# Moving node-RED - Failed to decrypt credentials

**URL:** <https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830>\
**Category:** General\
**Created:** [12 November 2019 10:22 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830 "2019-11-12T10:22:16Z")\
**Posts on this page:** 15\
**Page:** 2

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 November 2019 11:07 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/21 "2019-11-13T11:07:53Z")

</div>

Thanks, but first I'd be interested to know what I asked in my last post, as that could be the issue.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [13 November 2019 11:10 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/22 "2019-11-13T11:10:09Z")

</div>

None of that is in the json since there were no projects involved. Try taking it out.

---

<div class="post-metadata">

**Author:** ![kuema](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kuema/32/6542_2.png) [@kuema](https://discourse.nodered.org/u/kuema)\
**Post date:** [13 November 2019 11:11 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/23 "2019-11-13T11:11:24Z")

</div>

That's what I thought. The `.config.json` keeps different settings per project. And the key `"activeProject": "Master_flow"` determines the project that is launched at start-up.

So to migrate from a projects to non-projects workspace, we need to piece all this data together into the right place.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 November 2019 11:24 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/24 "2019-11-13T11:24:33Z")

</div>

> [@zenofmud](#):
>
> Try taking it out.

Still the same with that section taken out unfortunately.

It seems strange that the "mysecret" in `.config.json`, isn't a hash, it's a single word password

`"credentialSecret": "mysecret"`

---

<div class="post-metadata">

**Author:** ![kuema](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kuema/32/6542_2.png) [@kuema](https://discourse.nodered.org/u/kuema)\
**Post date:** [13 November 2019 11:29 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/25 "2019-11-13T11:29:44Z")

</div>

Strange, but it should not matter. As soon as it is set to any string, it will be used as encryption key.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [13 November 2019 12:06 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/26 "2019-11-13T12:06:07Z")

</div>

Just to let you know. i reproduced this  
pi with projects -\> macOS no projects

```auto
13 Nov 07:04:33 - [warn] Error loading credentials: SyntaxError: Unexpected token e in JSON at position 0
13 Nov 07:04:33 - [warn] Error loading flows: Error: Failed to decrypt credentials

```

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 November 2019 12:10 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/27 "2019-11-13T12:10:01Z")

</div>

> [@zenofmud](#):
>
> Just to let you know. i reproduced this

That's good, perhaps @knolleary has thoughts on this.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 November 2019 12:23 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/28 "2019-11-13T12:23:12Z")

</div>

> [@zenofmud](#):
>
> Just to let you know. i reproduced this  
> pi with projects -\> macOS no projects

What steps did you take _exactly_? What files did you copy? Did you copy and properties from one file to another?

Let me try to explain all the different bits.

**Without Projects**

- if `credentialSecret` is not set in your `settings.js` file, then NR will generate a key and store it in `.config.json` at the top level of the object under the name `_credentialSecret`. This is a long randomly generated string.
- if `credentialSecret` is set in your `settings.js` file, then NR will use that instead.
- if it finds `_credentialSecret` in `.config.json` **and** `credentialSecret` in `settings.js` then we assume this is the first time you've run since setting `credentialSecret` and the runtime will re-encrypt the credential file using `credentialSecret` and then delete `_credentialSecret` as it is no longer needed. (Technically it does this migration the first time you hit Deploy after starting it up in this state).

**With Projects**

- if projects are enabled then it ignores `credentialSecret` in your settings file and `_credentialSecret` in `.config.json`.
- Instead it uses the project-specific credential secret that is also stored in the `.config.json` file under the `projects.[name-of-project].credentialSecret` property.

**Migrating from Projects on Device A to Not-Projects on Device B**

To do this you need to:

1. copy the flow and credential files from the projects subdirectory on Device A onto Device B
2. copy the value of `projects.[name-of-project].credentialSecret` from `.config.json` on Device A to `credentialSecret` in the `settings.js` file on Device B

I know this works cause I've just run a workshop with a room full of developers who were doing pretty much exactly this (albeit Device B is actually an instance running in a Cloud environment).

