Encrypt

encrypt outbound wraps an upstream outbound and encrypts the content of each entry before writing.

To encrypt an entire archive instead, use the encryption field of the Archive outbound.

Entry-level encryption protects file content only. Entry names, sizes, and other metadata remain readable. To hide metadata, encrypt the whole archive.

Structure

{
  "type": "encrypt",
  "tag": "encrypt-out",
  "algorithm": "aes-256-gcm",
  "password": "$ENCRYPTION_KEY",
  "recipient": "",
  "outbound": "compress-out"
}

Fields

algorithm

Required

The encryption algorithm.

Algorithm	Description
aes-256-gcm	AES-256 in GCM mode
chacha20	ChaCha20-Poly1305

password

The encryption password. The key is derived from the password using Argon2id.

Exactly one of password and recipient must be set.

recipient

A public key generated by backup-dev generate keypair. Only the recipient's private key can decrypt the backup, using the identity field of the Encrypt inbound.

The key encapsulation is a hybrid of X25519 and ML-KEM-768.

Exactly one of password and recipient must be set.

outbound

Required

The tag of the upstream outbound.