Skip to main content

​
Usage

​
When to run this

Run capsule key show before any of the following:
  • Migrating to a new server — copy the key first, then decommission the old machine
  • Rebuilding or re-imaging a server — the OS keyring is wiped along with the OS
  • Decommissioning a server — once the machine is gone, the key is gone with it
  • Backing up your secrets — add it to your password manager or secrets vault as part of a periodic security checklist
If you wait until after the server is gone, the key is unrecoverable and your existing backups cannot be decrypted by anyone — including Capsule.

​
What it does

Displays the AES-256 encryption key that Capsule uses to encrypt your backups before they leave your server. The key is a 64-character lowercase hex string representing 32 bytes.

​
How to store your key

Save the 64-character hex string in one of the following:
  • A password manager (1Password, Bitwarden, etc.) — recommended
  • An encrypted notes app
  • Your team’s secrets vault
Do not store it in a plaintext file on the same server — if the server is compromised or destroyed, the key goes with it.
This key is the only thing standing between your backups and permanent data loss. Capsule does not hold a copy. If you lose it, your existing backups cannot be decrypted by anyone.

​
Restoring your key on a new server

Once you have the key saved, use it on the replacement server:
See capsule auth for the full restore flow.