Unable to decrypt backups

[asellitt]

Hey, not sure if its an issue on my end or not, but i'm unable to decrypt home assistant backups using this tool.

It used to work fine.

I'm currently on Home Assistant Core version 2023.8.4, and if its helpful I'm also running Home Assistant Operating System 10.5

[sabeechen]

Its possible HA changed something about the backup format, I basically have to copy-paste their code to keep things updated.

That being said, I just tried with HA latest (2023.09.2) and things seemed to work. What error are you getting when you try to decrypt?

[asellitt]

hey sorry about the delay, here's the stacktrace:

Tue 19 Sep 11:41:52 am  $> python3 -m decrypt-ha-backup homeassistant.tar.gz
Backup Password:
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/opt/homebrew/lib/python3.11/site-packages/decrypt-ha-backup/__main__.py", line 250, in <module>
    main()
  File "/opt/homebrew/lib/python3.11/site-packages/decrypt-ha-backup/__main__.py", line 219, in main
    with tarfile.open(Path(args.backup_file), "r:") as backup_file:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.11.4_1/Frameworks/Python.framework/Versions/3.11/lib/python3.11/tarfile.py", line 1817, in open
    return func(name, filemode, fileobj, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.11.4_1/Frameworks/Python.framework/Versions/3.11/lib/python3.11/tarfile.py", line 1847, in taropen
    return cls(name, mode, fileobj, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.11.4_1/Frameworks/Python.framework/Versions/3.11/lib/python3.11/tarfile.py", line 1707, in __init__
    self.firstmember = self.next()
                       ^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.11.4_1/Frameworks/Python.framework/Versions/3.11/lib/python3.11/tarfile.py", line 2609, in next
    raise ReadError(str(e)) from None
tarfile.ReadError: invalid header

[sabeechen]

It looks like its failing to open the main tar file, before it even gets to the decryption step.

Home Assistant's backups are made out of several smaller encrypted files inside one unencrypted file (its a weird format).

Because its failing to open the single, unencrypted tar file its most likely the file is corrupt. Options are pretty limited if thats the case, the tarfile format doesn't handle corruption very well. The most common cause of corruption is damaged SD cards.

You might try opening it up in a standard tool like 7zip. It should be able to open homeassistant.tar.gz, so if it complains about the file then its definitely corruption. I've also heard some people have had success with tools like this, though I've never tried it myself.

[asellitt]

i'll give that a go.

It might be corrupted, but I doubt it. If i create a backup w/o a password, i'm able to open things without issues. Also, i'm running HA off of an SSD.

[sabeechen]

If you're able to get some or all the files out of it, I can give some instructions about how to "reconstruct" it back into a format this tool can decrypt.

[cynicer]

I'm having the same issue, I'm unable to decrypt my backups with the "invalid header" error. My password contains special characters.

[override80]

Try this: https://github.com/sabeechen/decrypt-ha-backup/pull/7

[BalanceBreaker]

Try this: #7

Thanks a lot this fixed the issue 👍

[racinmat]

I tried it today on HA 2025.4.2 and it's not working, unfortunately.

[mbretschn]

Fails with the latests Home Assistant.

% python3 -m decrypt-ha-backup --password ... Automatic_backup_2025.4.1_2025-04-18_04.56_55003959.tar
Decrypting Automatic_backup_2025.4.1_2025-04-18_04.56_55003959.tar to Decrypted Automatic_backup_2025.4.1_2025-04-18_04.56_55003959.tar
  ✅ homeassistant.tar.gz (5.72 MB)
  ✅ 5c53de3b_esphome.tar.gz (2.34 KB)
  ✅ a0d7b954_nodered.tar.gz (31.27 KB)
  ✅ a0d7b954_vscode.tar.gz (1.37 MB)
  ✅ core_mosquitto.tar.gz (5.20 KB)
  ✅ share.tar.gz (240.00 B)
  ✅ media.tar.gz (240.00 B)
  ✅ ssl.tar.gz (240.00 B)
Validating files in Decrypted Automatic_backup_2025.4.1_2025-04-18_04.56_55003959.tar
  ❌ homeassistant.tar.gz
  ❌ 5c53de3b_esphome.tar.gz
  ❌ a0d7b954_nodered.tar.gz
  ❌ a0d7b954_vscode.tar.gz
  ❌ core_mosquitto.tar.gz
  ❌ share.tar.gz
  ❌ media.tar.gz
  ❌ ssl.tar.gz
8 file(s) from the backups couldn't be validated as compressed tar files.  This means that either the provided password was wrong or the original backup is corrupted.

[override80]

Things in home assistant backups changed quite a lot in home assistant 2025.1 and later... I'll give it a try, but i doubt this solution will work. My way is to keet local backups unencrypted and encrypt when you store in the cloud.