{"record":{"id":"63a0c56192b1c8df","repo":"getsops/sops","slug":"incorrect-passphrase","errorCode":null,"errorMessage":"incorrect passphrase","messagePattern":"incorrect passphrase","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"age/encrypted_keys.go","lineNumber":70,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn fileKey, nil\n\t}\n\ti.NoMatchWarning()\n\treturn nil, age.ErrIncorrectIdentity\n}\n\nfunc (i *EncryptedIdentity) decrypt() error {\n\td, err := age.Decrypt(bytes.NewReader(i.Contents), &LazyScryptIdentity{i.Passphrase})\n\tif e := new(age.NoIdentityMatchError); errors.As(err, &e) {\n\t\t// ScryptIdentity returns ErrIncorrectIdentity for an incorrect\n\t\t// passphrase, which would lead Decrypt to returning \"no identity\n\t\t// matched any recipient\". That makes sense in the API, where there\n\t\t// might be multiple configured ScryptIdentity. Since in cmd/age there\n\t\t// can be only one, return a better error message.\n\t\ti.IncorrectPassphrase()\n\t\treturn fmt.Errorf(\"incorrect passphrase\")\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to decrypt identity file: %v\", err)\n\t}\n\ti.identities, err = age.ParseIdentities(d)\n\treturn err\n}\n\n// LazyScryptIdentity is an age.Identity that requests a passphrase only if it\n// encounters an scrypt stanza. After obtaining a passphrase, it delegates to\n// ScryptIdentity.\ntype LazyScryptIdentity struct {\n\tPassphrase func() (string, error)\n}\n\nvar _ age.Identity = &LazyScryptIdentity{}\n\nfunc (i *LazyScryptIdentity) Unwrap(stanzas []*age.Stanza) (fileKey []byte, err error) {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/age/encrypted_keys.go#L52-L88","documentation":"In age/encrypted_keys.go, decrypting a passphrase-encrypted identity file returns an ErrIncorrectIdentity from the scrypt stanza, but cmd/age has only one identity, so the code converts it into the clearer message \"incorrect passphrase\". It means the passphrase typed by the user does not decrypt the encrypted identity file. The ScryptIdentity is marked so the passphrase is re-requested.","triggerScenarios":"Unwrapping an age scrypt recipient where the user-supplied passphrase fails to decrypt the identity file — i.e. the wrong passphrase was entered at the prompt.","commonSituations":"Typo or stale passphrase in interactive prompts; SOPS_AGE_PASSPHRASE environment variable holding an old password; passphrase-encrypted key file regenerated with a new passphrase.","solutions":["Re-enter the correct passphrase for the encrypted identity file at the prompt.","Check that SOPS_AGE_PASSPHRASE (or the agent cache) contains the current passphrase; unset or update it.","Recover access by regenerating the identity or using a backup of the unencrypted key file."],"exampleFix":"// before\nexport SOPS_AGE_PASSPHRASE=oldpass\n// after\nunset SOPS_AGE_PASSPHRASE   # let age prompt for the correct passphrase","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"fileKey, err := identity.Unwrap(stanzas)\nif err != nil && strings.Contains(err.Error(), \"incorrect passphrase\") {\n    // clear cached passphrase and re-prompt the user\n    os.Unsetenv(\"SOPS_AGE_PASSPHRASE\")\n    return retryUnwrap(stanzas)\n}","preventionTips":["Verify the passphrase by test-decrypting the key file once at setup","Avoid stale SOPS_AGE_PASSPHRASE values in shell profiles","Keep an unencrypted backup of the age identity in secure storage"],"tags":["age","passphrase","decryption","scrypt","keyfile"],"backgroundTag":"incorrect-passphrase","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}