{"record":{"id":"53fb58eda418401d","repo":"MuntashirAkon/AppManager","slug":"incorrect-password","errorCode":null,"errorMessage":"Incorrect password","messagePattern":"Incorrect password","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/backup/adb/AndroidBackupHeader.java","lineNumber":307,"sourceCode":"                offset, offset + len);\n        offset += len;\n        // and finally the encryption key checksum hash\n        len = mkBlob[offset++];\n        byte[] mkChecksum = Arrays.copyOfRange(mkBlob,\n                offset, offset + len);\n\n        // now validate the decrypted encryption key against the checksum\n        byte[] calculatedCk = makeKeyChecksum(algorithm, encryptionKey, ckSalt,\n                rounds);\n        if (MessageDigest.isEqual(calculatedCk, mkChecksum)) {\n            ivSpec = new IvParameterSpec(IV);\n            c.init(Cipher.DECRYPT_MODE,\n                    new SecretKeySpec(encryptionKey, \"AES\"),\n                    ivSpec);\n            // Only if all of the above worked properly will 'result' be assigned\n            result = new CipherInputStream(rawInStream, c);\n        } else {\n            throw new IOException(\"Incorrect password\");\n        }\n\n        return result;\n    }\n\n    /**\n     * Used for generating random salts or passwords.\n     */\n    public byte[] randomBytes(int bits) {\n        byte[] array = new byte[bits / 8];\n        mRng.nextBytes(array);\n        return array;\n    }\n\n    @NonNull\n    private static String readHeaderLine(@NonNull InputStream in) throws IOException {\n        int c;\n        StringBuilder buffer = new StringBuilder(80);","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/backup/adb/AndroidBackupHeader.java#L289-L325","documentation":"IOException from AndroidBackupHeader.attemptEncryptionKeyDecryption: the PBKDF2-derived key failed the PBKDF2 verification check built into the Android backup format, meaning the supplied password (combined with the stored user/checksum salts and rounds) does not derive the correct key.","triggerScenarios":"A wrong or mistyped password was supplied to an encrypted .ab backup; also triggered when salt/iteration lines in the header are corrupted so verification fails even with the right password.","commonSituations":"Users forgetting the password typed at 'adb backup' time; keyboard layout/input-method differences; automated scripts with placeholder passwords; header corruption from partial transfers.","solutions":["Re-enter the correct backup password carefully (check keyboard layout, trailing spaces)","Try common password variants used when the backup was created","If the header may be corrupted, verify the salt/round lines against a known-good backup header","Without the correct password the backup is cryptographically unrecoverable — create a new backup"],"exampleFix":"// before\nnew AndroidBackupHeader(stream, \"password123\".toCharArray()).toTar(); // guess\n// after\nchar[] pw = System.console().readPassword(\"Backup password: \");\nif (pw == null || pw.length == 0) throw new IllegalArgumentException(\"Password required\");\nnew AndroidBackupHeader(stream, pw).toTar();","handlingStrategy":"try-catch","validationCode":"// No pre-check can validate a password; enforce non-empty and prompt deliberately\nif (password == null || password.length == 0) {\n    throw new IllegalArgumentException(\"Encrypted backup requires a password\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    InputStream tar = header.toTar();\n} catch (IOException e) {\n    if (e.getMessage().contains(\"Incorrect password\")) {\n        char[] pw = System.console().readPassword(\"Wrong password. Try again: \");\n        header = new AndroidBackupHeader(reopen(stream), pw);\n        tar = header.toTar();\n    } else throw e;\n}","preventionTips":["Re-read the password from the user rather than retrying stored guesses","Beware keyboard layouts and autocomplete when the backup was created","Store backup passwords in a credential manager, not scripts","Accept that wrong-password backups are unrecoverable; keep the raw stream for retries"],"tags":["backup","encryption","wrong-password"],"backgroundTag":"authentication-required","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}