pgadmin4 icon indicating copy to clipboard operation
pgadmin4 copied to clipboard

Failed to decrypt the saved password

Open amirhossein-deriv opened this issue 2 months ago • 16 comments

Describe the bug

We upgraded our pgAdmin to V9.3, now there are two kind of issues:

the saved password for one user gets error: Failed to decrypt the saved password. Error: 'utf-8' codec can't decode byte 0xaf in position 1: invalid start byte

and

Failed to decrypt the saved password. Error: 'utf-8' codec can't decode byte Oxd5 in position 0: invalid continuation byte to solve this issue regarding our online research we find these links helpful and based on them we cleared the passwords for all connections and setup them.

https://www.pgadmin.org/docs/pgadmin4/9.3/clear_saved_passwords.html https://stackoverflow.com/questions/56526882/pgadmin-error-failed-to-decrypt-the-saved-password

We have the second issue that raised after the other one: connection failed: connection to server at "xx.xx.xx.xx", port 5432 failed: fe_sendauth: no password supplied To Reproduce

Steps to reproduce the behavior:

upgrade version 8.12 to 9.3 See the error Expected behavior

Regarding the issue posted from older versions, it should be solved and don't raise again.

Error message

Failed to decrypt the saved password. Error: 'utf-8' codec can't decode byte 0xaf in position 1: invalid start byte

Failed to decrypt the saved password. Error: 'utf-8' codec can't decode byte Oxd5 in position 0: invalid continuation byte

Screenshots

Image Image Docker:

image: dpage/pgadmin4:9.3 Version: [e.g. 6.15] Mode: [e.g Desktop or Server] Browser: chrome Package type: Container

sharing below our pgadmin info

Version 9.5 Application Mode Server Commit a5714903acb250481a987f3e352680b7a66403b5 2025-06-27 Python Version 3.12.11 Browser Chrome 139.0.0.0 Operating System Alpine Linux v3.22, Linux-5.10.0-35-cloud-amd64-x86_64-with pgAdmin Database File /var/lib/pgadmin/pgadmin4.db And this is our PgAdmin Docker compose file

version: '3.7' services: pgadmin: image: dpage/pgadmin4:9.5 deploy: replicas: 1 placement: constraints: [node.role == manager] resources: limits: memory: 4G ports: - 8001:80 environment: - PGADMIN_DEFAULT_EMAIL=<REDACTED> - PGADMIN_DEFAULT_PASSWORD=<REDACTED> - PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION=False - PGADMIN_CONFIG_WTF_CSRF_CHECK_DEFAULT=False volumes: - type: bind source: /data/pgadmin target: /var/lib/pgadmin - type: bind source: /data/pgadmin/servers.json target: /pgadmin/servers.json please do let us know if anything else we can provide to help replicating this

unsolved lssue: https://github.com/pgadmin-org/pgadmin4/issues/8776 https://github.com/pgadmin-org/pgadmin4/issues/5487

amirhossein-deriv avatar Oct 16 '25 03:10 amirhossein-deriv

@amirhossein-deriv Can you please share the Docker logs that were printed during the upgrade? Also, if possible, can you please share dummy passwords which has special characters that are being used in the actual password?

Also, please try with the latest pgadmin version.

yogeshmahajan-1903 avatar Oct 16 '25 06:10 yogeshmahajan-1903

@yogeshmahajan-1903 I attached the logs and the dummy password is: AhQwY!eT0y00nRxh5PDO%qA&gAD$fsSRQ6N

pgAdminlogs.txt

amirhossein-deriv avatar Oct 17 '25 07:10 amirhossein-deriv

Same problem here using pgAdmin 9.8, master password enabled and oauth2 authentication using Entra ID.

skel0 avatar Oct 17 '25 14:10 skel0

Same bug. Basically as temp solution we switched to non-shared server connection per user. Few hours investigetions didn't help.

Lxrdknows77 avatar Oct 17 '25 17:10 Lxrdknows77

We are also having this same issue. Been going for a while. I suspect that it has something to do with special characters in password. Just a guess, since not everyone experiences it. Perhaps some auto-generated passwords use characters that won't work in utf-8. We are on 9.8.

mbtx2 avatar Oct 17 '25 18:10 mbtx2

Version 9.9 I have the same problem of not begin able to save the password - it is making PgAdmin UNUSABLE for me. The password I use is all lower case, is made up of characters from a-z only.

