Set a Unique Encryption Key and Back It Up

n8n encrypts every stored credential with the N8N_ENCRYPTION_KEY environment variable. If you do not set one, n8n generates a random key on first startup and writes it inside the .n8n directory; lose that key and every credential becomes permanently unrecoverable. Always set the key explicitly, and back it up in at least two secure locations.

What is the n8n encryption key?

n8n encrypts all stored credentials (API keys, OAuth tokens, database passwords) using the N8N_ENCRYPTION_KEY environment variable. If you do not set one, n8n generates a random key on first startup and stores it in ~/.n8n/.n8n-config. If you lose this key -- by rebuilding a Docker container without persisting the volume, for example -- every stored credential becomes permanently unrecoverable.

Real-world example: A team rebuilds their n8n Docker container after a host migration. They preserved the database but not the .n8n directory. All 47 workflow credentials now decrypt to garbage. Every API key, OAuth connection, and database password must be re-entered manually.

How do you set the encryption key?

# Generate a strong encryption key (run once, save forever)

openssl rand -hex 32

# Output example: a1b2c3d4e5f6...64 hex characters

# Set in .env

N8N_ENCRYPTION_KEY=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2

# docker-compose.yml

services:
  n8n:
    image: n8nio/n8n:latest
    environment:
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
    volumes:
      # Also persist the .n8n directory as a secondary safeguard

      - n8n_data:/home/node/.n8n

How do you back up and rotate the key?

Back up the encryption key in at least two secure locations:

Storage Location	Example
Password manager	1Password, Bitwarden vault shared with ops team
Cloud secrets manager	AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault
Offline backup	Encrypted USB drive in a physical safe

Danger: Key Rotation n8n does not natively support encryption key rotation. Changing the key after credentials have been saved will make all existing credentials unreadable. If you must rotate, export all workflows, re-create the instance with the new key, import workflows, and re-enter every credential.

Related: Use Docker Compose with Health Checks for n8n and PostgreSQL · Use Path Parameters in Webhook URLs for Dynamic Routing