Home Assistant Backup Encryption Key: Safe Recovery

Direct answer: If Home Assistant asks for an encryption key during restore, the backup is encrypted and must be unlocked with the matching key from its backup emergency kit. The key is not your Home Assistant login password, cloud password, or device PIN. If the original Home Assistant installation still works, open its backup settings and download the emergency kit again before doing anything destructive. If the old installation is unavailable, search the safe locations where you stored the kit and check any supported cloud backup account. Do not overwrite the old system or delete backup files while searching.

Symptoms and scope

A backup uploads successfully but restore requests an encryption key.
Your normal Home Assistant password is rejected.
A migration stops because you cannot find the emergency kit.
An automatic backup exists in cloud or network storage, but you cannot decrypt it.
You have several emergency kits and do not know which matches the backup.
A restore begins but fails because the file is incomplete, damaged, or from an incompatible environment.

This guide applies to Home Assistant’s current encrypted backup system introduced with the backup overhaul in 2025. It covers the safe decision process around finding the key, verifying the backup, and restoring. It does not provide a method to bypass encryption; strong backup encryption is specifically intended to prevent that.

What the emergency kit contains

When automatic encrypted backups are configured, Home Assistant generates an encryption key and offers an emergency kit for download. Home Assistant’s official backup guidance says encrypted backups require this key for restoration. The kit records the recovery information and identifies the backup configuration it belongs to.

The emergency kit should be stored separately from the Home Assistant machine. If the only copy is on the same disk that fails, the backup may become unusable precisely when it is needed.

Before attempting another restore

Preserve the original backup file without renaming or modifying its contents.
Make a second copy on another storage device.
Record the backup filename, creation date, size, and storage location.
Do not wipe the old Home Assistant installation if it may still contain the working backup configuration.
Do not post the encryption key, backup file, or emergency kit publicly.
Keep power stable during any restore, especially on Raspberry Pi or removable storage.

A backup can contain credentials, tokens, Wi-Fi details, device keys, location history, and personal automation data. Treat both the archive and emergency kit as sensitive secrets.

Step 1: Confirm that the prompt is for backup encryption

Read the restore screen carefully. An encryption-key prompt is different from the Home Assistant owner login, onboarding account creation, full-disk encryption, a network-storage password, or a cloud-provider sign-in.

The emergency-kit key is associated with Home Assistant backups. Trying account passwords will not decrypt the archive and can waste time or trigger unrelated account protections.

Step 2: Re-download the emergency kit from the working system

If the original Home Assistant installation is accessible:

Open Settings → System → Backups.
Open the automatic-backup configuration.
Locate the emergency-kit or encryption-key option.
Download a fresh copy.
Save it to two separate secure locations.
Label it with the Home Assistant instance and date.

Home Assistant’s 2025 backup announcement states that the emergency kit is available to download again from backup settings. Do this before migrating storage, replacing hardware, reinstalling Home Assistant OS, or experimenting with the old disk.

Step 3: Search likely safe locations methodically

If the old instance is unavailable, search without changing the backup:

Your computer’s Downloads and Documents folders.
An encrypted password-manager attachment or secure note.
An encrypted USB drive or external backup disk.
A private cloud-storage folder you intentionally chose.
A printed recovery folder or sealed offline record.
Another administrator’s approved secure storage.

Search by the Home Assistant instance name, “emergency kit,” “backup,” the approximate setup date, and likely file extensions. Verify the contents locally without sharing them.

Do not use random online “decrypt backup” services. Uploading a Home Assistant backup to an unknown site can expose every secret stored in the installation.

Step 4: Check the configured backup destination

Home Assistant can store automatic backups in enabled locations. The official documentation lists local storage, Home Assistant Cloud for subscribers, network storage, and locations supplied by backup-capable integrations. Determine which destination was enabled when the backup was created.

If Home Assistant Cloud was used, the latest stored backup may be accessible through the authorized cloud account even when the Home Assistant hardware has failed. Cloud-stored backups are encrypted, so the emergency key is still required. Sign in only through the official service.

Step 5: Match the kit to the backup

Do not assume the newest key unlocks every old archive. A backup may belong to an earlier installation or backup configuration. Keep multiple kits clearly labeled rather than replacing older copies automatically.

Start with the kit whose date and instance name best match the backup.
Enter the key exactly, avoiding added spaces or line breaks.
If it fails, stop and verify the backup and kit identity.
Try another legitimate kit only when you have evidence it may match.
Never edit the archive to remove encryption markers.

Step 6: Verify backup integrity before blaming the key

A damaged or incomplete archive may produce a restore failure that looks like a key problem. Compare the file size with the source storage and copy it again if the transfer was interrupted. Avoid restoring directly from an unstable browser upload, failing SD card, or unreliable network share.

If the source system still works, create a new manual backup, download its emergency kit, and test with that known pair. Home Assistant’s general backup guidance recommends excluding large media and share folders when appropriate because oversized backups take longer to create and restore. Do not exclude essential configuration merely to make the file smaller.

Step 7: Prepare the destination correctly

Use the restore path supported by your Home Assistant installation type. A complete Home Assistant OS migration differs from moving a Container installation or restoring selected folders manually. Confirm the destination has enough free storage—ideally comfortably more than the archive size because extraction requires working space.

Connect the destination to stable power and a reliable network. On small single-board computers, avoid suspect SD cards or underpowered adapters. A restore interrupted by power loss can leave the destination inconsistent even though the original backup remains safe.