2025-10-21 14:03:03,702: ERROR pgadmin: 'utf-8' codec can't decode byte 0xcc in position 0: invalid continuation byte Traceback (most recent call last): File "/usr/pgadmin4/web/pgadmin/utils/driver/psycopg3/connection.py", line 257, in _decode_password password = password.decode() UnicodeDecodeError: 'utf-8' codec can't decode byte 0xcc in position 0: invalid continuation byte

Using Desktop App on Fedora.

nptrainor avatar Oct 21 '25 13:10 nptrainor

Some our users confirm this bug on version 9.9, password haven't special symbols. downgrade to 9.4 help resolve problem.

lightvik avatar Oct 22 '25 15:10 lightvik

v9.9 - have the same issue

neonlight911 avatar Oct 27 '25 12:10 neonlight911

@yogeshmahajan-1903 I attached the logs and the dummy password is: AhQwY!eT0y00nRxh5PDO%qA&gAD$fsSRQ6N

pgAdminlogs.txt

@amirhossein-deriv I am not able to reproduce the issue. Are you using OAuth2 for authentication? The logs shared by you does not have any error. If possible could you please share complete docker config?

yogeshmahajan-1903 avatar Oct 29 '25 07:10 yogeshmahajan-1903

Same problem here using pgAdmin 9.8, master password enabled and oauth2 authentication using Entra ID.

@skel0 Is the problem arises after upgrades to 9.8 or it was in previous version too? What was pgadmin version where this was working for you. Are facing same issue with newly added server? Can you please try clearing password for existing server and again save it and try recoonecting?

yogeshmahajan-1903 avatar Oct 29 '25 07:10 yogeshmahajan-1903

going for a while. I suspect that it has something to do with special characters in password. Just a guess, since not everyone experiences it. Perhaps some auto-generated passwords use characters that won't work in utf-8. We are on 9.8.

@mbtx2 Can you please share some dummy passwords from users for who this does not work?

yogeshmahajan-1903 avatar Oct 29 '25 07:10 yogeshmahajan-1903

Version 9.9 I have the same problem of not begin able to save the password - it is making PgAdmin UNUSABLE for me. The password I use is all lower case, is made up of characters from a-z only.

2025-10-21 14:03:03,702: ERROR pgadmin: 'utf-8' codec can't decode byte 0xcc in position 0: invalid continuation byte Traceback (most recent call last): File "/usr/pgadmin4/web/pgadmin/utils/driver/psycopg3/connection.py", line 257, in _decode_password password = password.decode() UnicodeDecodeError: 'utf-8' codec can't decode byte 0xcc in position 0: invalid continuation byte

Using Desktop App on Fedora.

@nptrainor Does pgadmin prompts you for master password?

yogeshmahajan-1903 avatar Oct 29 '25 07:10 yogeshmahajan-1903

@yogeshmahajan-1903 in the version we are using it is not prompting for master password

amirhossein-deriv avatar Oct 29 '25 09:10 amirhossein-deriv

going for a while. I suspect that it has something to do with special characters in password. Just a guess, since not everyone experiences it. Perhaps some auto-generated passwords use characters that won't work in utf-8. We are on 9.8.

@mbtx2 Can you please share some dummy passwords from users for who this does not work?

I'm not sure it's the password characters anymore, given that some of those who are experiencing the issue in this issue thread have no special characters. I should point out that we are now on 9.9 using server version. I'll see if we can narrow it down to a specific dummy password that is reproducible.

mbtx2 avatar Oct 29 '25 18:10 mbtx2

@yogeshmahajan-1903 in the version we are using it is not prompting for master password

I think in that case, you are using an internal authentication source as internal in which case the login password is the master password. Can you please try adding new server and try with saved password? Does it give you the same behaviour? Kindly tun on debug log level and sahre logs for further debugging.

yogeshmahajan-1903 avatar Oct 30 '25 06:10 yogeshmahajan-1903

@yogeshmahajan-1903 behavior is the same and this is the log when other user wants to login to the shared server

2025-10-31 09:38:32,375: ERROR pgadmin: 'utf-8' codec can't decode byte 0xc2 in position 0: invalid continuation byte Traceback (most recent call last): File "/pgadmin4/pgadmin/utils/driver/psycopg3/connection.py", line 255, in _decode_password password = password.decode() ^^^^^^^^^^^^^^^^^ UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc2 in position 0: invalid continuation byte 2025-10-31 09:38:32,378: ERROR pgadmin: Could not connect to server(#3) - 'localpsql'. Error: Failed to decrypt the saved password. Error: 'utf-8' codec can't decode byte 0xc2 in position 0: invalid continuation byte

amirhossein-deriv avatar Oct 31 '25 09:10 amirhossein-deriv

If the password is not too sensitive (could change it later) you could try executing the following inside the container:

sed -i 's|"Failed to decrypt the saved password\.\\nError: {0}"|"Failed to decrypt the saved password\.\\nError: {0}\\nPassword: {1}"|g; s|)\.format(str(e)), password|)\.format(str(e), password.hex()), password|g' /pgadmin4/pgadmin/utils/driver/psycopg3/connection.py

This will include the password bytes as a hex string in the log.

Guiorgy avatar Nov 21 '25 13:11 Guiorgy