# Download a backup (/docs/restoring/download)

Any member of the workspace can download a backup from its page. Every download is recorded in the [audit log](/docs/team/audit-log).

## Download options [#download-options]

| Button | What you get |
| --- | --- |
| **Download** or **Download decrypted** | The dump itself, decrypted and decompressed by backupd, ready for the engine's restore tool. For example `production-….pgdump` or `….sql`. |
| **Download encrypted** | The stored file exactly as it is in backupd Storage, compressed with zstd and encrypted with age, for example `production-….pgdump.zst.age`. |

When the backup is encrypted to a key you added, **Download encrypted** is the main button and the decrypted download is shown as **Download decrypted**.

**Download encrypted** gives you a short-lived link that works for five minutes. Start the download again if it expires.

## Which one to use [#which-one-to-use]

- **Download encrypted** when you hold a key that the backup was encrypted to. The file stays encrypted until it reaches your machine. Decrypt it with your key, see [Restore without backupd](/docs/restoring/without-backupd).
- **Download decrypted** when the backup was made before you added a key, or when you don't have a key yet. backupd decrypts it with its own key.

<Callout type="info">
  A key only opens backups made after you added it. Backups made before then can
  still be downloaded decrypted from the app.
</Callout>

## Restore a decrypted download [#restore-a-decrypted-download]

The decrypted file is the dump with no compression or encryption. Restore it with the engine's own tool:

```sh title="PostgreSQL 17+"
pg_restore --no-owner --single-transaction -d "$TARGET_URL" production.pgdump
```

```sh title="PostgreSQL 9.2 to 16"
pg_restore --no-owner -f - production.pgdump | grep -v '^SET transaction_timeout' \
  | psql --single-transaction -v ON_ERROR_STOP=1 "$TARGET_URL"
```

```sh title="MySQL / MariaDB"
mysql --defaults-extra-file=target.cnf target_db < production.sql
```

```sh title="MongoDB"
mongorestore --archive=production.archive --uri "$TARGET_URI"
# Full replica-set backups include the oplog: add --oplogReplay.
```

```sh title="Convex"
npx convex import --replace-all production.zip
```