How to Back Up n8n Properly: Database, Encryption Key and a Restore Test

Short on time? The n8n Production Self-Hosting Kit ($29) is the finished, tested version of what this tutorial builds.

The most common n8n disaster isn't a crashed server. It's discovering, after the crash, that the backup can't restore the credentials. Here's what a real backup needs, and the commands we tested.

What you must back up

1. The database (Postgres). It holds workflows, credentials (encrypted), users, variables and execution history.
2. The encryption key (N8N_ENCRYPTION_KEY in your .env, or /home/node/.n8n/config if you never set one). Without it, the credentials in the database are unreadable.
3. The n8n data folder (/home/node/.n8n). It holds binary data, community nodes and settings.

A workflow JSON export alone is not a backup. Exports don't include decryptable credentials, users or history.

Back up (Docker Compose + Postgres)

From the folder with your docker-compose.yml:

docker compose exec -T postgres pg_dump -U n8n -d n8n -Fc > n8n-db.dump
docker compose exec -T n8n tar -czf - -C /home/node/.n8n . > n8n-data.tar.gz

Store both files off the server, for example with rclone to Backblaze B2 or S3. Store the encryption key separately, in your password manager. If you keep the key next to the backup, encrypt the whole archive.

Restore

docker compose stop n8n
docker compose exec -T postgres psql -U n8n -d postgres \
  -c 'DROP DATABASE n8n WITH (FORCE);' -c 'CREATE DATABASE n8n OWNER n8n;'
docker compose exec -T postgres pg_restore --no-owner --role=n8n -U n8n -d n8n < n8n-db.dump
docker compose start n8n

Make sure .env contains the original encryption key before you start n8n.

Prove it: the restore test

A backup you have never restored is a hope. After restoring, check that workflows are back and that credentials decrypt:

docker compose exec n8n n8n list:workflow
docker compose exec n8n n8n export:credentials --all --decrypted --output=/tmp/c.json
docker compose exec n8n rm /tmp/c.json      # contains secrets: delete it right away

If the export fails with a decryption error, the key doesn't match. Better to find out now than during an outage.

Check the key before you restore, without writing decrypted secrets to disk: the free n8n-key-check CLI tests a key against a normal (encrypted) credentials export, a backup folder or database.sqlite. It prints only match / no match, and --keys old.env tells you which of several candidate keys is the right one.

docker compose exec n8n n8n export:credentials --all --output=/tmp/creds.json
docker compose cp n8n:/tmp/creds.json ./creds.json
N8N_ENCRYPTION_KEY='the-key-you-will-restore-with' npx github:onyxaholguin-cyber/n8n-key-check creds.json

We ran exactly these commands on n8n 2.40.6 with Postgres 17. All workflows came back and 5 of 5 test credentials decrypted.

Do the drill on a copy, not on production. Use a second Compose project (docker compose -p n8n-drill ...) without published ports, restore into it, check, and delete it.

How often?

• Nightly database + data backups, with 14–30 days retention.
• A restore drill once a month and before every upgrade.
• An alert when a backup fails. A cron job that silently stopped in March helps nobody.

Done-for-you version

The n8n Production Self-Hosting Kit automates all of this:

• Backups: encrypted archives with checksums and a key fingerprint, off-site copies, retention and failure pings.
• Restores: restore.sh refuses to restore with the wrong key.
• Monthly drill: restore-drill.sh restores into a throwaway stack and prints DRILL PASSED only if every credential decrypts.

For nightly Git backups of your workflows, see the n8n Reliability Workflow Pack.

Not affiliated with n8n GmbH.

Free tool: n8n Workflow Checker: Pasted Secrets, Open Webhooks, Silent Failures

Written with AI assistance. Every formula, command and number on this page was tested before publishing (see each section). Product links go to our store.