Fixing "Sync failed: can't decrypt your tasks"

Documentation
1

Fixing “Sync failed: can’t decrypt your tasks”

Overview

If WingTask shows Sync failed: WingTask can’t decrypt your tasks,
your Taskwarrior is encrypting your tasks with a different
Encryption Secret than the one WingTask has.

task sync on your computer keeps working. Only WingTask is affected:
it can’t read anything your computer uploads, so your tasks don’t
appear in the web app.

This does not clear up on its own. WingTask will fail on every sync
until the secrets match again.

What the Error Means

TaskChampion, the sync engine behind Taskwarrior 3, encrypts every
change before it leaves your computer, using the encryption_secret
in your ~/.taskrc. The sync server only ever stores the sealed data.

WingTask keeps its own copy of your tasks and decrypts them with the
secret shown at Settings > Taskwarrior Sync. When your computer uses a
different secret, WingTask receives data it cannot unlock.

Your devices can still sync with each other, because they all share the
same secret. WingTask is the one left out.

If You Did This on Purpose

Some people use WingTask purely as a sync server and set their own
secret so that WingTask can never read their tasks.

If that’s you, there is nothing to fix. Sync between your devices works
normally. The web app just can’t show your tasks, and you’ll keep
seeing this message when WingTask tries to sync.

Before You Start

  • Tasks created or edited in WingTask since the secrets diverged
    exist only in WingTask.     Step 2 deletes them. The number next to the
    Sync button shows how many changes are waiting. Copy anything you
    need into Taskwarrior first.
  • Your tasks on your computer are safe. They are re-uploaded at the
    end.
  • Rotating your credentials won’t fix this. Rotation needs WingTask
    to read your existing history, which it can’t. Delete your data
    instead, as below.

Fixing It

  1. Save anything made in WingTask. Copy tasks you created or edited
    in the web app into Taskwarrior on your computer.

  2. Delete your WingTask data. Go to Settings and use Delete my
    data    . See Deleting Your WingTask Data.

  3. Use WingTask’s secret on every device. Copy the Encryption
    Secret     from Settings > Taskwarrior Sync into ~/.taskrc on
    every machine that syncs:

    sync.encryption_secret=<secret from WingTask>

    Check it with:

    task show sync

  4. Rebuild each device. Deleting your data resets your history on
    the server, so each device needs a fresh start. Follow
    Fixing a 410 Gone Sync Error
    on each machine.

  5. Sync. Run task sync. Your tasks upload, encrypted with the
    right secret, and appear in WingTask.

Confirming It Worked

Open WingTask in a browser and check that your tasks are there. The
“can’t decrypt” message should not come back. If it does, one of your
devices still has the old secret. Run task show sync on each and
compare.

Notes

  • Every device must use the same Client ID and Encryption
    Secret    . Copy them from Settings > Taskwarrior Sync.
  • Your Client ID and Encryption Secret are effectively
    passwords. Do not paste them anywhere public.

Related Topics

Documentation Index