---
title: 'Howto Encrypt Backups on creation'
url: 'https://willifix.net/blog/howto-encrypt-backups-on-creation'
markdown: 'https://willifix.net/blog/howto-encrypt-backups-on-creation.md'
date: '2025-06-27'
description: "Background No backup, no mercy! That's why I store my backups in several locations with different hyperscalers (aws, hetzner, azure). But are these providers really trustworthy when it comes to my life insurance policy, for example? I can't thoroughly check the existing security mechanisms. I also…"
---

# Howto Encrypt Backups on creation

## [Howto Encrypt Backups on creation](https://willifix.net/blog/howto-encrypt-backups-on-creation)

    27th Jun 2025  

### Background

**No backup, no mercy!** That's why I store my backups in several locations with different hyperscalers (aws, hetzner, azure). But are these providers really trustworthy when it comes to my life insurance policy, for example? I can't thoroughly check the existing security mechanisms. I also have limited trust in the encryption they offer. In the past, there have been some very surprising incidents in this regard.

**So I have to assume that I'm not the only one who could have access to this data ?**

![kindpng_417020](https://willifix.net/images/a/e/8/6/d/ae86d35edfafe05dc78ff780157f4831db43dc0d-kindpng417020.png "kindpng_417020")

So how can I prevent unauthorized persons from accessing my backups in the event of a leak or hack? The answer is quite simple 🤓 

![gnupg-logo-300x131-2179043192](https://willifix.net/user/pages/03.blog/howto-encrypt-backups-on-creation/gnupg-logo-300x131-2179043192.png "gnupg-logo-300x131-2179043192")### how does it work?

Readers of my blog should already have a picture in their minds, but for the others here, here's how it works. Thanks to my Yubikey, I have a key pair (public/private) that I can use to encrypt the backups. For the encryption only the public 🔑 is needed. When I need the backups, I need my private 🔑 to decrypt them.

for more infos about the Public-key crypthography have a look [Public-key\_cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography)

#### Example

No blog post without a practical example!

##### Encrypt

In order to encrypt my backups using my public key when creating them, I first need to install `GnuPG` on the server. Then I can use the following command to import my gpg key:

```bash
curl -fsSl https://willifix.net/contact/rwillems.txt | gpg --import
```

the output confirms the import:

![RWill_2025-06-27%2022-43-47](https://willifix.net/user/pages/03.blog/howto-encrypt-backups-on-creation/RWill_2025-06-27%2022-43-47.png "RWill_2025-06-27%2022-43-47")

now we have everything to encrypt our stuff. I like oneliners and here is a example how to `tar` a file and encrypt the output directly with the public key:

```
tar czf - /source | gpg --encrypt --recipient raffael.willems@im-c.de --output /tmp/source.tar.gpg
```

The backups are therefore encrypted 🔐and unusable in the event of data theft.

##### decrypt

Since GPG does a lot of the work for us here, I think decrypting is easier than encrypting.

```
gpg --decrypt source.tar.gpg | tar xvfz -
```

if you need to decrypt on a server have a look <https://willifix.net/blog/howto-decrypt-with-yubikey-on-remote-hosts>
That's it, folks!

![rage-comic-face-47-1](https://willifix.net/images/d/1/5/d/d/d15ddfe72731269507816f2d7bdc986a5721947e-rage-comic-face-47-1.jpeg "rage-comic-face-47-1")

 [ Previous Post](https://willifix.net/blog/howto-windows-recovery-partition-move) [Next Post ](https://willifix.net/blog/howto-decrypt-with-yubikey-on-remote-hosts)

---

## Navigation

- Parent: [Blog](https://willifix.net/blog.md)
- Previous: [howto decrypt with yubikey on remote hosts](https://willifix.net/blog/howto-decrypt-with-yubikey-on-remote-hosts.md)
- Next: [Howto Windows Recovery Partition move](https://willifix.net/blog/howto-windows-recovery-partition-move.md)