# Encryption keys (/docs/security/encryption-keys)

Add your own key so every new backup is also encrypted to a key you hold. With it you can open downloaded files and copies in your own bucket without backupd.

Open **Settings → Encryption**. Owners and admins can add and revoke keys. A workspace can have up to 3 keys.

## Add a key [#add-a-key]

Click **Add key**, give it a **Label** (for example `Ops team vault`), and choose how to create it.

<Tabs items={["Generate in browser", "Use an existing key"]}>
<Tab value="Generate in browser">

1. Click **Generate key pair**. The key pair is created on your device.
2. Save the **Secret key**. It is shown once. backupd never sees it and can't recover it.
   - **Download key file** saves it as `backupd-<workspace>.agekey`, an age identity file you can use with `age -d -i`.
   - Or copy it into your password manager and click **I copied it somewhere safe**.
3. Click **Add key**.

Only the public key is sent to backupd.

</Tab>
<Tab value="Use an existing key">

Paste an age **Public key**, which starts with `age1`. Only the public key, never the secret one.

To make a key with the age tools:

```sh
age-keygen -o backupd.agekey
```

The command prints the public key. Run `age-keygen -y backupd.agekey` to print it again.

</Tab>
</Tabs>

<Callout type="warn">
  Keep the secret key in a password manager or vault. Anyone with it can read
  the backups encrypted to it.
</Callout>

## Which backups a key opens [#which-backups-a-key-opens]

A key opens backups made **after** you added it. It can't open older backups, because each file's encryption is fixed when it is written. For older backups, use **Download decrypted** in the app.

## Your keys [#your-keys]

Under **Your keys** you see each key's label, public key and when it was added. New backups are encrypted to every key listed.

## Revoke a key [#revoke-a-key]

Click **Revoke** next to a key. Revoking only affects future backups: backups already encrypted to the key stay readable with it. To fully retire a key, revoke it and delete any backups or bucket copies it should no longer open.

## backupd's key [#backupds-key]

**backupd's key** shows the public key backupd uses for your workspace. backupd needs it to run restores and restore tests, so it can't be removed.

## Next [#next]

Use your key to [restore without backupd](/docs/restoring/without-backupd).