juicedata/juicefs · error

decode key: %s

Error message

decode key: %s

What it means

Returned by Format.Decrypt() when base64.StdEncoding.DecodeString fails on an encrypted secret field. The stored value is expected to be base64(nonce || ciphertext); a value that is not valid base64 (or has been mangled) triggers this error.

Source

Thrown at pkg/meta/config.go:282

	if !f.KeyEncrypted {
		return nil
	}

	ci, err := newCipher(f.EncryptAlgo, f.UUID)
	if err != nil {
		return err
	}
	decrypt := func(k *string) {
		if *k == "" {
			return
		}
		if *k == "removed" {
			err = fmt.Errorf("secret was removed; please correct it with `config` command")
			return
		}
		buf, e := base64.StdEncoding.DecodeString(*k)
		if e != nil {
			err = fmt.Errorf("decode key: %s", e)
			return
		}
		plaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)
		if e != nil {
			err = fmt.Errorf("open cipher: %s", e)
			return
		}
		*k = string(plaintext)
	}

	decrypt(&f.EncryptKey)
	decrypt(&f.SecretKey)
	decrypt(&f.SessionToken)
	f.KeyEncrypted = false
	return err
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Re-encrypt and store the secret correctly with `juicefs config <META-URL> --encrypt-key <key>`
2. Check the stored value is pure base64 (no whitespace, newlines, or quoting artifacts) and restore it
3. If the value came from a dump/backup, reload it with the official `juicefs load` command instead of manual edits

if _, err := base64.StdEncoding.DecodeString(format.EncryptKey); err != nil && format.EncryptKey != "" { return fmt.Errorf("encrypt key is not valid base64: %w", err) }

func isBase64(s string) bool { _, err := base64.StdEncoding.DecodeString(s); return err == nil }

if err := format.Decrypt(); err != nil { if strings.Contains(err.Error(), "decode key") { /* re-store the secret via juicefs config */ } }

When it happens

Trigger: Decrypting a format whose EncryptKey/secret field contains characters outside the base64 alphabet, whitespace, quotes, or has been truncated by manual editing or copy/paste.

Common situations: Hand-editing a metadata dump, copying the key with extra characters, restoring backups through a tool that escapes the value, or storing the secret in a JSON/YAML layer that altered it.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• format decrypt: %s
• %w: please set the 'JFS_RSA_PASSPHRASE' environment variable
• create %sor: %w
• decrypt format: %s
• encrypt format: %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/1bff7bc693d4c2da. Report an issue: GitHub.