---
title: "Backup encryption"
description: "How CDP Backup encrypts a node's backups with your passphrase, when you set it, and what happens if you lose it."
content_type: "concept"
product: "cdp-backup"
platform: "MyAccount"
url: "/myaccount/cdp-backup/concepts/backup-encryption/"
---

# Backup encryption

Backup encryption protects a node's CDP Backup recovery points with a passphrase that only you
know. The backups are encrypted with AES-256. Only someone with the passphrase can browse or
restore them. Encryption is optional and off by default.

Use it when the node holds sensitive data or runs in production, or when your security
policies require backups to be encrypted.

In **Manage CDP Backups**, an encrypted backup shows a shield beside the node's name.

## When you set the passphrase

You choose encryption only when you turn backup on:

- On an existing node, check **Do you want to apply encryption?** in
  **Backup Schedule Configuration**; see
  [Turn on CDP Backup for a node](/myaccount/cdp-backup/how-to/turn-on-cdp-backup/).
- On a new node, check **Do you want to apply backup encryption?** under **Enable Backup.** on the
  create-node form; see
  [Enable backups on a node](/myaccount/node/how-to/enable-backups-on-a-node/).

Enter the passphrase in **Encryption Passphrase** and again in **Confirm Passphrase**. It must be 8
to 50 characters, with at least one digit, one uppercase letter, one lowercase letter, and one
special character.

## When you need the passphrase

Every backup of the node is encrypted with the passphrase. To browse or restore an encrypted backup,
enter the passphrase in **Passphrase** and click **Submit**. A wrong passphrase gets "Passphrase
provided is incorrect. Please provide correct passphrase to proceed." Once you enter the right one,
you can browse and restore the backup.

## If you lose the passphrase

If you lose the passphrase, neither you nor E2E can restore the node's backups. E2E does not store
your passphrase and cannot reset or recover it.

Every later backup of the node uses the same passphrase, and needs it to be restored too. Those old
recovery points need the lost passphrase, so turning backup off loses nothing you could restore. To
back the node up with a passphrase you know, turn backup off and on again with a new one.

Keep the passphrase in a password manager, and share it only with the people who restore backups.
Choose a passphrase you do not use anywhere else.

## Changing encryption later

Encryption and the passphrase stay as you set them for as long as backup is on. **Change Schedule**
has no setting for either.

Turning backup off removes the node's recovery points for good. Restore anything you need first.
Then, to add encryption, remove it, or change the passphrase, turn backup off and on again with the
new setting. See
[Deactivate CDP Backup](/myaccount/cdp-backup/how-to/deactivate-cdp-backup/).

## What encryption covers

Encryption protects the recovery points stored on E2E's backup servers, not the files on the
running node. To encrypt a volume, choose encryption when you create it; see [Encrypt a volume](/myaccount/volumes/how-to/encrypt-a-volume/).