shwenzhang/AndResGuard · error · RuntimeException

No passwords

Error message

No passwords

What it means

decryptPkcs8EncodedKey attempts to decrypt an encrypted PKCS#8 private key with each candidate password. If the password list is empty, no exceptions are recorded and a RuntimeException "No passwords" is thrown. This signals that no passwords were provided for decrypting a PEM/PKCS#8 key file, distinct from wrong-password failures which rethrow the underlying exception.

Solutions

1. Provide the key password via --key-pass pass:<password> (or env:/file:/stdin form).
2. Alternatively decrypt the key offline (e.g. openssl pkcs8 -topk8 -nocrypt) and pass an unencrypted PKCS#8 file with --key.
3. Verify the password source (env var/file) actually contains a value.
4. If calling the API, ensure the passwords List<char[]> is non-empty.

Example fix

// before
apksigner sign --key encrypted.pk8 --cert cert.x509.pem --out app.apk app-unsigned.apk
// after
apksigner sign --key encrypted.pk8 --cert cert.x509.pem --key-pass pass:keyPw --out app.apk app-unsigned.apk

java
if (keyPassword == null || keyPassword.isEmpty()) {
    throw new IllegalArgumentException("Key password required for encrypted PKCS#8 key files (--key-pass)");
}

java
try {
    signerBuilder.build().sign(outputFile);
} catch (RuntimeException e) {
    if ("No passwords".equals(e.getMessage())) {
        System.err.println("The --key file is encrypted; supply --key-pass pass:<password>.");
    } else {
        throw e;
    }
}

When it happens

Trigger: Signing with --key/--cert file-based signing where the PKCS#8 key file is encrypted but no --key-pass spec was given, so loadPrivateKeyAndCertsFromFiles calls decryptPkcs8EncodedKey with an empty passwords list.

Common situations: Using an encrypted (password-protected) PEM key without --key-pass; pointing --key-pass at an empty env var or file; forgetting that unencrypted-key workflows still need the spec only when encryption is present.

Related errors

• No keystore passwords
• No key passwords
• Not an RSA, EC, or DSA private key
• At least one signer must be specified
• Failed to read resource

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/8932c754f61d6d5a. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:589

    private static PKCS8EncodedKeySpec decryptPkcs8EncodedKey(
        EncryptedPrivateKeyInfo encryptedPrivateKeyInfo, List<char[]> passwords)
        throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException {
      SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(encryptedPrivateKeyInfo.getAlgName());
      InvalidKeySpecException lastKeySpecException = null;
      InvalidKeyException lastKeyException = null;
      for (char[] password : passwords) {
        PBEKeySpec decryptionKeySpec = new PBEKeySpec(password);
        try {
          SecretKey decryptionKey = keyFactory.generateSecret(decryptionKeySpec);
          return encryptedPrivateKeyInfo.getKeySpec(decryptionKey);
        } catch (InvalidKeySpecException e) {
          lastKeySpecException = e;
        } catch (InvalidKeyException e) {
          lastKeyException = e;
        }
      }
      if ((lastKeyException == null) && (lastKeySpecException == null)) {
        throw new RuntimeException("No passwords");
      } else if (lastKeyException != null) {
        throw lastKeyException;
      } else {
        throw lastKeySpecException;
      }
    }

    private static PrivateKey loadPkcs8EncodedPrivateKey(PKCS8EncodedKeySpec spec)
        throws InvalidKeySpecException, NoSuchAlgorithmException {
      try {
        return KeyFactory.getInstance("RSA").generatePrivate(spec);
      } catch (InvalidKeySpecException expected) {
      }
      try {
        return KeyFactory.getInstance("EC").generatePrivate(spec);
      } catch (InvalidKeySpecException expected) {
      }
      try {

View on GitHub (pinned to e4df245d82)