siyuan-note/siyuan · error

311

311

Error message

Incorrect master password

What it means

EnableEncryptedNotebook returns Conf.Language(311) ('incorrect master password') at line 1006 when the device already has encrypted notebooks, history, or a backup (hasEncrypted || hasHistory || hasBackup), and the recovery attempt via tryRestoreNotebookCryptoFromBackupLocked fails with an error whose message contains the Language(311) string. The recovery path derives a KEK from the supplied password and verifies it against the backup's KEKVerifier; failure means the password does not match the existing key domain. This is the expected error when a user tries to (re-)enable encryption with the wrong master password on a device that already holds encrypted data.

Source

Thrown at kernel/model/crypto.go:1006

	hasEncrypted, listErr := hasEncryptedNotebook()
	if listErr != nil {
		return fmt.Errorf("list encrypted notebooks failed: %w", listErr)
	}
	hasHistory, historyErr := scanEncryptedNotebookHistory()
	if historyErr != nil {
		return fmt.Errorf("check encrypted notebook history failed: %w", historyErr)
	}
	hasBackup := filelock.IsExist(dataCryptoBackupPath())
	if hasEncrypted || hasHistory || hasBackup {
		// 现存笔记本、已删除笔记本历史或全局备份均表示已有密钥域，必须恢复并认证，不能生成新 MasterSalt。
		kek, restoreErr := tryRestoreNotebookCryptoFromBackupLocked(password)
		if kek != nil {
			zeroAndClear(kek)
		}
		if restoreErr != nil {
			if strings.Contains(restoreErr.Error(), Conf.Language(311)) {
				return errors.New(Conf.Language(311))
			}
			return errors.New(Conf.Language(315))
		}
		logging.LogInfof("encrypted notebook re-enabled with authenticated recovery key material")
		return nil
	}

	// 不存在任何密钥依赖或备份时生成新的 MasterSalt。
	salt, err := util.GenerateSalt()
	if err != nil {
		return err
	}
	Conf.m.RLock()
	kdfParams := Conf.NotebookCrypto.KDFParams
	Conf.m.RUnlock()
	params, validErr := util.ValidateArgon2Params(kdfParams)
	if validErr != nil {
		return validErr

View on GitHub (pinned to 251596fc0d)

Solutions

1. Enter the master password that matches the existing encrypted notebooks/backup on this device.
2. If the password was changed on another device, sync first so the backup reflects the current password, then retry.
3. If the password is truly forgotten, existing encrypted notebooks and history are unrecoverable by design — do not force a new enable.

// Distinguish wrong-password (311) from missing-backup (315) on enable.
if err := model.EnableEncryptedNotebook(password); err != nil {
    if strings.Contains(err.Error(), Conf.Language(311)) {
        // prompt for the correct existing master password
    } else if strings.Contains(err.Error(), Conf.Language(315)) {
        // recovery-required: backup missing
    }
}

When it happens

Trigger: On a device with existing encrypted notebooks/history/backup, the user calls EnableEncryptedNotebook with a password that cannot authenticate the persisted backup's KEKVerifier. tryRestoreNotebookCryptoFromBackupLocked returns an error containing Language(311), which is re-surfaced here.

Common situations: User mistypes the master password when re-enabling after a reinstall or on a synced device; user enters a new password thinking enable creates a fresh domain, while existing notebooks require the original; password changed elsewhere and the local backup was not yet updated.

Related errors

• Encrypted notebooks already exist but the master key backup
• Incorrect master password
• password must not be empty
• encrypted notebook key material is missing
• Cannot import a key backup while encrypted notebooks are ena

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/4a531c931940342f. Report an issue: GitHub.