NyxBackup

Encryption and your keys

End to end, on your machine

Nyx Backup encrypts your files - their contents, names, and folder structure - on your machine with AES-256-GCM before anything leaves it. Your destination only ever holds encrypted blobs. We never receive your data or your keys, and could not read your backups if we were asked to.

How keys work

  • On first run, Nyx Backup generates a random 256-bit master key using your operating system’s secure random source.
  • The master key is stored in your operating system’s secure keychain (Windows Credential Manager, macOS Keychain, or the Linux secret service) so backups can run unattended, and it is locked in memory so it is never written to swap.
  • Each backup set gets its own subkey, derived from the master key. Sets are cryptographically independent from one another.
  • You are shown the master key once, as a recovery passphrase. Write it down.

If you lose the machine and the recovery passphrase, your backups cannot be decrypted by anyone - including us. That is the trade-off that makes the encryption real. Keep the recovery passphrase somewhere safe and separate.

The published format

The on-disk layout of everything Nyx Backup writes - packs, manifests, the encryption envelope, and key derivation - is documented in the Archive Format Specification and implemented independently by the open-source Recovery Tool. Your data is never locked in a proprietary black box; it stays recoverable for the long haul.

Integrity

Beyond confidentiality, Nyx Backup verifies that what came back is exactly what went out. Restores check each chunk against its cryptographic hash, and the app can run scheduled integrity audits that sample your backup, download it, and verify it end to end - so you find out about a bad backup before you need it, not during a recovery.

No phone-home

Your license is verified offline and there is no account. The only optional network traffic beyond your own storage is anonymous usage telemetry, which you can switch off in Settings, and an update check you can set to daily, weekly, monthly, or never.