Recovery & your encryption key

Your backups are encrypted with a password that only your machine holds. This page explains what that means for recovery — including the case where the original machine is gone.

Rested cannot recover your password

Every repository is encrypted by restic with a password you set when you create it. That password is sealed to your server’s agent in your browser and is never sent to Rested in a form we can read. This is what keeps your backup data private — but it also means that if you lose the password, no one, including Rested, can decrypt your backups.

Save your encryption password outside Rested

Store it in a password manager (1Password, Bitwarden) or another safe place before you rely on the repository. Recovering data requires this password; we cannot reset or retrieve it for you.

If you still have the machine

Use the in-app restore flow: open the repository, go to the Snapshots tab, pick a snapshot, and choose Restore. The agent already holds your encryption password locally, so it can restore without you re-entering anything. See Restoring your data.

If the machine is lost

You can still recover as long as you have your restic password and read access to the storage bucket. From any machine with restic installed:

  • In Rested, open the repository and use the recovery flow to issue read-only storage credentials and copy the repository URL.
  • Set the credentials and password as environment variables.
  • List snapshots, then restore the one you want.
export RESTIC_REPOSITORY="<repository URL from Rested>"
export RESTIC_PASSWORD="<your saved encryption password>"
export AWS_ACCESS_KEY_ID="<read-only key from Rested>"
export AWS_SECRET_ACCESS_KEY="<read-only secret from Rested>"

restic snapshots
restic restore latest --target /home/restore

Because restic reads directly from your storage bucket, this works even if Rested is unreachable — the data and the format are standard restic.

No machine, no password?

If you have neither the original machine nor the saved password, the encrypted data cannot be decrypted. This is a property of end-to-end encryption, not a Rested limitation. Keep your password backed up.