Step 8: Restore with the correct key

Upload or select the preserved backup through the supported restore interface.
Enter the matching encryption key from the emergency kit.
Select a full or partial restore intentionally.
Start the restore and allow it to finish without refreshing repeatedly.
Expect the interface to become temporarily unavailable during restart.
Reconnect using the appropriate local address after sufficient time.

A large backup can take a long time. Repeatedly restarting the host because the page is temporarily unavailable can convert a slow restore into a failed one. Check host activity and network reachability before intervening.

How to verify the restored system

Confirm the expected Home Assistant version and installation type.
Check integrations for reauthentication or missing hardware.
Verify Zigbee, Z-Wave, Matter, Thread, Bluetooth, and USB adapter mappings.
Test several non-critical automations.
Check dashboards, users, areas, scripts, and helpers.
Review logs for repeated database, storage, or integration errors.
Create a new backup only after the restored instance is stable.

Some integrations intentionally require reauthentication after migration. USB device paths, IP addresses, multicast routing, and radio assignments can also change. These are post-restore environment issues, not proof that the backup was bad.

If you cannot recover the key

There is no responsible shortcut around correctly implemented encryption. If the original instance is still accessible, recover or re-download the emergency kit from it. If a trusted cloud service holds the backup, check its official recovery path. If neither the matching key nor a functioning original system exists, you may have to build a new Home Assistant installation and reconnect devices.

Before rebuilding, preserve the old storage and all backup copies. A later discovery of the correct emergency kit may make restoration possible. Rebuilding immediately on the same disk can destroy that option.

Rollback and recovery

If a restore fails, do not modify the original archive. Save logs and error text, shut down the destination cleanly if possible, and return to the previous known-good boot disk or instance. When migrating hardware, keep the old system powered off but intact until the new one has operated successfully for several days.

When to escalate

Contact official Home Assistant support channels or the relevant installation project with the Home Assistant version, installation type, destination hardware, backup creation date and size, exact error text, and restore stage. Remove secrets from screenshots and logs. Never provide the emergency key or backup archive to strangers offering to fix it.

Prevention: a practical 3-2-1 plan

Keep at least three copies of important data.
Use at least two different storage types or locations.
Keep at least one copy off the Home Assistant host.
Store the emergency kit separately in two secure places.
Label kits with the instance and date.
Test that a backup and its key are available before major updates.
Review retention rules so a bad new backup does not replace the only good copy.
Create a fresh manual backup before hardware, radio, database, or network migrations.

Plan for the case where no matching emergency kit can be found

If every legitimate storage location has been checked and no matching encryption key exists, pause before reinstalling or overwriting anything. Encryption is intended to prevent recovery without the key. A normal account password, recovery-mode login, cloud subscription, or new emergency kit cannot substitute for the key that protected an older backup.

Preserve every remaining source: the original Home Assistant disk, downloaded backup archives, network-storage snapshots, cloud copies, and older emergency kits. Label copies with dates and do not run repair utilities directly against the only surviving disk. If the original system can still boot intermittently, prioritize downloading a fresh backup and its matching emergency kit. If storage hardware is failing, make a sector-level image with appropriate recovery expertise before repeated boots cause further damage.

A partial manual rebuild may be the only safe path when the key is unavailable. Recreate the new Home Assistant owner account, reinstall integrations from official sources, reauthenticate cloud services, and add radios or devices carefully. Do not copy unknown database fragments or secret files into a clean installation without understanding their compatibility and security impact.

Build a backup recovery drill instead of trusting an untested archive

A backup is useful only when its archive, key, storage location, and restore procedure remain available together. Schedule a periodic recovery review. Confirm that automatic backups are completing, verify their sizes are plausible, download the current emergency kit, and store it separately in at least two protected locations. Keep one offline copy when practical and document which Home Assistant instance it belongs to.

Do not expose a backup or emergency kit merely to test it. Use an isolated, supported environment and prevent the restored instance from taking control of production radios, locks, alarms, thermostats, or automations. A test restore should confirm that the key unlocks the archive and that essential configuration is present without allowing two controllers to operate the same home simultaneously.

Information to record before requesting help

Record the Home Assistant version that created the backup, installation type, archive filename and size, destination type, restore environment, exact stage of failure, and the complete redacted error. Say whether the key prompt rejects the key immediately or whether failure occurs later during extraction. This distinction helps separate a mismatched key from damaged storage, insufficient space, or a restore-process problem. Never upload the archive, emergency kit, secrets file, tokens, or unredacted diagnostics to a public forum.

Sources

Last reviewed: September 8, 2026.

Related Troubliq guides: Use the safe diagnostic method and browse all troubleshooting guides.

Decision guide: which recovery path should you choose?

If the original Home Assistant system still starts, the safest path is to re-download the emergency kit there, create a fresh backup, copy both items off the host, and then retry the migration. If the original system does not start but its disk is intact, preserve that disk before attempting repair. Work from a clone or separate destination whenever possible.

If the backup is stored in Home Assistant Cloud or another supported destination, retrieve it only through that provider’s official authenticated interface. A cloud copy does not eliminate the encryption requirement; it protects availability, while the emergency kit protects confidentiality. You need both the archive and its matching key.

If you have the correct key but restoration still fails, investigate file integrity, free disk space, installation type, and transfer errors before concluding the encryption is wrong. If you have no key but retain access to the old instance, recover the kit there. If neither the matching key nor the original instance exists, preserve all media and prepare for a clean rebuild rather than repeatedly modifying the only backup.

Find your next troubleshooting path

Use the related guide that matches the next confirmed layer of the failure. Avoid changing unrelated systems at the same time.

Home Assistant backup asks for an encryption key: find the emergency kit and restore safely