{"record":{"id":"54ce0a6f8ea6165c","repo":"pentaho/pentaho-kettle","slug":"could-not-decrypt-password","errorCode":null,"errorMessage":"Could not decrypt password","messagePattern":"Could not decrypt password","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"core/src/main/java/org/pentaho/di/core/database/util/DecryptingDataSource.java","lineNumber":31,"sourceCode":"\n\npackage org.pentaho.di.core.database.util;\n\nimport org.apache.commons.dbcp2.BasicDataSource;\nimport org.pentaho.support.encryption.Encr;\nimport org.pentaho.support.encryption.PasswordEncoderException;\nimport org.pentaho.support.utils.XmlParseException;\n\npublic class DecryptingDataSource extends BasicDataSource {\n\n  @Override\n  @SuppressWarnings( \"squid:S00112\" )\n  public void setPassword( String password ) {\n    try {\n      super.setPassword( Encr.getInstance().decryptPasswordOptionallyEncrypted( password ) );\n    } catch ( PasswordEncoderException | XmlParseException e ) {\n      //Should only get here if configuration was setup incorrectly\n      throw new RuntimeException( \"Could not decrypt password\", e );\n    }\n  }\n}\n","sourceCodeStart":13,"sourceCodeEnd":35,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/core/src/main/java/org/pentaho/di/core/database/util/DecryptingDataSource.java#L13-L35","documentation":"DecryptingDataSource.setPassword decrypts the configured password with Encr.decryptPasswordOptionallyEncrypted before delegating to the parent pool's setter. If the password can't be decrypted (PasswordEncoderException) or the source XML can't be parsed (XmlParseException), it fails fast with a RuntimeException 'Could not decrypt password'. This almost always means the stored password was not encrypted with this Kettle installation's encoder, or is malformed.","triggerScenarios":"Setting a password string that is not in the Kettle 'Encrypted ...' format, was encrypted with a different TwoWayPasswordEncoder, contains noise/whitespace, or is malformed XML when parsed.","commonSituations":"Copying connection passwords between Kettle installations with different KETTLE_TWO_WAY_PASSWORD_ENCODER/one-line encoder settings, hand-editing kettle.properties or connection XML, or migrating repositories where the plaintext password is mistakenly passed with 'Encrypted' prefix.","solutions":["Re-encrypt the password with the same encoder plugin used at runtime: run Encr.encryptPasswordIfNotUsingVariables on the plaintext.","Set the encoder consistently (kettle.properties TwoWayPasswordEncoderPluginID / system property) to match the one that produced the stored value.","If the password is plain text, pass it without the 'Encrypted ' prefix so decryptPasswordOptionallyEncrypted leaves it alone.","Fix malformed XML if XmlParseException is the cause."],"exampleFix":"// before\npool.setPassword( \"Encrypted 2be98afc86aa7f2e4bb18bd63c99dbdde\" ); // wrong encoder at runtime\n// after\n// align encoder, or store via:\npool.setPassword( Encr.encryptPasswordIfNotUsingVariables( \"plaintext\" ) );","handlingStrategy":"try-catch","validationCode":"// detect a non-decryptable password before assigning\nboolean decryptable( String pw ) {\n  try { Encr.getInstance().decryptPasswordOptionallyEncrypted( pw ); return true; }\n  catch ( Exception e ) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n  pool.setPassword( storedPassword );\n} catch ( RuntimeException e ) {\n  if ( e.getMessage().contains( \"Could not decrypt password\" ) ) {\n    throw new IllegalStateException( \"Stored password was not encrypted with this encoder; re-encrypt it\", e );\n  }\n  throw e;\n}","preventionTips":["Encrypt passwords with Encr.encryptPasswordIfNotUsingVariables in the same environment that will decrypt them","Keep the TwoWayPasswordEncoderPluginID consistent across environments","Never hand-edit 'Encrypted ...' strings; re-encrypt from plaintext instead","Test decryption at config load time, before pool setup"],"tags":["password","encryption","configuration"],"backgroundTag":"invalid-argument-format","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}