Backup Encryption

When you choose an encryption key for your file and database backups, the resulting backup will be encrypted via AES-256 and can only be decrypted using the same key you used.

Behind the scenes, OpenSSL is used and takes care of the encryption for you.

This works best when backups are also streamed ("Backup Streaming" is enabled) since it will happen on the fly and the backup output will not even exist unencrypted at any point in time during the backup state's transition.

Here's a step-by-step guide on how to generate a private key and obtain a PEM public key to use with SimpleBackups:

1. Create the private key

To encrypt your backups, you need to generate a private key first. To do this, open the terminal on your computer and enter the following command:

This command generates an RSA private key that is 4096 bits long. The output file, private-key.pem, is encrypted with AES256. You'll be prompted to enter a password that will be used to protect your private key file. We recommend using a strong passphrase to ensure the security of your private key.

2. Get the PEM public key to use

Once you have generated the private key, you will need to obtain the corresponding PEM public key. To do this, run the following command:

This command generates a PEM public key file that you will use to encrypt your backups. The public key can be safely distributed, while the private key must be kept secret.

After running the command, you will need to copy and paste the contents of the public-key.pem file into SimpleBackups' encryption key field.

3. Save your private key

It is important to keep your private key file safe and secure. We recommend storing it in a password-protected location, such as an encrypted USB device or a secure cloud storage service.

4. Encrypt your backups

You can now use the PEM public key to encrypt your backups. Simply enter the contents of the public-key.pem file into SimpleBackups' encryption key field. When you run the backup, SimpleBackups will use the public key to encrypt your data.

Step 1. Decrypt your encryption passphrase first using the following command:

Where private-key.pem is your private key (you never share it with anyone), encryption-passphrase.pass is the encrypted passphrase used to encrypt your backup via AES-256.

Step 2. Finally, to decrypt your backup, you could use the following command:

Where encrypted-file-from-simplebackups.sql.gz is your encrypted SimpleBackups backup archive, decryption-passphrase.txt is the decrypted passphrase which will decrypt your backup.

We use AES-256 to encrypt your backups using your key via OpenSSL. Using this method is highly recommended, since you are the only one who can actually read your own backups, no one else can.

High-level overview:

You will LOSE access to your encrypted backup, and will not be able to decrypt it. No one can help in this situation. It is extremely important that you keep your private key safe, and never lose it.

No. You can use this command to convert a private SSH key into the public RSA PEM key:

Note: you need the private SSH key, you cannot convert a public SSH key (i.e.:id_rsa.pub) to PEM.