What causes "unsupported hash version (%d)" in kopia/kopia?

Upgrade kopia to a release that supports the stored hash version.

unsupported hash version

Error message

unsupported hash version (%d)

What it means

getPasswordHashAlgorithm maps a PasswordHashVersion enum value to its hashing algorithm name. Any version outside the known set (unset/scrypt, pbkdf2) produces this error with the numeric version embedded in the message.

Solutions

Upgrade kopia to a release that supports the stored hash version.
Re-set the affected user's password so a supported algorithm (scrypt or pbkdf2) generates the hash.
If the algorithm is actually known, map the version constant correctly instead of passing a raw integer.
Restore the user profile manifest from backup if the version field was corrupted.

Example fix

// before
h.PasswordHashVersion = 42
// after
h.PasswordHashVersion = user.Pbkdf2HashVersion // a supported constant

Defensive patterns

Strategy: try-catch

Validate before calling

if !validHashVersion(h.PasswordHashVersion) { /* upgrade kopia or re-hash */ }

Try / catch

_, err := user.GetUserProfile(ctx, rep, name)
if err != nil && strings.Contains(err.Error(), "unsupported hash version") {
    return fmt.Errorf("kopia too old for this repository: %w", err)
}

Prevention

Pin kopia version >= the version that created the repository.
Use named version constants, never raw integers, when constructing hashes.
On upgrade of hash defaults, migrate stored hashes explicitly.

When it happens

Trigger: Calling validate or computePasswordHash with a PasswordHashVersion value not defined in this build — typically hashes created by a newer kopia version, or a version field corrupted to a bogus integer.

Common situations: Opening a repository created by a newer kopia release with an older binary; manual edits to user profile metadata; migration scripts writing arbitrary version numbers.

Related errors

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/6b0a985e2b90ae9e. Report an issue: GitHub.

Appendix: source

Thrown at internal/user/password_hashings.go:14

package user

import "github.com/pkg/errors"

// getPasswordHashAlgorithm returns the password hash algorithm given a version.
func getPasswordHashAlgorithm(passwordHashVersion int) (string, error) {
	switch passwordHashVersion {
	// when the version is unsetDefaultHashVersion, map it to ScryptHashVersion
	case unsetDefaultHashVersion, ScryptHashVersion:
		return scryptHashAlgorithm, nil
	case Pbkdf2HashVersion:
		return pbkdf2HashAlgorithm, nil
	default:
		return "", errors.Errorf("unsupported hash version (%d)", passwordHashVersion)
	}
}

View on GitHub (pinned to 82495e54b5)