Creating an encryption key for PBS and storing it safely

PBS can optionally encrypt your backups right on your Proxmox VE — before they are transferred to us. We then only receive AES-256-GCM-encrypted blocks and cannot decrypt them. That’s the clean solution against every scenario where your backups could go astray on our side — theft, seizure, an attacker in our systems.

Important: without the key you cannot restore the backups. So the key has to be stored safely enough that you never lose it — but not so “safely” that you can’t reach it in an emergency.

Generating the key on the PVE host

On the CLI of your Proxmox VE:

proxmox-backup-client key create /etc/pve/priv/storage/xaweho-pbs.enc

You’ll be asked for an optional password:

• Password set: you need the key AND the password to decrypt backups. Maximum security, but also two things you can lose.
• No password: the key file alone is enough. Easier to handle, but whoever steals the file can decrypt.

For most setups: no password, but store the key file safely.

The generated file is a JSON file containing the key material. It looks something like this:

{
  "kdf": null,
  "created": "2026-05-08T10:23:45Z",
  "modified": "2026-05-08T10:23:45Z",
  "data": "...long base64 string...",
  "fingerprint": "ab:cd:ef:..."
}

Storing the key safely

Three copies in three places is the rule of thumb:

1. On the PVE host: stays under /etc/pve/priv/storage/xaweho-pbs.enc — only root can read it.
2. In your password manager: Bitwarden, 1Password, KeePass — as a secure document or attachment. That way you still have the key even if the PVE host dies completely.
3. Offline: once on a USB stick or printed out in the safe. Sounds old-fashioned, but against ransomware it’s the only reliable protection.

What you should NOT do:

• Store the key on the same PBS that holds the backups — if the PBS is gone, the key is gone too.
• Upload the key without a password to an unprotected cloud (Dropbox, Google Drive).
• Email the key to yourself — it stays in your mailbox forever.

Registering the key in the PBS storage

In PVE you have to tell the storage to encrypt. Via the GUI:

1. Datacenter → Storage, edit the PBS storage.
2. Set the Encryption Key field to the path of the key file.
3. Save.

Via the CLI:

pvesm set xaweho-pbs --encryption-key /etc/pve/priv/storage/xaweho-pbs.enc

What happens from now on?

All new backups are encrypted with the key. Old backups made before you enabled it stay unencrypted — you can see them on the PBS, but they’re not protected by your key.

If you want all backups encrypted: delete the old snapshots (prune script or GUI), run garbage collection, then back up fresh.

Rotating the key

Want to switch keys? You can — but old backups encrypted with the old key stay encrypted with the old key. You need both until the old backups are gone through prune+GC.

# Generate a new key
proxmox-backup-client key create /etc/pve/priv/storage/xaweho-pbs-2026.enc

# Keep the old key as a fallback
mv /etc/pve/priv/storage/xaweho-pbs.enc /etc/pve/priv/storage/xaweho-pbs-old.enc

# Switch the PVE storage to the new key
pvesm set xaweho-pbs --encryption-key /etc/pve/priv/storage/xaweho-pbs-2026.enc

When restoring an old backup, you provide the old key. New backups use the new one.

Frequently asked questions

Can I use an existing key on a second PVE host? Yes. Copy the .enc file to the second PVE (best via scp, not via email or USB stick), use the same path and storage entry. Both PVE hosts can then back up to the same datastore with the same key.

What’s the difference between “key with password” and “key without password”? With a password, you have to type the password additionally during restore. That protects against file theft, but is operationally more expensive (you forget a password you haven’t needed for a long time). In an emergency, “key file from the password manager + start restore” is simpler than “find the file, dig up the password, then restore”.

Can I migrate backups when switching providers? For encrypted backups: no, not without the key. Encrypted PBS backups are worthless without the key. If you ever move to another provider, you take the backups along with the key, or you back up your VMs fresh to the new provider — and keep the old backups around for a while until rotation.

What if I’ve lost the key? Then the encrypted backups are lost. We can’t help you — we don’t have the key. That’s the whole point of client-side encryption.

What’s next

• Running your first backup
• Restoring a complete VM or LXC
• Append-only mode — protection against ransomware