[GH-ISSUE #206] Whatsapp business backup Decryption failed #82

New issue

Open

opened 2026-03-02 03:59:55 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 03:59:55 +03:00

Owner

Originally created by @OrGozlan on GitHub (Mar 1, 2026).
Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/206

Originally assigned to: @ElDavoo on GitHub.

Hexdump of your key file

00000000: aced 0005 7572 0002 5b42 acf3 17f8 0608 ....ur..[B......
00000010: 54e0 0200 0078 7000 0000 20ae a5ef 2b70 T....xp... ...+p
00000020: 8284 0791 dc76 2a13 f611 5d43 f50f cf0f .....v*...]C....
00000030: 1348 4dac dd15 d3ff ed3f 21 .HM......?!

**Hexdump of the encrypted DB

00000000: 8601 0801 1a12 0a10 2f9c c6af f439 08be ......../....9..
00000010: 31b0 6133 b250 4050 226c 0a09 322e 3236 1.a3.P@P"l..2.26
00000020: 2e37 2e37 331a 0232 3820 0128 0130 0138 .7.73..28 .(.0.8
00000030: 0140 0148 0150 0158 0160 0168 0170 0178 .@.H.P.X..h.p.x 00000040: 0180 0101 8801 0190 0101 9801 01a0 0101 ................ 00000050: a801 01b0 0101 b801 01c0 0101 c801 01d0 ................ 00000060: 0101 d801 01e0 0101 e801 01f0 0101 f801 ................ 00000070: 0180 0201 8802 0190 0201 9802 01a0 0201 ................ 00000080: a802 01b8 0201 3003 f6f3 c934 d7c5 260b ......0....4..&. 00000090: 42e4 f5f1 8aba bb37 3cc7 fee6 e270 e4dc B......7<....p.. 000000a0: ba2c 102d 492d 3c85 475d 48a0 39f5 11c5 .,.-I-<.G]H.9... 000000b0: cd60 af11 d9ce d7ea 2657 c347 3624 bbde .......&W.G6$..
000000c0: 6e1c 7e9f 84f5 0aa7 dd8f 0698 6771 7935 n.~.........gqy5
000000d0: fa89 ef37 0fc1 4a65 0f0f 2771 f6d0 72c5 ...7..Je..'q..r.
000000e0: 77bc 3bc5 50e0 effa 1b77 0476 f24a f814 w.;.P....w.v.J..
000000f0: 22c7 28cf d0ea 0538 bff1 1b62 fcb1 4a9f ".(....8...b..J.

Screenshots

Program output using -v and -f

keyfactory.py:31 : [D] Reading keyfile...
key15.py:50 : [D] Root key: aea5ef2b7082840791dc762a13f6115d43f50fcf0f13484dacdd15d3ffed3f21
key15.py:54 : [I] Crypt15 / Raw key loaded
wadecrypt.py:235 : [D] Key15(key: aea5ef2b7082840791dc762a13f6115d43f50fcf0f13484dacdd15d3ffed3f21)
dbfactory.py:41 : [D] Parsing database header...
dbfactory.py:75 : [D] WhatsApp version: 2.26.7.73
dbfactory.py:78 : [D] Your phone number ends with 28
dbfactory.py:121 : [D] Crypt15 info:
Header information in your crypt15 file:IV: 2f9cc6aff43908be31b06133b2504050
Key type: 1
WhatsApp version: 2.26.7.73
The last two numbers of the user's Jid: 28
Backup version: 1
Features: [5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 39]
Max feature number: 39

db15.py:132 : [D] Checksum OK (c0ddfd35dfdbef3ce358cf78a069b8b2). Decrypting...
db15.py:155 : [E] Authentication tag mismatch: MAC check failed.
This probably means your backup is corrupted.
wadecrypt.py:261 : [E] I can't recognize decrypted data. Decryption not successful.
The key probably does not match with the encrypted file.
Or the backup is simply empty. (check with --force)
wadecrypt.py:271 : [I] Done

Additional context

Hey, I am having a problem of decrypting a Whatsapp business backup,
First I used the Whatsapp application to create E2E encryption key, took a screenshot of the key and saved it, later on I used the whatsapp backup feature (in app) to make a new backup to my google account,

I used this repo to get the latest copy of the backup: https://github.com/giacomoferretti/whatsapp-backup-downloader-decryptor

Then I used this repo in order to decrypt, but no matter what I do I get the same error, note that I first used wacreatekey to transform the hex key into the .key file.

Done it like 3-4 times to make sure im not missing anything, but still getting the same error.
By the way, just to make sure im doing it right, I've tried it with another phone (which doesn't have Whatsapp business) and it worked just fine.

Am I doing something wrong?
Thanks ahead.

