HELP! Can't Extract tar.gz auto-Backups

Configuration
1

I recently updated to use the integrated HA backup scheme to external NAS, but now I realise I can’t extract the files!!

Backups files are e.g.;

Automatic_backup_2025.3.4_2025-03-26_03.00_00000979_meta.json
Automatic_backup_2025.3.4_2025-03-26_03.00_00000979.tar

I can extract the tar, no problem. But then files inside can’t be extracted. take homeassistant.tar.gz for example and test on the cmd line:

$ gzip -t homeassistant.tar.gz
gzip: homeassistant.tar.gz: not in gzip format

What the…

All my backups are like this. Can’t extract a single one. I see the size is more or less what I’d expect.

UPDATE:
so I discovered that this issue exists when I navigate to the backup directly on my NAS and extract the files from there. If I “download” the backup from the HA UI, and extract the downloaded file, everything is ok. What’s going on?

Is it perhaps the encryption?

2

tar -zxvf *.tar.gz

3

still the same:

$ tar -zxvf homeassistant.tar.gz 

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
4

Encryption?

5

Could be. But how then apply the de/encryption key?

6

You can’t. You have 2 solutions: disable encryption in settings to save your backup unencrypted or download backup from HA as HA decrypts the file before download

7

Suppose I have stored the encryption key as I should have, how can I apply it?

8

HA will ask for it if you want to restore your backup on a fresh install (as it does not know the key)

9

Understand that, but what does HA do under the hood? There must be an encrypt/decrypt program that I can use in a pipeline.

10

HA by default stores backup encrypted with the encryption key. When needed (you download a backup from HA or you restore on the same system) it decrypts the backup so you don’t have to. There is no official and available tool to decrypt backups.

If you want to decrypt backups by yourself, you can try one of those scripts:

https://janm321.github.io/decrypt-ha-backup/

11

I created a a simple shell script which uses gzip, tar, and openssl to decrypt backups. See Hassio-tar.sh - Decrypt Home Assistant backups with near-zero dependencies required

Edit: I added a section to my post explaining how encrypted backups work because the original poster asked the question.

1 Like
12

I have reviewed the source code and home assistant does not store the encrypted key with the backup. Only the salt is stored with each encrypted file inside of the Tar backup.

The salt paired with the AES key derives the IV (and the AES key is derived from the backup password). See my previous message where I provide a generic breakdown of how home assistant encrypts backups.

13

In case it helps, I just resolved this. The synology NAS backups would not open in Linux, with an unsupported file error.

I uploaded the tar back to HomeAssistant in the HA UI, then downloaded the backup again using the UI.

I could then open the re-downloaded tar and browse the files.