What causes "Could not decrypt password" in pentaho/pentaho-kettle?

Re-encrypt the password with the same encoder plugin used at runtime: run Encr.encryptPasswordIfNotUsingVariables on the plaintext.

pentaho/pentaho-kettle · critical · RuntimeException

Could not decrypt password

Error message

Could not decrypt password

What it means

DecryptingDataSource.setPassword decrypts the configured password with Encr.decryptPasswordOptionallyEncrypted before delegating to the parent pool's setter. If the password can't be decrypted (PasswordEncoderException) or the source XML can't be parsed (XmlParseException), it fails fast with a RuntimeException 'Could not decrypt password'. This almost always means the stored password was not encrypted with this Kettle installation's encoder, or is malformed.

Solutions

Re-encrypt the password with the same encoder plugin used at runtime: run Encr.encryptPasswordIfNotUsingVariables on the plaintext.
Set the encoder consistently (kettle.properties TwoWayPasswordEncoderPluginID / system property) to match the one that produced the stored value.
If the password is plain text, pass it without the 'Encrypted ' prefix so decryptPasswordOptionallyEncrypted leaves it alone.
Fix malformed XML if XmlParseException is the cause.

Example fix

// before
pool.setPassword( "Encrypted 2be98afc86aa7f2e4bb18bd63c99dbdde" ); // wrong encoder at runtime
// after
// align encoder, or store via:
pool.setPassword( Encr.encryptPasswordIfNotUsingVariables( "plaintext" ) );

Defensive patterns

Strategy: try-catch

Validate before calling

// detect a non-decryptable password before assigning
boolean decryptable( String pw ) {
  try { Encr.getInstance().decryptPasswordOptionallyEncrypted( pw ); return true; }
  catch ( Exception e ) { return false; }
}

Try / catch

try {
  pool.setPassword( storedPassword );
} catch ( RuntimeException e ) {
  if ( e.getMessage().contains( "Could not decrypt password" ) ) {
    throw new IllegalStateException( "Stored password was not encrypted with this encoder; re-encrypt it", e );
  }
  throw e;
}

Prevention

Encrypt passwords with Encr.encryptPasswordIfNotUsingVariables in the same environment that will decrypt them
Keep the TwoWayPasswordEncoderPluginID consistent across environments
Never hand-edit 'Encrypted ...' strings; re-encrypt from plaintext instead
Test decryption at config load time, before pool setup

When it happens

Trigger: Setting a password string that is not in the Kettle 'Encrypted ...' format, was encrypted with a different TwoWayPasswordEncoder, contains noise/whitespace, or is malformed XML when parsed.

Common situations: Copying connection passwords between Kettle installations with different KETTLE_TWO_WAY_PASSWORD_ENCODER/one-line encoder settings, hand-editing kettle.properties or connection XML, or migrating repositories where the plaintext password is mistakenly passed with 'Encrypted' prefix.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/54ce0a6f8ea6165c. Report an issue: GitHub.

Appendix: source

Thrown at core/src/main/java/org/pentaho/di/core/database/util/DecryptingDataSource.java:31


package org.pentaho.di.core.database.util;

import org.apache.commons.dbcp2.BasicDataSource;
import org.pentaho.support.encryption.Encr;
import org.pentaho.support.encryption.PasswordEncoderException;
import org.pentaho.support.utils.XmlParseException;

public class DecryptingDataSource extends BasicDataSource {

  @Override
  @SuppressWarnings( "squid:S00112" )
  public void setPassword( String password ) {
    try {
      super.setPassword( Encr.getInstance().decryptPasswordOptionallyEncrypted( password ) );
    } catch ( PasswordEncoderException | XmlParseException e ) {
      //Should only get here if configuration was setup incorrectly
      throw new RuntimeException( "Could not decrypt password", e );
    }
  }
}

View on GitHub (pinned to f3058517a1)