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 November 2019 12:35 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/29 "2019-11-13T12:35:18Z")

</div>

> [@knolleary](#):
>
> 1. copy the value of `projects.[name-of-project].credentialSecret` from `.config.json` on Device A to `credentialSecret` in the `settings.js` file on Device B

The value of `.credentialSecret from.config.json on Device A` is a plain text password, whilst the `credentialSecret in the settings.js file` is curently a hash. Is that expected?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 November 2019 12:39 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/30 "2019-11-13T12:39:40Z")

</div>

> [@Paul-Reed](#):
>
> the `credentialSecret in the settings.js file` is curently a hash

It may look like a hash but it isn't - it's just a string of characters.

And yes, `.config.json` contains the project's credentialSecret value in plain text because:

1. that is **not** a file you put in version control
2. if we did encrypt it somehow, where would we store the key to decrypt it? We'd have to encrypt _that_ key. But where would we store the key to decrypt **that** key? And so on.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 November 2019 12:42 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/31 "2019-11-13T12:42:09Z")

</div>

Well the good news is that it works!!  
All my credentials are now accessible.

Thanks everyone.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [13 November 2019 12:50 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/32 "2019-11-13T12:50:18Z")

</div>

@knolleary Worked for me too! Thanks Nick!

---

<div class="post-metadata">

**Author:** ![eitijupaenoithoowohd](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@eitijupaenoithoowohd](https://discourse.nodered.org/u/eitijupaenoithoowohd)\
**Post date:** [26 July 2020 15:12 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/33 "2020-07-26T15:12:49Z")

</div>

In my case credentials contains of plaintext characters and were absolutely identical in both cases, but decryption had not worked until I removed manually \_credentialSecret from .config on the site where projects were disabled.

@knolleary I would like to draw your attention to the fact that the \_credentialSecret is not automatically deleted without hit "Deploy" button even if the credentialSecret present in settings.js. Please consider, that sometimes users can't hit "Deploy" button manually to change .config.json because they have only "read" rigths. Sometimes prepared flows.json files just copied to production environment where disableEditor:true setting is activated; On my opinion the behaviour like this is a bug. You shouldn't wait when "Deploy" button will be hit. I believe that \_credentialSecret from .config.json have to removed immediately when credentialSecret will appear in settings.js  
I've checked Node-RED 1.0.4 and latest from the official docker containers. I think you can simply reproduce this bug - the behaviour is exactly the same as the scenario you had described in your Nov 19th post. Please think to change algorithm and exclude "Deploy" hit from the scenario.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [26 July 2020 19:10 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/34 "2020-07-26T19:10:31Z")

</div>

@eitijupaenoithoowohd we can only remove `_credentialSecret` from `.config.json` when we know that the credentials file has been re-encrypted according to the `credentialSecret` value from the settings file. That means rewriting the credentials file, and we _only_ do that when the user hits the Deploy button.

If you are copying flows files onto a system then you need to make sure its settings.js file have the right `credentialSecret` in it before you run the flows.

If you have previously run Node-RED on that system without a credentialSecret in its settings file, then it will have generated ` _credentialSecret` in the `.config.json` file and you'll need to either remove the value yourself from the file, or delete the `.config.json` file.

---

<div class="post-metadata">

**Author:** ![eitijupaenoithoowohd](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@eitijupaenoithoowohd](https://discourse.nodered.org/u/eitijupaenoithoowohd)\
**Post date:** [26 July 2020 19:35 UTC](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830/35 "2020-07-26T19:35:54Z")

</div>

@knolleary Thank you for your detailed answer.

I have understood that simple solution is not exists and impossible to do re-encryption without "Deploy" hit. And this is the basic problem.

I want to explain. In my case the copied flows files got from a site where projects was enabled and `credentialSecret` being in `.config.json` but not in `settings.js`

I would like to leave my post in this topic to someone, who will have the same problem like me. I hope my experience will be useful.

[Previous page](https://discourse.nodered.org/t/moving-node-red-failed-to-decrypt-credentials/17830.md?page=1)