---
title: "Encrypt backups · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/backups-and-recovery/encrypted-backups
updated: 2026-10-20
licence: "All rights reserved"
---

# Encrypt backups

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Backups and recovery](https://agentwranglers.se/playbook/data/backups-and-recovery)
- Rule: Encrypt every backup before it leaves the server, and keep the key apart from the backups.
- How: Encrypt with a public key, using a tool such as `age` or `gpg`, so the server holds only the key that locks. Or use storage-side encryption with a key you control. Store the private key in a password manager or secret store, never next to the backups. The [encrypt data rule](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data) covers data at rest in general.
- Check: Download a backup file. It cannot be opened without the key, and the private key is not on the database server.

Example:

```sh
pg_dump --format=custom shop | age -r age1examplepublickey... > shop-2026-10-20.dump.age
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers data playbook: https://agentwranglers.se/playbook/data/backups-and-recovery/encrypted-backups`.

- Next: [Keep point-in-time recovery for busy databases](https://agentwranglers.se/playbook/data/backups-and-recovery/point-in-time-recovery)
- [Backups and recovery](https://agentwranglers.se/playbook/data/backups-and-recovery)