Encryption function used by Instagram (Browser App) to generate the 'enc_password' from PubKey (AES-GCM + SealedBox)

generate_instagram_enc_password.py

import base64
import struct
import datetime
import binascii

from urllib.parse import quote_plus

# pip install pycryptodomex
from Cryptodome import Random
from Cryptodome.Cipher import AES

# pip install PyNaCl
from nacl.public import PublicKey, SealedBox


def encrypt_password(key_id, pub_key, password, version=10):
    key = Random.get_random_bytes(32)
    iv = bytes([0] * 12)

    time = int(datetime.datetime.now().timestamp())

    aes = AES.new(key, AES.MODE_GCM, nonce=iv, mac_len=16)
    aes.update(str(time).encode('utf-8'))
    encrypted_password, cipher_tag = aes.encrypt_and_digest(password.encode('utf-8'))

    pub_key_bytes = binascii.unhexlify(pub_key)
    seal_box = SealedBox(PublicKey(pub_key_bytes))
    encrypted_key = seal_box.encrypt(key)

    encrypted = bytes([1,
                       key_id,
                       *list(struct.pack('<h', len(encrypted_key))),
                       *list(encrypted_key),
                       *list(cipher_tag),
                       *list(encrypted_password)])
    encrypted = base64.b64encode(encrypted).decode('utf-8')

    return quote_plus(f'#PWD_INSTAGRAM_BROWSER:{version}:{time}:{encrypted}')


print(encrypt_password(72, "b3a328ff28b785092af6a578767877514c93a690a11b9d92ba0ce614c9d5db57", "CHANGE_PASSWORD_HERE"))

NodeJS version: https://github.com/unoemon/instagram-enc_passowrd-generator/blob/master/enc_passowrd-generator.js

Patch the JS script:

1,2c1
< const WebCrypto = require("node-webcrypto-ossl");
< const webcrypto = new WebCrypto();
---
> const webcrypto = new (require("node-webcrypto-ossl")).Crypto();
6,10c5,9
< exports.handler = async (event) => {
<   const APP_ID = '6';
<   const KEY_ID = '191';
<   const PUBLIC_KEY = '47c741b21d867bf5909ec70f86da86b9adcdff119c365f44f19d2f222f60260b';
<   const PASSWORD = 'passwrod123';
---
> generatePassword = async (appId, keyId, pubKey, password) => {
>   const APP_ID = appId;
>   const KEY_ID = keyId;
>   const PUBLIC_KEY = pubKey;
>   const PASSWORD = password;
32c31
<   return "#PWD_INSTAGRAM_BROWSER" + ':' + app_id + ':' + time + ':' + enc_password
---
>   return encodeURIComponent("#PWD_INSTAGRAM_BROWSER" + ':' + app_id + ':' + time + ':' + enc_password)
96,99c95
<   var t, o = [], c = str.length;
<   for (t = 0; t < c; t++)
<     o.push(String.fromCharCode(str[t]));
<   return btoa(o.join(''))
---
>   return Buffer.from(str, "binary").toString("base64");
107a104,106
> 
> // MAIN
> generatePassword("10", 72, "b3a328ff28b785092af6a578767877514c93a690a11b9d92ba0ce614c9d5db57", "CHANGE_PASSWORD_HERE")

Rust version

use aes_gcm::{aead::NewAead, AeadInPlace, Aes256Gcm, Key, Nonce};
use chrono::Utc;
use rand::Rng;
use rust_sodium::crypto::{box_::PublicKey, sealedbox::curve25519blake2bxsalsa20poly1305::seal};

const VERSION: u8 = 10;

fn read_hex_array(hex_array: &str) -> Vec<u8> {
    let hex_array = hex_array.as_bytes();
    let mut result = Vec::new();
    for i in (0..hex_array.len()).step_by(2) {
        let first = hex_array[i];
        let second = hex_array.get(i + 1).unwrap_or(&0);
        let mut number = match first {
            b'a'..=b'f' => 10 + (first - b'a'),
            b'A'..=b'F' => 10 + (first - b'A'),
            b'0'..=b'9' => first - b'0',
            _ => 0,
        };
        number <<= 4;
        number += match second {
            b'a'..=b'f' => 10 + (second - b'a'),
            b'A'..=b'F' => 10 + (second - b'A'),
            b'0'..=b'9' => second - b'0',
            _ => 0,
        };
        result.push(number);
    }
    result
}

fn generate_enc_password(public_key: &str, key_id: u8, password: &str) -> String {
    let public_key = read_hex_array(public_key);
    let iv = [0; 12];
    let mut key: [u8; 32] = [0; 32];
    rand::thread_rng().fill(&mut key);
    let time = Utc::now().timestamp().to_string();

    // Encrypt the password
    let aes = Aes256Gcm::new(Key::from_slice(&key));
    let mut encrypted_password = password.as_bytes().to_vec();
    let cipher_tag = aes
        .encrypt_in_place_detached(
            Nonce::from_slice(&iv),
            time.as_ref(),
            encrypted_password.as_mut_slice(),
        )
        .unwrap();
    
    // Seal the key with the public key
    let mut encrypted_key = seal(&key, &PublicKey::from_slice(&public_key).unwrap());

    let mut result = vec![1, key_id];
    result.extend_from_slice(&(encrypted_key.len() as u16).to_le_bytes());
    result.append(&mut encrypted_key);
    result.extend_from_slice(&cipher_tag);
    result.append(&mut encrypted_password);

    format!(
        "#PWD_INSTAGRAM_BROWSER:{}:{}:{}",
        VERSION,
        time,
        base64::encode(result)
    )
}

@lorenzodifuccia
Not working.

@suyashjawale, maybe key_id, pub_key are changed...

@suyashjawale, maybe key_id, pub_key are changed...

do you know how solve this problem ?

any update on why it might not work? I'm entering my password yet it still responds that the password is incorrect.
b'{"message":"Sorry, your password was incorrect. Please double-check your password.","status":"fail"}'
(for sure its the right password, also i made sure to receive the current public key and key id from 'https://www.instagram.com/data/shared_data/' using the code:

    data = json.loads(requests.get('https://www.instagram.com/data/shared_data/').text)
    publicKey = data['encryption']['public_key']
    keyId     = data['encryption']['key_id']
    result = encrypt_password(int(keyId), publicKey, password)

)

yep this not working i changed the keys still getting this error

any solution for this issue?

yep this not working i changed the keys still getting this error

In my case, I encrypt with version 10, but version is 9. You should get actual version from https://www.instagram.com/data/shared_data/ -> encryption.version

Thank you for sharing this!

I am using it in the fb2cal project to properly authenticate: https://github.com/mobeigi/fb2cal/blob/master/fb2cal/utils.py#L22-L50

I was using plain text password before which seems to have only recently stopped working.
Made minor change for header and version to support Facebook Web instead of Instagram.

Question for @tabekg , are you aware of any Facebook Web equivalent to: https://www.instagram.com/data/shared_data/
I'd like to programmatically get the version too for Facebook Web rather than hard coding it.

any update on why it might not work? I'm entering my password yet it still responds that the password is incorrect. b'{"message":"Sorry, your password was incorrect. Please double-check your password.","status":"fail"}' (for sure its the right password, also i made sure to receive the current public key and key id from 'https://www.instagram.com/data/shared_data/' using the code:

    data = json.loads(requests.get('https://www.instagram.com/data/shared_data/').text)
    publicKey = data['encryption']['public_key']
    keyId     = data['encryption']['key_id']
    result = encrypt_password(int(keyId), publicKey, password)

)

did u know how i get public key for #PWD_INSTAGRAM:1 v1
or how i generate it?