Recovery & your encryption key

Your backups are encrypted with a password that Rested cannot read or recover. This page explains what that means for recovery — including the case where the original machine is gone.

Rested cannot recover your password

Every repository is encrypted by restic with a password you set when you create it. That password is sealed to your server’s agent in your browser and is never sent to Rested in a form we can read. This is what keeps your backup data private — but it also means that if you lose the password, no one, including Rested, can decrypt your backups.

Save your encryption password outside Rested

Store it in a password manager (1Password, Bitwarden) or another safe place before you rely on the repository. Recovering data requires this password; we cannot reset or retrieve it for you.

If you still have the machine

Use the in-app restore flow: open the repository, go to the Snapshots tab, pick a snapshot, and choose Restore. The agent already holds your encryption password locally, so it can restore without you re-entering anything. See Restoring your data.

If the machine is lost

You can still recover as long as you have your restic password and read access to the storage bucket. From any machine with restic installed:

Open Rested's recovery page and copy the repository URL.
Create or retrieve storage credentials from your storage provider. Read-only credentials are sufficient for listing and restoring snapshots.
Set those credentials and your saved password as environment variables.
List snapshots, then restore the one you want.

export RESTIC_REPOSITORY="<repository URL from Rested>"
export RESTIC_PASSWORD="<your saved encryption password>"
export AWS_ACCESS_KEY_ID="<access key from your storage provider>"
export AWS_SECRET_ACCESS_KEY="<secret key from your storage provider>"

restic snapshots
restic restore latest --target /home/restore

Because restic reads directly from your storage bucket, this works even if Rested is unreachable — save the repository URL alongside your recovery password, or reconstruct it from your bucket and repository prefix. Rested never has plaintext storage credentials it could reveal later.

No machine, no password?

If you have neither the original machine nor the saved password, the encrypted data cannot be decrypted. This is a property of end-to-end encryption, not a Rested limitation. Keep your password backed up.