tauri-apps/tauri · error

Failed to generate key

Error message

Failed to generate key

What it means

`tauri signer generate` creates a minisign keypair via generate_encrypted_keypair (which derives a key from the password). This expect fires if keypair generation internally fails; in practice that means a non-UTF-8/unusable password read from the prompt or environment, or an extremely rare OS entropy/wrapping failure inside the helper (generate_key itself unwraps internally).

Source

Thrown at crates/tauri-cli/src/signer/generate.rs:35

  #[clap(short, long)]
  password: Option<String>,
  /// Write private key to a file
  #[clap(short, long)]
  write_keys: Option<PathBuf>,
  /// Overwrite private key even if it exists on the specified path
  #[clap(short, long)]
  force: bool,
  /// Skip prompting for values
  #[clap(long, env = "CI")]
  ci: bool,
}

pub fn command(mut options: Options) -> Result<()> {
  if options.ci && options.password.is_none() {
    log::warn!("Generating new private key without password. For security reasons, we recommend setting a password instead.");
    options.password.replace("".into());
  }
  let keypair = generate_key(options.password).expect("Failed to generate key");

  if let Some(output_path) = options.write_keys {
    let (secret_path, public_path) =
      save_keypair(options.force, output_path, &keypair.sk, &keypair.pk)
        .expect("Unable to write keypair");

    println!();
    println!("Your keypair was generated successfully:");
    println!("Private: {} (Keep it secret!)", display_path(secret_path));
    println!("Public: {}", display_path(public_path));
    println!("---------------------------")
  } else {
    println!();
    println!("Your keys were generated successfully!",);
    println!();
    println!("Private: (Keep it secret!)");
    println!("{}", keypair.sk);
    println!();

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Retry with a simple ASCII password first to isolate encoding issues.
2. Pass the password explicitly via the password flag/env rather than an interactive prompt in CI.
3. Update to the latest CLI version (`cargo install tauri-cli --locked` / latest npm package).
4. If it still fails, open an issue with the exact command (never include the password/key material).

Example fix

# before: password secret with stray bytes
$ tauri signer generate -p "$SIGNING_PASSWORD"

# after: re-entered plain ASCII secret
$ tauri signer generate -p 'correct-horse-battery'

# Keep signing passwords plain ASCII (no stray bytes) before generating
python3 -c "import os,sys; \
  (os.environ['KEY_PASSWORD'].encode('ascii')) if 'KEY_PASSWORD' in os.environ else None" || {
  echo 'password must be ASCII'; exit 1; }

# Retry once with an explicit password; generation failures are rarely persistent
tauri signer generate -w keys/app.key -p "$PW" || tauri signer generate -w keys/app.key -p "$PW"

When it happens

Trigger: Running `tauri signer generate` with a password containing bytes that break the key encoding path (e.g. TAURI_SIGNING_PRIVATE_KEY_PASSWORD-style secrets with invalid encoding fed through -p), or transient entropy/process issues in restricted CI sandboxes.

Common situations: CI secrets with bad encodings passed as the password; exotic locale terminals mangling typed passwords; very old CLI versions with signer bugs.

Related errors

• system clock is incorrect
• Unable to write keypair
• Key generation aborted: Unable to find the private key
• Failed to render template
• Failed to render tauri.conf.json template

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/88eb03385541e762. Report an issue: GitHub.