{"record":{"id":"86f49d80299185fe","repo":"FuelLabs/fuels-ts","slug":"invalid-password","errorCode":"INVALID_PASSWORD","errorMessage":"Failed to decrypt the keystore wallet, the provided password is incorrect.","messagePattern":"Failed to decrypt the keystore wallet, the provided password is incorrect\\.","errorType":"validation","errorClass":"FuelError","httpStatus":null,"severity":"error","filePath":"packages/account/src/wallet/keystore-wallet.ts","lineNumber":151,"sourceCode":"\n  const key = scrypt({\n    password: passwordBuffer,\n    salt: saltBuffer,\n    n,\n    p,\n    r,\n    dklen,\n  });\n\n  // Verify the MAC. It should be the Keccak-256 hash of the concatenation of the second half of the derived key and the ciphertext.\n  const data = Uint8Array.from([...key.subarray(16, 32), ...ciphertextBuffer]);\n\n  const macHashUint8Array = keccak256(data);\n\n  const macHash = stringFromBuffer(macHashUint8Array, 'hex');\n\n  if (mac !== macHash) {\n    throw new FuelError(\n      ErrorCode.INVALID_PASSWORD,\n      'Failed to decrypt the keystore wallet, the provided password is incorrect.'\n    );\n  }\n\n  // Decrypt the private key.\n  const buffer = await decryptJsonWalletData(ciphertextBuffer, key, ivBuffer);\n\n  const privateKey = hexlify(buffer);\n\n  return privateKey;\n}\n","sourceCodeStart":133,"sourceCodeEnd":164,"githubUrl":"https://github.com/FuelLabs/fuels-ts/blob/b3f37c91aca4aa9d5e4c0d3967f66237190826ea/packages/account/src/wallet/keystore-wallet.ts#L133-L164","documentation":"Thrown by decryptKeystoreWallet() when the MAC verification fails. After deriving the scrypt key from the supplied password and the keystore's salt, the code computes Keccak-256 over the second half of the key concatenated with the ciphertext and compares it to the stored 'mac'. A mismatch proves the password is wrong (or the keystore is corrupted) — decryption is aborted before any private key is exposed.","triggerScenarios":"Calling decryptKeystoreWallet(jsonWallet, password) — directly or via Wallet.fromKeystoreWallet / WalletUnlocked.loadKeystore — with a password that does not match the one used in encryptKeystoreWallet. Also if the keystore JSON was tampered with (ciphertext, salt, or mac altered).","commonSituations":"Wrong password typed by the user; password changed but the old keystore file was retained; keystore file corrupted on disk or truncated during copy; cross-tool import where a different KDF/cipher was assumed; trailing whitespace in the password input.","solutions":["Re-enter the password carefully, watching for trailing spaces or autocorrect.","If the password is forgotten, the keystore is unrecoverable — restore from a backup or seed phrase.","Verify the keystore JSON is intact (valid JSON, all crypto fields present, not truncated).","Confirm the keystore was produced by this SDK's encryptKeystoreWallet (same scrypt/AES-128-CTR scheme).","Strip accidental whitespace/newlines from the password string before passing it in."],"exampleFix":"// before\nconst wallet = await WalletUnlocked.loadKeystore(path, 'wrong-password');\n// after\nconst password = userInput.trim();\nconst wallet = await WalletUnlocked.loadKeystore(path, password);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  return await decryptKeystoreWallet(json, password);\n} catch (err) {\n  if (err instanceof FuelError && err.code === ErrorCode.INVALID_PASSWORD) {\n    // prompt user for password again; do not expose whether mac vs ciphertext failed\n  }\n  throw err;\n}","preventionTips":["Trim and validate password input before decryption.","Verify the keystore JSON is complete and uncorrupted before attempting.","Confirm the keystore was produced by the same SDK encryption scheme."],"tags":["keystore","wallet","password","decryption","security"],"backgroundTag":null,"analyzedSha":"b3f37c91aca4aa9d5e4c0d3967f66237190826ea","analyzedAt":"2026-08-12T20:30:56.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}