Bitcoin Core: what happens to backup wallet.dat files when creating a password?

[Kryptowerk]

A question regarding external wallet.dat backups after a password change in bitcoin core:
- There is a massage stating that old backups will not work anymore
- I wonder if that's actually true if you have a 2nd device running bitcoin core with the same keys in its wallet.dat - how is the blockchain or this device supposed to know the password was change on the other device?
My guess is local wallet.dat files are affected because bitcoin core somehow also updates the password for these but any external saved backups are still unaffected and should still work with the old (in this case no password at all as it was never set) password.

Can someone explain if my thoughts are correct or if indeed for which-ever magical reason also external backups will be worthless after a password change?
Thanks in advance!

[nc50lc]

- There is a massage stating that old backups will not work anymore

So you've set a password to a wallet that's not encrypted yet,
That message is about the "HD Seed" that's used by the wallet to generate private keys rather than the password.
Because after encryption, that particular wallet will use a different HD seed, thus, different set of private keys and addresses than its other instances or backups.
It does that for safety purposes since the keys would still be linked to any unencrypted copy of the wallet file if it doesn't use a new set of keys.

And that message wont show if you just change the password of an already encrypted wallet.

- I wonder if that's actually true if you have a 2nd device running bitcoin core with the same keys in its wallet.dat - how is the blockchain or this device supposed to know the password was change on the other device?

The Blockchain isn't involved on anything about the wallet's password.
It's all in the wallet instance where you changed the password, the other instance and each backups will still have their original password / remain unencrypted.

[Kryptowerk]

- There is a message stating that old backups will not work anymore

So you've set a password to a wallet that's not encrypted yet,
That message is about the "HD Seed" that's used by the wallet to generate private keys rather than the password.
Because after encryption, that particular wallet will use a different HD seed, thus, different set of private keys and addresses than its other instances or backups.
It does that for safety purposes since the keys would still be linked to any unencrypted copy of the wallet file if it doesn't use a new set of keys.

And that message wont show if you just change the password of an already encrypted wallet.

Much appreciated, now that explains it.
The wallet was indeed unencrypted before and now was changed to use a PW.

But then it means the funds in this (new HD seed) wallet still use the same private keys (for now)? Otherwise a transaction would have been created to transfer them to the new ones, which wasn't the case.
And so the older backups still containing these "old" private keys can be used to extract the funds? Or am I missing something?

Future transaction will use new keys (the new HD seed) for change addresses etc., so as soon as I make *one* transaction, accessing any funds with the old backups will be impossible?

[Forsyth Jones]

Much appreciated, now that explains it.
The wallet was indeed unencrypted before and now was changed to use a PW.

But then it means the funds in this (new HD seed) wallet still use the same private keys (for now)? Otherwise a transaction would have been created to transfer them to the new ones, which wasn't the case.
And so the older backups still containing these "old" private keys can be used to extract the funds? Or am I missing something?

Future transaction will use new keys (the new HD seed) for change addresses etc., so as soon as I make *one* transaction, accessing any funds with the old backups will be impossible?

In short, if you create your wallet in Bitcoin Core and encrypt it from the start, Bitcoin Core will generate "only" 8 descriptors. Every 2 descriptors represent the master private key, directed to a specific derivation path so that the wallet generates legacy, segwit-p2sh and segwit bech32, bech32m (taproot) addresses.

If you create the wallet and don't encrypt it at the time of creation and then encrypt it after the wallet creation, Bitcoin Core will generate 8 more descriptors (now you have 16 descriptors) with a completely different master private key than the previous master key. It does this for your security.

The first 8 descriptors generated when creating the wallet will remain fully functional and will be protected by the backup.

- If you made any backups before encrypting with a passphrase, you must update the backup, because after you encrypted, you now have 16 descriptors protected by the same keystore (wallet.dat = your backup).

If you received coins before upgrading/encrypting your wallet, don't worry, when you go to send coins and have a remaining balance (change), your remaining balance will be sent to a change address associated with your new master private key (descriptor).

In other words, your first 8 descriptors will remain operational, but will no longer be active, that is, they will be hidden (accessible only via console). No receiving or change addresses generated by you will be from these first 8 descriptors, the addresses generated will be from the new descriptors that your wallet generated after encryption.

[nc50lc]

But then it means the funds in this (new HD seed) wallet still use the same private keys (for now)? Otherwise a transaction would have been created to transfer them to the new ones, which wasn't the case.

It still keeps those private keys and you'll still see their parent descriptors in listdescriptors command but with "active: false" flag.
Means that it wont be used to generate new addresses anymore but the wallet will still keep track of transactions that can be spent by those non-active descriptors.

Future transaction will use new keys (the new HD seed) for change addresses etc., -snip-

Yes.

-snip- so as soon as I make *one* transaction, accessing any funds with the old backups will be impossible?

If that transaction is associated with the new descriptors in the new encrypted wallet, yes, the old backups that don't have it will not be able to spend that.
And encrypting the old unencrypted backups will not reproduce the same HD Seed as the one generated by the new encrypted wallet even if you set the same password.