getsops/sops · error

incorrect passphrase

Error message

incorrect passphrase

What it means

In age/encrypted_keys.go, decrypting a passphrase-encrypted identity file returns an ErrIncorrectIdentity from the scrypt stanza, but cmd/age has only one identity, so the code converts it into the clearer message "incorrect passphrase". It means the passphrase typed by the user does not decrypt the encrypted identity file. The ScryptIdentity is marked so the passphrase is re-requested.

Source

Thrown at age/encrypted_keys.go:70

		if err != nil {
			return nil, err
		}
		return fileKey, nil
	}
	i.NoMatchWarning()
	return nil, age.ErrIncorrectIdentity
}

func (i *EncryptedIdentity) decrypt() error {
	d, err := age.Decrypt(bytes.NewReader(i.Contents), &LazyScryptIdentity{i.Passphrase})
	if e := new(age.NoIdentityMatchError); errors.As(err, &e) {
		// ScryptIdentity returns ErrIncorrectIdentity for an incorrect
		// passphrase, which would lead Decrypt to returning "no identity
		// matched any recipient". That makes sense in the API, where there
		// might be multiple configured ScryptIdentity. Since in cmd/age there
		// can be only one, return a better error message.
		i.IncorrectPassphrase()
		return fmt.Errorf("incorrect passphrase")
	}
	if err != nil {
		return fmt.Errorf("failed to decrypt identity file: %v", err)
	}
	i.identities, err = age.ParseIdentities(d)
	return err
}

// LazyScryptIdentity is an age.Identity that requests a passphrase only if it
// encounters an scrypt stanza. After obtaining a passphrase, it delegates to
// ScryptIdentity.
type LazyScryptIdentity struct {
	Passphrase func() (string, error)
}

var _ age.Identity = &LazyScryptIdentity{}

func (i *LazyScryptIdentity) Unwrap(stanzas []*age.Stanza) (fileKey []byte, err error) {

View on GitHub (pinned to 13442bb981)

Solutions

1. Re-enter the correct passphrase for the encrypted identity file at the prompt.
2. Check that SOPS_AGE_PASSPHRASE (or the agent cache) contains the current passphrase; unset or update it.
3. Recover access by regenerating the identity or using a backup of the unencrypted key file.

Example fix

// before
export SOPS_AGE_PASSPHRASE=oldpass
// after
unset SOPS_AGE_PASSPHRASE   # let age prompt for the correct passphrase

fileKey, err := identity.Unwrap(stanzas)
if err != nil && strings.Contains(err.Error(), "incorrect passphrase") {
    // clear cached passphrase and re-prompt the user
    os.Unsetenv("SOPS_AGE_PASSPHRASE")
    return retryUnwrap(stanzas)
}

When it happens

Trigger: Unwrapping an age scrypt recipient where the user-supplied passphrase fails to decrypt the identity file — i.e. the wrong passphrase was entered at the prompt.

Common situations: Typo or stale passphrase in interactive prompts; SOPS_AGE_PASSPHRASE environment variable holding an old password; passphrase-encrypted key file regenerated with a new passphrase.

Related errors

• failed to decrypt identity file: %v
• could not read passphrase: %v
• failed to copy age decrypted data into bytes.Buffer: %w
• Unknown datatype: %s
• failed to read '%s': %w

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/63a0c56192b1c8df. Report an issue: GitHub.