Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Home Assistant’s backup-encryption upgrade is no longer merely planned. SecureTar v3 shipped with Home Assistant 2026.4 on April 1, 2026. New encrypted backups created after the update use the modernized format, while older backups remain restorable with their original encryption keys.
For most users, there is no need to recreate every historical backup. The important actions are to update Home Assistant, download and securely store the backup emergency kit, preserve older keys if you rotate them, and replace any short password used for command-line or automation-created backups.
As an Amazon Associate I earn from qualifying purchases.
What changed in Home Assistant backup encryption?
Home Assistant announced SecureTar v3 on March 26, 2026, describing it as a purpose-built format and library for password-protected backups. It became available with the 2026.4 release.
This is a broader cryptographic redesign, not simply a switch to “stronger AES.” SecureTar v3 uses:
Popular on Amazon
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
- Argon2id for password-based key derivation, making password guessing substantially more expensive than simpler legacy approaches.
- XChaCha20-Poly1305 authenticated encryption through libsodium’s
secretstreamAPI, exposed through PyNaCl. - Separate subkeys for backup parts.
- Stronger parsing behavior intended to prevent corrupted data from silently falling back to a legacy protocol.
- Build-security improvements, including pinned GitHub Actions commits and narrower workflow permissions.
Home Assistant’s technical summary lists a 256-bit key size for the new design. Earlier v1 and v2 encrypted formats used an AES-128 variant with simpler key derivation.
The project also says a focused Trail of Bits security assessment found three issues: two informational findings involving timing validation and malformed-header fallback, and one medium-severity supply-chain issue involving unpinned GitHub Actions and broad permissions. Home Assistant says all three were fixed and that a follow-up review confirmed the fixes. That is evidence about the audited SecureTar work—not a guarantee that the entire backup architecture is immune to future vulnerabilities.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Read Home Assistant’s announcement and technical explanation.
When did SecureTar v3 become effective?
The announcement was published on March 26, 2026. SecureTar v3 rolled out with Home Assistant 2026.4, released April 1, 2026. The 2026.4.1 changelog also lists SecureTar-related updates, including a version bump and a fix for encrypted-backup size calculation.
The practical rule is simple: new encrypted backups created after updating to 2026.4 use the newer format. The exact behavior of individual storage services can still involve separate service-specific encryption documentation, particularly for Home Assistant Cloud.
Also popular on Amazon
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
Do existing Home Assistant backups need to be recreated?
No. Home Assistant says backups made before the upgrade remain readable. They continue to depend on the encryption format and key that were used when they were created.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Backup | Key required | What to do |
|---|---|---|
| Created before 2026.4 | The previous key | Keep the old emergency kit securely stored. |
| Created after updating to 2026.4 or later | The current key | Download and store the current emergency kit. |
| Created with a weak manually selected password | That password | Replace the password and create a new backup. |
| Key lost while the Home Assistant instance is inaccessible | No documented recovery path | Treat the encrypted backup as unrecoverable. |
Changing the current encryption key does not retroactively re-encrypt older backups. A new key unlocks future backups; older files still require the earlier key.
What should users do now?
- Update Home Assistant to a current release that includes the 2026.4 changes.
- Create a fresh backup before or immediately after the upgrade.
- Open Settings → System → Backups and download the backup emergency kit.
- Store the emergency kit outside the Home Assistant machine—for example, in a secure password manager or another protected location.
- Confirm that automatic backups still run and that each configured backup location receives the new file.
- Keep the old emergency kit if older encrypted backups are still being retained.
- For an important or safety-related installation, perform a test restore rather than assuming the backup is usable.
A test restore is especially worthwhile after changing hardware, moving installations, changing storage providers, or relying on backups for a business or rental property.
How to change the encryption key safely
Home Assistant’s documented path is:
Settings → System → Backups → Configure automatic backups → Encryption key → Change
Before selecting the change option:
- Download the current emergency kit.
- Store the old key separately from the Home Assistant device.
- Generate or save the new key.
- Label the keys with dates or backup generations.
- Do not delete older keys while backups made with them still matter.
Key rotation is not mandatory for everyone. It is most useful if the old key may have been exposed, was stored insecurely, or was based on a short or predictable password.
