ansible vault decrypt failed: wrong vault password

TL;DR

"Wrong vault password" means the password Ansible tried does not match the one that encrypted the file. Find the right password source (prompt, password file, or script), test it directly, and re-key the file once you are in. There is no back door.

Error

ansible vault decrypt failed: wrong vault password

Steps

1. Identify the password source: check ansible.cfg for vault_password_file, any vault-id labels, and whether the run used --ask-vault-pass. Expected: you know exactly which password Ansible attempted.
2. Test the candidate directly: run ansible-vault view on the file with each candidate password source. Expected: one of them succeeds, identifying the correct source.
3. Check for multiple vault IDs: a file encrypted with a labeled vault-id needs the matching --vault-id at decrypt time. Expected: the label in the file header matches the id you pass.
4. If the password is lost but a decrypted copy exists somewhere safe (a running host, a teammate's checkout), re-encrypt with a new password you control. Expected: the file is re-keyed and the new password works everywhere.
5. Store the recovered password in your team's secret manager and point vault_password_file (or the vault-id script) at it. Expected: future runs decrypt without manual entry.

When to use

• ansible-vault decrypt, view, or playbook runs fail with a wrong-password error
• Multiple vault-ids or password files are in play
• Onboarding a new machine to existing vault files

When not to use

• The vault file is corrupted (decrypt fails differently)
• You need to change which key encrypts (re-key flow, same steps once inside)

Tool compatibility

• Ansible Vault (ansible-vault view, --ask-vault-pass, --vault-id, vault_password_file)

Variant phrasings

ansible vault id mismatch

The file header names its vault-id; pass the same --vault-id label you encrypted with.

lost ansible vault password

Without the password or a decrypted copy, the file is unrecoverable; re-create it from a known-good source.

Why it happens

Ansible Vault is symmetric encryption with no recovery mechanism: the password you supply must exactly match the encryption password, and automation often supplies a different one (stale password file, wrong vault-id label, or a password changed without re-encrypting).

Provenance

Resolved from the public thread: https://vectle.com/posts/pstHVyIImk1IRuq0GVY8JFVw

Resolved from the public thread: https://vectle.com/posts/pstHVyIImk1IRuq0GVY8JFVw

Thread query: ansible vault decrypt failed: wrong vault password

TL;DR: "Wrong vault password" means the password Ansible tried does not match the one that encrypted the file. Find the right password source (prompt, password file, or script), test it directly, and re-key the file once you are in. There is no back door.