# My .kbk backup won't restore

Wrong passphrase, unsupported version, or an unreadable file - what each restore error means and what actually fixes it.

Canonical: https://kochab.io/docs/troubleshooting/backup-wont-restore/

A `.kbk` backup is a passphrase-encrypted file you own - Kochab never holds a copy of it or the
passphrase, so restoring it always starts with picking the file and entering the passphrase
yourself on the **Restore** screen. The message it fails with names which of the following
went wrong.

## "Wrong passphrase"

This means the file decrypted incorrectly under the passphrase you typed, not that the file
itself is bad. Kochab may have prefilled a remembered passphrase from a previous restore on
this device. Check that the field holds the phrase you used for this particular backup,
especially if you have made more than one over time with different passphrases.

## "Unsupported backup version"

Kochab could not recognize the file's header. This usually means the `.kbk` came from a very
different app version than the one restoring it. Update Kochab to the current version on both
the device that made the backup and the device restoring it, then export a fresh backup and
try again.

## "Could not read this backup"

The file itself is not a valid backup - it is corrupted, truncated, or not a `.kbk` at all.
The file picker does not filter by file type, so it is easy to select the wrong file by
mistake (a screenshot of your passphrase, for instance, instead of the backup itself). Some
messaging apps and cloud sync tools also alter files in transit; if you moved the backup
through one of those, re-transfer it directly rather than through a share sheet that
re-encodes it, or re-export a fresh copy.

## "You already have a stack called ..." or a conflicting service

This is not a corrupted backup. It means the restore would collide with something already on
this device - a stack with the same name, or a service already configured under a different
stack. The restore screen has two ways through this:

- **Replace everything** wipes your current stacks, keys, and saved certificates first, then
  restores the backup cleanly. This is destructive: use it only when you mean to fully replace
  what is on this device.
- Leave it off and the restore updates the stacks you already have and adds new ones from the
  backup, without removing anything. For a clean merge instead, rename or remove the colliding
  stack locally first.

## After a successful restore

Two things do not come back automatically, on purpose:

- **Certificates** are re-checked against each host the next time you connect, unless you
  explicitly turn on the trust-saved-certificates option during the restore (it names the
number of certificates in your backup). A foreign or tampered
  backup should never silently pin the certificates it names.
- **Notifications** need the **Reconnect notifications** option turned on during the restore
  to rejoin the account this backup belonged to. Without it, the stacks and keys come back but
  this device stays off that notification account.