rustdesk/rustdesk-server · error

Invalid secret key

Error message

Invalid secret key

What it means

validate_keypair (src/utils.rs, called from the `--doctor`/keypair validation path in main) first base64-decodes the supplied secret key; if `base64::decode(sk)` fails, it bails with "Invalid secret key". This means the -k/--key argument is not valid base64 at all, before any cryptographic check happens.

Solutions

1. Re-copy the secret key exactly as printed by the key-generation step ('Secret Key: ...'), with no truncation or whitespace.
2. Quote the argument in the shell (single quotes) so '+' and '/' are not mangled.
3. Verify the string decodes: `echo '<sk>' | base64 -d > /dev/null` must succeed.
4. Regenerate the keypair with the built-in key generation if the original key file is lost.

Example fix

// before
hbbs --doctor -k 0Sfx!invalid
// after (single-quoted, full base64 string)
hbbs --doctor -k '0SfxB0b+BASE64SECRETKEY=='

fn is_base64(s: &str) -> bool { base64::decode(s.trim()).is_ok() }
// pre-check: assert!(is_base64(&sk), "secret key must be valid base64");

fn valid_sk_base64(s: &str) -> Option<Vec<u8>> { base64::decode(s.trim()).ok().filter(|b| b.len() == 64) }

match validate_keypair(&pk, &sk) {
    Err(e) if e.to_string().contains("secret key") => eprintln!("Re-copy the secret key from key-gen output"),
    Err(e) => eprintln!("keypair check failed: {e}"),
    Ok(()) => println!("keypair OK"),
}

When it happens

Trigger: Passing a secret key string to the keypair validator that contains characters outside the base64 alphabet, has wrong padding, or is empty/whitespace so base64::decode returns Err.

Common situations: Copy-paste truncation or extra whitespace/newlines in the key; confusing the base64 public key with the raw secret key; shell quoting mangling '+' or '/' characters; editing key files by hand.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid public key
• Invalid Secret key
• Invalid Public key
• Invalid port
• Key pair is INVALID

AI-assisted analysis of rustdesk/rustdesk-server@a7736be5e4 (2026-09-09). Data as JSON: /api/errors/ec4da2b52940ad23. Report an issue: GitHub.

Appendix: source

Thrown at src/utils.rs:38

}

fn error_then_help(msg: &str) {
    println!("ERROR: {msg}\n");
    print_help();
}

fn gen_keypair() {
    let (pk, sk) = sign::gen_keypair();
    let public_key = base64::encode(pk);
    let secret_key = base64::encode(sk);
    println!("Public Key:  {public_key}");
    println!("Secret Key:  {secret_key}");
}

fn validate_keypair(pk: &str, sk: &str) -> ResultType<()> {
    let sk1 = base64::decode(sk);
    if sk1.is_err() {
        bail!("Invalid secret key");
    }
    let sk1 = sk1.unwrap();

    let secret_key = sign::SecretKey::from_slice(sk1.as_slice());
    if secret_key.is_none() {
        bail!("Invalid Secret key");
    }
    let secret_key = secret_key.unwrap();

    let pk1 = base64::decode(pk);
    if pk1.is_err() {
        bail!("Invalid public key");
    }
    let pk1 = pk1.unwrap();

    let public_key = sign::PublicKey::from_slice(pk1.as_slice());
    if public_key.is_none() {
        bail!("Invalid Public key");

View on GitHub (pinned to a7736be5e4)