Encrypted maFiles: the password, and the manifest
You have a .maFile, something is asking for a password, and
nothing you type works. Two facts untangle nearly every case: which password
it actually wants, and the second file it cannot work without.
Which password it wants
The encryption passphrase set inside SDA, on the machine that made the file. Not your Steam password, not your Windows password, not the email password. When SDA's encryption was switched on it asked for a passphrase of its own — that is the one. If somebody else set the machine up, it may be theirs rather than yours.
The file that has to travel with it
SDA does not keep everything needed for decryption inside the maFile itself.
The salt and initialisation vector — parameters the passphrase is combined
with — live in manifest.json in the same folder, keyed by
account. The practical rule:
An encrypted maFile copied without manifest.json
cannot be opened, even with the correct passphrase. Copy the
whole maFiles folder, never the one file.
This is the most common way people lock themselves out while believing they
made a backup: the .maFile went to the USB stick, the manifest
stayed behind, and the machine was wiped.
Why the error messages are so unhelpful
SDA derives a key from your passphrase with PBKDF2 and encrypts with AES-256-CBC — a mode with no authentication tag. That matters: an authenticated cipher can tell you plainly that the key was wrong, and an unauthenticated one cannot. What you get instead is a padding error, or occasionally plausible-looking rubbish, and those look identical whether the real problem is
- a wrong passphrase,
- the wrong salt or IV — usually a mismatched
manifest.json, - or a corrupted file.
ODA's importer checks whether the decrypted result actually parses as a maFile, so it can say the passphrase did not open the file rather than handing you garbage — but no tool can tell you which of those three went wrong, or what the right passphrase is. The mathematics genuinely does not know.
If the passphrase is genuinely gone
Then the file's contents are unreachable. That is what encryption is for, and anything claiming to crack it is either lying or describing a brute-force run that only works on short passphrases. The account itself is not lost, though. In order:
- Look for an unencrypted copy. SDA's encryption was off by default, so an older backup of the folder may be plain JSON. Open one in a text editor — readable field names mean unencrypted.
- Any still-working authenticator — the Steam app on a phone, SDA on another machine — can show the recovery code, which removes and re-adds the authenticator cleanly.
- Neither? The lost-access page — from here it is the recovery code you hopefully wrote down, or Steam Support.