Set a Unique Encryption Key and Back It Up

n8n encrypts all stored credentials (API keys, OAuth tokens, database passwords) using the N8N_ENCRYPTION_KEY environment variable. If you do not set one, n8n generates a random key on first startup and stores it in ~/.n8n/.n8n-config. If you lose this key -- by rebuilding a Docker container without persisting the volume, for example -- every stored credential becomes permanently unrecoverable.

Real-world example: A team rebuilds their n8n Docker container after a host migration. They preserved the database but not the .n8n directory. All 47 workflow credentials now decrypt to garbage. Every API key, OAuth connection, and database password must be re-entered manually.

# Generate a strong encryption key (run once, save forever)

openssl rand -hex 32

# Output example: a1b2c3d4e5f6...64 hex characters

# Set in .env

N8N_ENCRYPTION_KEY=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
```text
```yaml

# docker-compose.yml

services:
  n8n:
    image: n8nio/n8n:latest
    environment:
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
    volumes:
      # Also persist the .n8n directory as a secondary safeguard

      - n8n_data:/home/node/.n8n
```text
Back up the encryption key in at least two secure locations:

| Storage Location | Example |
|:----------------|:--------|
| Password manager | 1Password, Bitwarden vault shared with ops team |
| Cloud secrets manager | AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault |
| Offline backup | Encrypted USB drive in a physical safe |

> **Danger: Key Rotation**
>
> n8n does not natively support encryption key rotation. Changing the key after credentials have been saved will make all existing credentials unreadable. If you must rotate, export all workflows, re-create the instance with the new key, import workflows, and re-enter every credential.

**Related:** [Use Docker Compose with Health Checks for n8n and PostgreSQL](../self-hosting-operations/01-use-docker-compose-with-health-checks-for-n8n-and-postgresql.md) | [Use Path Parameters in Webhook URLs for Dynamic Routing](../webhook-mastery/01-use-path-parameters-in-webhook-urls-for-dynamic-routing.md)