Also popular on Amazon
- 5 sets of code: Python (compatible with 2&3), C, Java, Scratch and Processing (Scratch and Processing code provide graphical interfaces)
- Detailed tutorial: Can be downloaded (in English, 962-page in total) or viewed online (original in English, can be translated into other languages by browsers) (The tutorial link can be found on the product box, no paper tutorial)
- 128 projects from simple to complex: Provides step-by-step guide with electronics and components knowledge, each project has schematics, wiring diagrams, complete code and detailed explanations
- 223 items in total: This ultimate kit includes the most commonly used electronic components, modules, sensors, wires and other compatible items
- Compatible models: Raspberry Pi 5 / 500 / 400 / 4B / 3B+ / 3B / 3A+ / 2B / 1B+ / 1A+ / Zero 2 W / Zero W / Zero (NOT included in this kit)
What if a weak password was used?
Home Assistant’s automatically generated encryption passphrases were designed to have high entropy, so users who relied on the normal generated key are in a different position from users who manually supplied a short password.
Review backups created with the ha backup command or the hassio.backup_full and hassio.backup_partial actions. If a short, predictable, or reused password was supplied, choose a stronger replacement and create a new encrypted backup. Preserve the old password if the earlier backup may still be needed.
What does an encrypted backup protect?
A full Home Assistant backup can contain config, share, addons, ssl, and media. Depending on the installation and integrations, configuration data may include API keys, integration credentials, automations, and private information about the home.
SecureTar v3 is designed to protect confidentiality and detect tampering when someone obtains the encrypted archive without its key. It does not:
Recommended Free Tools
- protect a key stored beside the backup file;
- recover a lost key;
- protect an already compromised Home Assistant host or account;
- make an unencrypted downloaded copy safe;
- create additional backup copies or off-site redundancy; or
- prevent an administrator with access to the running system from viewing configuration secrets.
For broader protection, follow Home Assistant’s guidance on strong unique account passwords, multifactor authentication, updates, and secure remote access: Securing Home Assistant.
Also popular on Amazon
- The Raspberry Pi Raphael Starter Kit for Beginners: The kit offers a rich learning experience for beginners aged 10+. With 337+ components, 161 projects, and 70+ expert-led video lessons, this kit makes learning Raspberry Pi programming and IoT engaging and accessible. Compatible with Raspberry Pi 5/4B/3B+/3B/Zero 2 W /400, RoHS Compliant
- Expert-Guided Video Lessons: The Raspberry Pi Kit includes 70+ video tutorials by the renowned educator, Paul McWhorter. His engaging style simplifies complex concepts, ensuring an effective learning experience in Raspberry Pi programming
- Wide Range of Hardware: The Raspberry Pi 5 Kit includes a diverse array of components like Camera, Speaker, sensors, actuators, LEDs, LCDs, and more, enabling you to experiment and create a variety of projects with the Raspberry Pi
- Supports Multiple Languages: The Raspberry Pi 4 Kit offers versatility with support for 5 programming languages - Python, C, Java, Node.js and Scratch, providing a diverse programming learning experience
- Dedicated Support: Benefit from our ongoing assistance, including a community forum and timely technical help for a seamless learning experience
Do not confuse encryption with backup resilience
An encrypted file stored only on the same disk as Home Assistant can still disappear through disk failure, theft, corruption, fire, ransomware, or a failed migration. Encryption protects the contents; it does not provide redundancy.
A sensible arrangement keeps multiple copies, includes at least one copy outside the Home Assistant device, and ideally keeps one copy off-site. Retention matters too: Home Assistant Cloud documentation currently describes one Cloud backup of up to 5 GB, so users who need several historical restore points should verify whether that limit meets their needs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Local, NAS, cloud, and object-storage options
Home Assistant supports local storage and backup-location integrations. The 2026.4 release coverage lists upload-progress support for Home Assistant Cloud, WebDAV, Google Drive, OneDrive, OneDrive for Business, S3-compatible integrations, and the built-in Supervisor backup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Home Assistant Cloud: the simplest hosted option for users who want off-site storage and do not want to manage a separate service. It is optional; Home Assistant itself remains free and open source. Cloud backup is documented as included for subscribers, with one backup up to 5 GB and no additional backup charge.
- NAS or WebDAV: useful for local control and multiple retained copies, but a NAS in the same building is not protection against theft, fire, or other site-wide events.
- Google Drive or OneDrive: convenient if an existing account and ecosystem are already trusted. Check retention and account-recovery arrangements.
- S3-compatible storage: suitable for technical users who can manage buckets, access policies, retention, and billing. Home Assistant’s release coverage names AWS S3, iDrive e2, and Cloudflare R2 among compatible options.
