Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Encryption Keys in NovaBACKUP 22: What They Protect and What Cannot Be Recovered

An encryption key protects every backup on its device, and NovaBACKUP cannot recover a lost key. Learn how keys work and how to keep a safe copy.

Applies to: NovaBACKUP PC Agent and NovaBACKUP Server Agent, version 22.

An encryption key protects the backups on a device. NovaBACKUP cannot recover a lost key for you, so only someone who still has the key can restore the backups encrypted with it. Read this article before you set or change a key.

At a glance

QuestionAnswer
What does the key protect?All backups written to the device it is set on. The key belongs to the device, not to a job.
Where is it set?When you add a device on the Devices page, in the Encryption key and Confirm encryption key fields. The key is 10 to 30 characters long.
Can I change it later?Yes, on the device's details page. Backups made with the earlier key stay restorable.
Can NovaBACKUP recover a lost key?No. See below for the two places a copy can exist.
What happens if I delete the device?Its keys are deleted with it.

Changing a key

To change the key, open the device on the Devices page and enter a new Encryption Key. Leave the field empty to keep the current key.

When you change the key, NovaBACKUP also keeps every earlier key for that device, so backups made before the change can still be restored. Turning encryption off does not delete the keys.

Important: Deleting a device deletes all of its encryption keys. If backups encrypted with those keys still exist, you need the keys from your own records to restore them later.

What cannot be recovered

NovaBACKUP stores encryption keys in the device configuration on the computer, and nowhere else unless you set up one of the copies described below. If the computer is lost and you have no copy of the key, the backups encrypted with it cannot be restored by anyone, including NovaBACKUP Support.

A copy of the key can exist in two places, if you set them up in advance:

  • Your NovaBACKUP Management Console (CMon): for a cloud device, a recovery token from the CMon returns the device settings, including the encryption key. See Issuing a Device Recovery Token in the CMon.
  • Your recovery media: media created with Include device configuration selected contains the device credentials and encryption keys.

Important: Anyone who has recovery media created with Include device configuration can use it to reach your backup storage. Keep that media secure.

When NovaBACKUP asks for a key

If you restore, mount, or import backups that were written with a key this device does not hold, NovaBACKUP pauses and shows Encryption key required, with the message The backup data on this device was written with an encryption key that is not stored here. Enter the key to continue.

  1. Enter the key in Encryption key.
  2. Select Continue.

If the key is wrong, NovaBACKUP shows The key you entered did not unlock the backup data. Check it and try again. To stop, select Cancel. The job ends as canceled, and the files that need the key are not restored.

To keep the key during an import, select Save this key to the device so future imports and restores do not ask for it. A key entered for a mount is used for that mount only.

Legacy backups

In NovaBACKUP 21.x, the key was set per backup job. Backups made by legacy jobs use the key of the job that created them. Restore them in the Legacy NovaBACKUP UI with that key.

Best Practices

  • Store every encryption key in a password manager or another secure place outside the computer, labeled with the device it belongs to.
  • For MSPs: manage cloud devices from the CMon, so a recovery token can return the key if a computer is lost.
  • When you change a key, keep a record of the earlier key until the backups made with it have expired.
  • Test a restore on a second computer, using only your stored copy of the key.

Related Articles

Still Need Help?

Contact NovaBACKUP Support: