> ## Documentation Index
> Fetch the complete documentation index at: https://snapr.seshuk.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption

> Encrypt backup archives per job with OpenSSL symmetric encryption, and decrypt them manually when you need to.

Encryption is optional, symmetric, and configured per job. snapr applies it **after** compression. Currently only OpenSSL is supported.

## Prerequisites

* `openssl` must be installed on the snapr host and available in `PATH`. snapr shells out to it for encryption.
* snapr runs `openssl enc -<cipher> -salt -pbkdf2 -pass env:...`. It forwards the password through an environment variable, never on the command line.

## Fields

| Option     | Type   | Required | Default       | Description                                                                             |
| ---------- | ------ | -------- | ------------- | --------------------------------------------------------------------------------------- |
| `type`     | enum   | No       | `openssl`     | Only `openssl` is supported.                                                            |
| `cipher`   | string | No       | `aes-256-cbc` | Any cipher accepted by `openssl enc -<cipher>` (for example `aes-256-gcm`, `chacha20`). |
| `password` | string | Yes      | —             | Encryption passphrase. Use `env:` for secrets.                                          |

## Example

```yaml snapr.yaml theme={null}
jobs:
  - name: postgres-nightly
    # ...
    encryption:
      type: openssl
      cipher: aes-256-cbc
      password: env:BACKUP_ENC_PASSWORD
```

snapr appends `.enc` to the compressed filename (for example `backup.tar.gz.enc`). After a successful run, it deletes the plaintext archive from the working directory.

<Warning>
  Lose the passphrase, lose the backup. Store it outside snapr — in a password manager or a separate secrets store.
</Warning>

## Decrypt an archive by hand

snapr encrypts with `-salt -pbkdf2`, so your decrypt command must include `-pbkdf2` as well.

<Steps>
  <Step title="Get the encrypted file">
    Download the archive from the web UI, the [download API](/api-reference/overview), or copy it straight off the storage backend. If the job also uses the [splitter](/configuration/splitter), reassemble the parts first.
  </Step>

  <Step title="Export the passphrase">
    Put the passphrase in an environment variable so it never appears in your shell history as a command argument:

    ```bash theme={null}
    export BACKUP_ENC_PASSWORD='your-passphrase'
    ```
  </Step>

  <Step title="Decrypt">
    Use the same cipher the job was configured with. With the default `aes-256-cbc`:

    ```bash theme={null}
    openssl enc -d -aes-256-cbc -pbkdf2 \
      -in backup.tar.gz.enc \
      -out backup.tar.gz \
      -pass env:BACKUP_ENC_PASSWORD
    ```

    If you set a non-default `cipher` in the job config, pass that same value here.
  </Step>

  <Step title="Extract">
    ```bash theme={null}
    tar -xzf backup.tar.gz
    ```
  </Step>
</Steps>

<Note>
  Forgetting `-pbkdf2` on decrypt produces a "bad decrypt" error even with the correct passphrase, because OpenSSL then
  derives the key with a different function than snapr used.
</Note>