This website was helping me. Quote:
Then run the following command, replacing $BACKUPFOLDER with the path to the folder with your backup folders and $PASSPHRASE with your encryption passphrase:
for i in /$BACKUPFOLDER/*; do
if gpg --passphrase=$PASSPHRASE --batch --pinentry-mode=loopback --decrypt $i >/dev/null 2>/dev/null; then
echo -e "^ \033[0;32mcorrect passphrase\033[0m";
else echo -e "^ \033[0;31mwrong passphrase\033[0m";
If you see that some of the files have the correct passphrase and some have the wrong passphrase, you are affected by this bug.
Duplicity, the underlying backup program that Déjà Dup calls, does not always validate that the encryption passphrase used for a backup is the same one used on the previous backup. This is bug 918489.
Déjà Dup used to not clear out a saved encryption password from your keyring when you entered a passphrase without asking for it to be remembered. Which would cause a saved default passphrase to be lurking on the system, although you backed up with a new passphrase. This has been fixed since 39.1.
Even if you never saved your passphrase, you may have made a typo one of the times you entered it. In which case, that new passphrase would be used for those backup files. This has been fixed since 39.1.
The result of all three of these problems together means that pieces of your chain of backup volumes might be encrypted with different passwords than other parts.