_map(|(host, tags)| {\n                tags.keys().map(move |tag| RecordSeriesKey::new(*host, tag.clone()))\n            })\n            // Plaintext series (packfile manifests) would fail decryption with any key, so they\n            // can't be used to check whether the local key matches the remote.\n            .find(|series| !series.tag.is_plaintext());\n\n        let series = sample?;\n\n        let record = match self.client.records(&series).one().await {\n            Ok(Some(record)) => record,\n            Ok(None) => return None,\n            Err(e) => return Some(SyncError::RemoteRequestError { msg: e.to_string() }),\n        };\n\n        record.decrypt(key).err().map(|_| SyncError::WrongKey)\n    }\n\n    /// Fetch the remote's record status index.\n    #[instrument(level = \"trace\", skip_all, err)]\n    pub async fn record_status(&self) -> Result<RecordStatus, SyncError> {\n        self.client\n            .record_status()\n            .await\n            .map_err(|e| SyncError::RemoteRequestError { msg: e.to_string() })\n    }\n\n    #[instrument(level = \"trace\", skip_all, err)]\n    pub async fn diff(&self) -> Result<(Vec<Diff>, RecordStatus), SyncError> {\n        let local_index = self\n            .store\n            .status()\n            .await\n            .map_err(|e| SyncError::LocalStoreError { msg: e.to_string() })?;","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/atuinsh/atuin/blob/900007c48045867e7f44b0f9bc55ad9dbe99ee0d/crates/atuin-client/src/record/sync/mod.rs#L205-L241","documentation":"`SyncError::WrongKey` is returned by `check_key_against_index` when a record fetched from the sync server cannot be decrypted with the local encryption key (`record.decrypt(key)` errs). It means the key being used does not match the key the records were encrypted with — typically during `atuin login`/`sync` key verification.","triggerScenarios":"During `check_encryption_key`, a remote record is downloaded and `record.decrypt(key)` fails (crates/atuin-client/src/record/sync/mod.rs:223), producing `SyncError::WrongKey`. Triggered by logging in with an encryption key that differs from the one the account's records were encrypted with.","commonSituations":"Re-creating an account and reusing an old key; copying a key from a different atuin account; key file at ~/.local/share/atuin/key being regenerated or from another machine; typos when pasting the key during login.","solutions":["Log in again supplying the correct original encryption key (from the machine that first ran `atuin register`, stored in ~/.local/share/atuin/key).","Export the key from a working machine with `atuin key` and use it at login (`atuin login --key <key>`).","If the key is truly lost, register a fresh account (accepting history loss) so all records re-encrypt under the new key."],"exampleFix":"// before\natuin login --username me --password pw --key <wrong-key>\n// after\natuin key   # on the original machine\natuin login --username me --password pw --key <correct-key-from-atuin-key>","handlingStrategy":"try-catch","validationCode":"// verify the local key decrypts an existing local record before syncing\nlet local_key = atuin_client::encryption::load_key()?;\n// run `atuin key` on the original machine and compare before logging in","typeGuard":null,"tryCatchPattern":"match sync::check_encryption_key().await {\n    Some(SyncError::WrongKey) => eprintln!(\"Encryption key mismatch: re-login with the original key from `atuin key` on the registering machine\"),\n    Some(other) => eprintln!(\"sync check failed: {other:?}\"),\n    None => { /* key OK, proceed with sync */ }\n}","preventionTips":["Back up ~/.local/share/atuin/key; it is the only way to decrypt synced history.","Run `atuin key` on a working machine before logging in on a new one.","Never regenerate the key file; copy it between machines instead.","Register one account per key; don't reuse keys across accounts."],"tags":["encryption","sync","key-mismatch","decryption"],"backgroundTag":"checksum-mismatch","analyzedSha":"900007c48045867e7f44b0f9bc55ad9dbe99ee0d","analyzedAt":"2026-09-19T12:52:51.491Z","contentChangedAt":"2026-09-19T12:52:51.491Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}