ActiveSupport::MessageEncryptor::InvalidMessage Ruby / Rails Origin: Application & API Last updated 5 Nov 2026

Rails: ActiveSupport::MessageEncryptor::InvalidMessage (credentials.yml.enc can't be decrypted — wrong master.key)

Rails couldn't decrypt credentials.yml.enc (or a signed/encrypted cookie) because the key is wrong or the data changed.

Exact message you may see ActiveSupport::MessageEncryptor::InvalidMessage (ActiveSupport::MessageEncryptor::InvalidMessage)OpenSSL::Cipher::CipherError credentials.yml.encCannot decrypt credentials with the wrong master key
Explore the map of this error Full error map →
Seen on: Ruby

Meaning

For credentials: the config/master.key (or RAILS_MASTER_KEY) doesn't match the one that encrypted the file. Restore the right key from your team/secrets store; if lost, delete credentials.yml.enc and recreate (losing old secrets). For cookies: secret_key_base changed so old sessions are invalid — users just log in again.

Common causes

  • Wrong or missing RAILS_MASTER_KEY
  • credentials.yml.enc committed from another key
  • secret_key_base changed (cookies/sessions)
  • Corrupted file after merge conflict
  • Different environment credentials file

⚡ Quick fix

  1. Set the correct RAILS_MASTER_KEY
  2. Re-create credentials: rm config/credentials.yml.enc && bin/rails credentials:edit (if the key is lost)
  3. Clear old cookies after changing secret_key_base

Detailed fix by platform

Rails

  1. EDITOR=vim bin/rails credentials:edit (needs the correct master key)

How to diagnose

  1. Key — master.key matches?
  2. File — Merge conflict?
  3. Cookies — secret_key_base changed?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

ActiveRecord::AssociationTypeMismatch — Rails: ActiveRecord::AssociationTypeMismatch: User(#1234) expected, got "42" which is an instance of String(#5678) (Ruby / Rails)ActiveRecord::Associa…ActiveRecord::ConnectionNotEstablished — Rails: ActiveRecord::ConnectionNotEstablished: No connection pool for 'ActiveRecord::Base' found (Ruby / Rails)ActiveRecord::Connect…ActiveRecord::Deadlocked: PG::TRDeadlockDetected — Rails: ActiveRecord::Deadlocked: PG::TRDeadlockDetected: ERROR: deadlock detected (Ruby / Rails)ActiveRecord::Deadloc…ActiveRecord::IrreversibleMigration — Rails: ActiveRecord::IrreversibleMigration — This migration uses remove_column without a type; db:rollback can't reverse it (Ruby / Rails)ActiveRecord::Irrever…DecryptException: The payload is invalid / The MAC is invalid — Laravel: Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. / The MAC is invalid. (Laravel)DecryptException: The…Missing encryption key to decrypt file with — Rails: ArgumentError: Missing encryption key to decrypt file with. Ask your team for your master key and write it to config/master.key or put it in the ENV['RAILS_MASTER_KEY'] (Ruby / Rails)Missing encryption ke…Missing secret_key_base for 'production' environment — Rails: ArgumentError: Missing `secret_key_base` for 'production' environment, set this string with `bin/rails credentials:edit` (Ruby / Rails)Missing secret_key_ba…ActiveSup…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.