Originally created by @OrGozlan on GitHub (Mar 1, 2026). Original GitHub issue: https://github.com/ElDavoo/wa-crypt-tools/issues/206 Originally assigned to: @ElDavoo on GitHub. **Hexdump of your key file** 00000000: aced 0005 7572 0002 5b42 acf3 17f8 0608 ....ur..[B...... 00000010: 54e0 0200 0078 7000 0000 20ae a5ef 2b70 T....xp... ...+p 00000020: 8284 0791 dc76 2a13 f611 5d43 f50f cf0f .....v*...]C.... 00000030: 1348 4dac dd15 d3ff ed3f 21 .HM......?! **Hexdump of the encrypted DB 00000000: 8601 0801 1a12 0a10 2f9c c6af f439 08be ......../....9.. 00000010: 31b0 6133 b250 4050 226c 0a09 322e 3236 1.a3.P@P"l..2.26 00000020: 2e37 2e37 331a 0232 3820 0128 0130 0138 .7.73..28 .(.0.8 00000030: 0140 0148 0150 0158 0160 0168 0170 0178 .@.H.P.X.`.h.p.x 00000040: 0180 0101 8801 0190 0101 9801 01a0 0101 ................ 00000050: a801 01b0 0101 b801 01c0 0101 c801 01d0 ................ 00000060: 0101 d801 01e0 0101 e801 01f0 0101 f801 ................ 00000070: 0180 0201 8802 0190 0201 9802 01a0 0201 ................ 00000080: a802 01b8 0201 3003 f6f3 c934 d7c5 260b ......0....4..&. 00000090: 42e4 f5f1 8aba bb37 3cc7 fee6 e270 e4dc B......7<....p.. 000000a0: ba2c 102d 492d 3c85 475d 48a0 39f5 11c5 .,.-I-<.G]H.9... 000000b0: cd60 af11 d9ce d7ea 2657 c347 3624 bbde .`......&W.G6$.. 000000c0: 6e1c 7e9f 84f5 0aa7 dd8f 0698 6771 7935 n.~.........gqy5 000000d0: fa89 ef37 0fc1 4a65 0f0f 2771 f6d0 72c5 ...7..Je..'q..r. 000000e0: 77bc 3bc5 50e0 effa 1b77 0476 f24a f814 w.;.P....w.v.J.. 000000f0: 22c7 28cf d0ea 0538 bff1 1b62 fcb1 4a9f ".(....8...b..J. **Screenshots** <img width="913" height="198" alt="Image" src="https://github.com/user-attachments/assets/85b75d9b-5bf9-4e33-bf22-0493e1107954" /> **Program output using -v and -f** keyfactory.py:31 : [D] Reading keyfile... key15.py:50 : [D] Root key: aea5ef2b7082840791dc762a13f6115d43f50fcf0f13484dacdd15d3ffed3f21 key15.py:54 : [I] Crypt15 / Raw key loaded wadecrypt.py:235 : [D] Key15(key: aea5ef2b7082840791dc762a13f6115d43f50fcf0f13484dacdd15d3ffed3f21) dbfactory.py:41 : [D] Parsing database header... dbfactory.py:75 : [D] WhatsApp version: 2.26.7.73 dbfactory.py:78 : [D] Your phone number ends with 28 dbfactory.py:121 : [D] Crypt15 info: Header information in your crypt15 file:IV: 2f9cc6aff43908be31b06133b2504050 Key type: 1 WhatsApp version: 2.26.7.73 The last two numbers of the user's Jid: 28 Backup version: 1 Features: [5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 39] Max feature number: 39 db15.py:132 : [D] Checksum OK (c0ddfd35dfdbef3ce358cf78a069b8b2). Decrypting... db15.py:155 : [E] Authentication tag mismatch: MAC check failed. This probably means your backup is corrupted. wadecrypt.py:261 : [E] I can't recognize decrypted data. Decryption not successful. The key probably does not match with the encrypted file. Or the backup is simply empty. (check with --force) wadecrypt.py:271 : [I] Done **Additional context** Hey, I am having a problem of decrypting a Whatsapp business backup, First I used the Whatsapp application to create E2E encryption key, took a screenshot of the key and saved it, later on I used the whatsapp backup feature (in app) to make a new backup to my google account, I used this repo to get the latest copy of the backup: https://github.com/giacomoferretti/whatsapp-backup-downloader-decryptor Then I used this repo in order to decrypt, but no matter what I do I get the same error, note that I first used `wacreatekey` to transform the hex key into the .key file. Done it like 3-4 times to make sure im not missing anything, but still getting the same error. By the way, just to make sure im doing it right, I've tried it with another phone (which doesn't have Whatsapp business) and it worked just fine. Am I doing something wrong? Thanks ahead.