Cloud-specific documentation deserves careful reading. Home Assistant’s emergency-kit page describes Cloud backups as always encrypted and uses AES-128 wording, while the SecureTar v3 announcement describes the newer format for encrypted backups created after the 2026.4 update. The available official pages do not clearly establish whether every Cloud-stored backup uses SecureTar v3 internally or whether the Cloud service retains a separate encryption layer. Do not treat those descriptions as proof of one universal algorithm across every storage path.
Also be careful when downloading backups through the Home Assistant interface. Home Assistant’s 2025.2 documentation says a downloaded backup can be decrypted on the fly and saved as an unencrypted archive, even when the remote copy is encrypted. Protect or delete that local copy when it is no longer needed.
Also popular on Amazon
- Pi5 8GB Pack: RasTech Pi 5 8GB kit includes 1 x Pi5 8GB board ,1 x 64GB Card, 2 x Card Readers,1 x Active Cooler,1 x Case for Pi5, 2 x 4K Micro HD Out Cable,1 x GaN 27W 5A USB-C Power supply,1 x Screwdriver and 1 x instructions.
- Pi5 8GB Board: The Pi5 board is equipped with a 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz and an 800MHz VideoCore VII GPU with support for OpenGL ES 3.1 and Vulkan 1.2, which delivers a significant increase in graphics performance. Dual HD Out 4Kp60 display outputs and a built-in dual 4-channel MIPI camera/display transceiver provide state-of-the-art camera support. The Pi 5 offers a 2-3 times increase in CPU performance compare to Pi4.
- Important Graphics Features: Equipped with an 800MHz VideoCore VII GPU and providing better graphics performance, suitable for multimedia applications,gaming,and graphics intensive tasks.Provides 1 UART interface,1 card slot that supports high-speed operation, 2 USB. 3 0.5 ports that support synchronous 0Gbps operation,2 USB 2.0 port ports,2 4Kp60 display outputs that support HDR.Built-in dedicated dual 4-channel 1Gbps MIPI DSI/CSI connectors,triple the total bandwidth.
- Cooling Kit for Pi 5: Compatible with Active Cooler for Raspberry Pi5, It can provide Pi 5 board with better cooling effect in using. The Case can accurately access usb-c power jack,Micro HD Out ports, usb ports, Ethernet jack, card slot, power button, 4-lane MIPI DSI/CSI connectors and so on, and it also supports installation of cooling fan.
- 64GB Card Kit and GaN 27W USB-C Power Supply: With extra 64GB card to store more files and card readers for multiple medium, keep better performance for Raspberry Pi 5, 27W USB C Power Supply is Compatible with Pi5 8GB, offers a variety of output voltage options, including 5.1V at 5A, 9.0V at 3.0A, 12.0V at 2.25A, and 15.0V at 1.8A, providing for different device requirements.
The most serious failure: losing the key
The emergency kit is not optional paperwork. If the relevant key is lost and the Home Assistant instance is no longer accessible, Home Assistant says the encrypted backup cannot be restored. Nabu Casa does not retain users’ encryption keys and cannot decrypt a backup whose key has been lost.
Download the key while the instance is accessible, store it separately, and document which key belongs to which backup period. Never assume that a newly generated key can unlock historical files.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Is Home Assistant Cloud required for SecureTar v3?
No. SecureTar v3 is a software change in Home Assistant 2026.4, not a requirement to subscribe to Home Assistant Cloud or buy Home Assistant hardware. Users can continue using local storage or supported third-party destinations.
Cloud is an optional Nabu Casa service that adds hosted features such as remote access and voice-assistant integrations. Home Assistant Green is an optional plug-and-play hardware choice, not a prerequisite for the encryption upgrade.
What this means for automatic backups
Automatic, NAS, cloud, and command-line users should all check their workflows after upgrading. The encryption format changes when new encrypted backups are created, but the operational risks remain the same:
- an automation may still be using a weak manually supplied password;
- a storage integration may authenticate successfully but fail to upload;
- a local-only backup may not survive loss of the host; and
- a scheduled backup may exist without a separately preserved key.
After updating, create a new backup, verify it appears in the Home Assistant backup interface, check the destination, and confirm that the relevant key is available outside the device.
Bottom line
Home Assistant 2026.4 made SecureTar v3 live, bringing Argon2id, XChaCha20-Poly1305 authenticated encryption, safer parsing, and build-security improvements to newly created encrypted backups. Older backups do not need automatic migration, but they still depend on their original keys.
The safest migration is straightforward: update, create a fresh backup, save the emergency kit separately, preserve every old key, replace weak custom passwords, and keep more than one copy in more than one place. Encryption is an important layer—but it is not a substitute for redundancy and a tested restore.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
