---
title: "Backup encryption keys and recovery kits"
description: "How Outpost Backup keys are held, how to switch a client to zero-knowledge keys, how to download a recovery kit, and what happens when a key is lost."
url: "https://support.outpostplatform.com/backup/encryption-keys/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Backup key custody. Each repository has its own key, generated on the endpoint. By default Outpost escrows a sealed copy; zero-knowledge mode (Backup > Settings, backup:keys plus a second factor) deletes it and offers one-time recovery kits. Recovery kits (JSON or PDF) restore with the open-source kopia tool. Without the endpoint's key or a kit, zero-knowledge backups cannot be recovered."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "backup:keys"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/backup/encryption-keys.md"
license: "CC BY 4.0"
---

# Backup encryption keys and recovery kits

Every Outpost backup is encrypted on the endpoint with a key the endpoint
generates. This page explains who holds a copy of that key, how to switch a
client to zero-knowledge keys so Outpost holds none, and how to download the
recovery kit that restores a backup without Outpost. Read it before the first
backup runs, because the choice decides what you can recover after losing an
endpoint.

## How backup keys work

Each copy of each endpoint, primary or secondary, is a separate repository with
its own key: 32 random bytes the endpoint creates when it first writes to the
destination. Backups are encrypted with AES-256-GCM, in the format of the
open-source kopia tool.

Every key exists in up to three places:

| Where | Held by default | Held in zero-knowledge mode |
| --- | --- | --- |
| On the endpoint, protected with DPAPI on Windows and in a file only root can read on Linux and macOS | Yes | Yes |
| In Outpost, sealed with the client's own encryption key (escrow) | Yes | No |
| In a recovery kit you download and keep | When you download one | Only the kits offered when you turn zero-knowledge on |

An endpoint does not write its first snapshot until Outpost confirms it has
received the key, or, in zero-knowledge mode, confirms it will not keep one.
Until then, runs show **Skipped** with **waiting for Depot to hold the key**.

## Escrow or zero-knowledge

Zero-knowledge is set for a whole client, on **Backup** > **Settings**. It is
not a profile setting, so no profile can override it.

| What you can do | Escrow (default) | Zero-knowledge |
| --- | --- | --- |
| Restore onto the source endpoint | Yes | Yes. The endpoint uses its own key. |
| Browse a snapshot's files in the console | Yes | Yes, through the source endpoint while it is online |
| Download files as a zip in the browser | Yes | No |
| Restore onto another endpoint | Yes | No |
| Recover after the endpoint is lost or rebuilt | Yes. Outpost delivers the key to the endpoint that restores. | Only with a recovery kit |
| Download a recovery kit at any time | Yes | No |

Zero-knowledge suits a client whose policy forbids a service provider from
holding backup keys. It moves the job of keeping keys safe to whoever keeps
the recovery kits.

## Before you begin

- You need the `backup:keys` permission. Among the built-in roles, only the
  owner holds it. On the MSP plan, practice-level roles with `storage:manage`
  hold it too.
- You need a second factor on your console account. Outpost asks for it before
  changing key custody or downloading a kit.
- On the MSP plan, open the client's workspace first. The setting belongs to
  one client.
- Decide where the recovery kits will be kept, such as a password manager or a
  safe. A kit holds a backup key in plain text.

:::danger
Once zero-knowledge is on, Outpost cannot open the client's backups and cannot
replace a lost recovery kit. If an endpoint is lost, rebuilt, or reinstalled
and nobody kept its recovery kit, its backups cannot be decrypted by anyone,
including Outpost.
:::

## Turn on zero-knowledge

1. Go to **Backup** > **Settings**.
2. On the **Zero-knowledge keys** card, read the warning **Depot will hold no
   backup keys**.
3. Select **Turn on zero-knowledge**.
4. Confirm your second factor if Outpost asks for it.
5. Outpost makes a recovery kit for every repository from its own copy of the
   key, then deletes its copies. The **Recovery kits** card lists one kit for
   each repository, including earlier repositories a copy has moved away from,
   by endpoint id and copy. Select **Download kit** for each one.

Each kit link works once, for 15 minutes. Outpost cannot make the kits again,
so download every one before you leave the page. If no endpoint had a key in
Outpost's keeping, the page says so instead, and each endpoint still holds its
own key.

:::caution
A repository created while zero-knowledge is on never has a key in Outpost.
That includes every endpoint enrolled later, a secondary copy added later, and
a copy that moves to another destination. The console cannot make a kit for
it. To get kits for those repositories, turn zero-knowledge off, wait for the
endpoints to connect and send their keys, then turn it on again and download
the kits it offers.
:::

## Turn off zero-knowledge

1. Go to **Backup** > **Settings**.
2. Select **Turn off zero-knowledge**, and confirm your second factor if
   Outpost asks for it.

Outpost asks every endpoint to send its keys again. Endpoints that are offline
send theirs when they next connect. Until an endpoint has sent its keys,
browsing, downloads, and restores onto another endpoint still fail for its
backups.

## Download a recovery kit

With escrow, you can download a kit for any repository at any time.

1. Open the endpoint and select its **Backups** tab.
2. Under **Recovery kit**, select **Primary kit (JSON)** or **Primary kit
   (PDF)**. If the endpoint has a secondary copy, the **Secondary** buttons
   download its kit.
3. Confirm your second factor if Outpost asks for it.

The kit is saved as `recovery-kit-<hostname>-<copy>.json` or `.pdf`. Every
download, and every change to zero-knowledge mode, is recorded in the
[audit log](/depot/audit-log/).

In zero-knowledge mode, the download is refused with **This client uses
zero-knowledge backup keys, so Depot holds no key to put in a kit.**

## What a recovery kit contains

| Field | Contents |
| --- | --- |
| Endpoint | The endpoint's id and hostname, and whether this is the primary or secondary copy |
| Repository | The storage provider, endpoint URL, region, bucket, and prefix, or the network share path |
| Password | The repository's key |
| kopia | The kopia version the repository was written with (0.23.0), and the commands to connect to the repository, list its snapshots, and restore one |

The kit never contains credentials for the storage itself. To use it, you
supply an access key that can read the bucket, or an account that can read the
network share. For backups on Outpost Cloud Storage, you hold no credentials
for the bucket, so a kit is a complete way out only for backups in storage you
own.

## Verify

- **Backup** > **Settings** shows **Zero-knowledge is on for this client.**
  with the time it changed, or **off**.
- On an endpoint's **Backups** tab, each repository with no key in Outpost
  shows **Zero-knowledge**.
- Each kit you downloaded opens and names the expected endpoint and
  repository.

## Next steps

- [Restore files and systems](/backup/restore/)
- [Configure backups with policy](/backup/configure-backup/)
- [Account security](/depot/account-security/)