# Rails: ActiveSupport::MessageEncryptor::InvalidMessage (credentials.yml.enc can't be decrypted — wrong master.key)

**Code:** `ActiveSupport::MessageEncryptor::InvalidMessage` · **Category:** Ruby / Rails · **Seen on:** Ruby

Rails couldn't decrypt `credentials.yml.enc` (or a signed/encrypted cookie) because the key is wrong or the data changed.

## Meaning

For credentials: the `config/master.key` (or `RAILS_MASTER_KEY`) doesn't match the one that encrypted the file. Restore the right key from your team/secrets store; if lost, delete `credentials.yml.enc` and recreate (losing old secrets). For cookies: `secret_key_base` changed so old sessions are invalid — users just log in again.

## Common causes

- Wrong or missing `RAILS_MASTER_KEY`
- `credentials.yml.enc` committed from another key
- `secret_key_base` changed (cookies/sessions)
- Corrupted file after merge conflict
- Different environment credentials file

## Quick fix

1. Set the correct `RAILS_MASTER_KEY`
2. Re-create credentials: `rm config/credentials.yml.enc && bin/rails credentials:edit` (if the key is lost)
3. Clear old cookies after changing `secret_key_base`

## Detailed fix by platform

### Rails

1. `EDITOR=vim bin/rails credentials:edit` (needs the correct master key)

## How to diagnose

1. **Key** — master.key matches?
2. **File** — Merge conflict?
3. **Cookies** — secret_key_base changed?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ruby/rails-credentials-invalid-message)