> ## Documentation Index
> Fetch the complete documentation index at: https://doc.trycapsule.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# capsule key

> Display your encryption key for safekeeping before a server migration or decommission.

## Usage

```bash theme={null}
capsule key show
```

## When to run this

Run `capsule key show` **before** any of the following:

* **Migrating to a new server** — copy the key first, then decommission the old machine
* **Rebuilding or re-imaging a server** — the OS keyring is wiped along with the OS
* **Decommissioning a server** — once the machine is gone, the key is gone with it
* **Backing up your secrets** — add it to your password manager or secrets vault as part of a periodic security checklist

If you wait until after the server is gone, the key is unrecoverable and your existing backups cannot be decrypted by anyone — including Capsule.

## What it does

Displays the AES-256 encryption key that Capsule uses to encrypt your backups before they leave your server. The key is a 64-character lowercase hex string representing 32 bytes.

```
Your encryption key (keep this safe — losing it makes your backups unrecoverable):

  a3f8c2d1e4b5a6f7d8e9c0b1a2f3e4d5b6c7a8f9e0d1c2b3a4f5e6d7c8b9a0f1

To restore this key on another server, run: capsule auth --restore
```

## How to store your key

Save the 64-character hex string in one of the following:

* A password manager (1Password, Bitwarden, etc.) — recommended
* An encrypted notes app
* Your team's secrets vault

Do **not** store it in a plaintext file on the same server — if the server is compromised or destroyed, the key goes with it.

<Warning>
  This key is the only thing standing between your backups and permanent data loss. Capsule does not hold a copy. If you lose it, your existing backups cannot be decrypted by anyone.
</Warning>

## Restoring your key on a new server

Once you have the key saved, use it on the replacement server:

```bash theme={null}
capsule auth --restore
```

See [`capsule auth`](/cli/auth#disaster-recovery) for the full restore flow.