Encrypt archives with AES-256

An archive contains the complete data of your website and, with an external destination, travels to third-party systems. The encryption converts the finished ZIP via AES-256-CBC into a file with the extension .zip.enc, which can only be opened again with the stored restore key.

Set the key, then switch on

1. In “Kakapo Backup”, open the item “Security” on the left under “Configuration”.
2. In the “Restore key” card, under “Set key”, enter a key with at least 12 characters — or copy the value from the “Suggestion” field, which is generated randomly and stored nowhere.
3. Save the key outside this website, for example in your password manager, and later check it against the “Fingerprint” shown.
4. Set the switch “I have saved the key outside this website”.
5. In the card above, switch on “Encrypt archives (AES-256)”.

• Without a stored key, the encryption cannot be switched on
• If OpenSSL is missing on the server, encryption is not possible; the status line in the panel tells you so
• Encrypted backups carry the “AES” badge in the list
• The fingerprint is the first 16 characters of the SHA-256 over the key

Two points that count in an emergency

The key sits in the database of this website — and that is exactly what is missing in the event of damage. A copy kept elsewhere is therefore not an optional extra but the precondition for outsourced archives to be readable at all. If the encryption is switched on and the confirmation is missing, the diagnosis in the “Status” area reports an error.