n8n backup: workflows, credentials and database

Short answer: a complete n8n backup has two parts: the data (the database, with workflows, credentials and executions) and the encryption key. Without the key, another installation cannot read the credentials from your backup.

What to include in the backup

• Workflows and credentials: they live in the database (SQLite by default, or PostgreSQL).
• Encryption key: it is stored in /home/node/.n8n/config, inside the n8n volume, or in the N8N_ENCRYPTION_KEY variable if you set one. Credentials are saved encrypted with it. See the n8n documentation on the encryption key.
• Local files, if your workflows read from or write to a mounted folder (such as ./local-files).

If the installation receiving the backup has a different key, reading the credentials fails with:

Credentials could not be decrypted. The likely reason is that a different "encryptionKey" was used to encrypt the data.

So set N8N_ENCRYPTION_KEY in your .env file and keep a copy somewhere safe outside the server, such as a password manager.

Option 1: export workflows and credentials with the CLI

This works with any database and produces JSON files, one per workflow and one per credential:

docker compose exec n8n sh -c "n8n export:workflow --backup --output=/home/node/.n8n/backup/workflows/ && n8n export:credentials --backup --output=/home/node/.n8n/backup/credentials/"
docker compose cp n8n:/home/node/.n8n/backup ./backup-$(date +%F)

--backup is shorthand for --all --pretty --separate. Credentials come out encrypted (the data field is ciphertext), so they still depend on the same key. The options are documented in the n8n CLI commands reference.

There is also --decrypted, which exports credentials in plain text. Use it only to migrate to an installation with a different key, and delete the file right afterwards: it holds readable passwords and tokens.

To restore on an installation with the same key:

docker compose cp ./backup-2026-10-13 n8n:/tmp/restore
docker compose exec n8n n8n import:workflow --separate --input=/tmp/restore/workflows/
docker compose exec n8n n8n import:credentials --separate --input=/tmp/restore/credentials/
docker compose restart n8n

Imported workflows arrive unpublished, even if they were active when exported. Publish the ones that need to stay active with n8n publish:workflow --id=<id>.

This backup does not include execution history. For everything, also back up the database.

Option 2: back up PostgreSQL with pg_dump

If you run n8n with PostgreSQL, one dump captures everything (workflows, credentials, executions and users) in a single file:

docker compose exec -T postgres pg_dump -U n8n -d n8n -Fc -f /tmp/n8n.dump
docker compose cp postgres:/tmp/n8n.dump ./n8n-$(date +%F).dump

For a fresh instance with a few workflows, the dump is under 1 MB. To restore on a new installation with the same N8N_ENCRYPTION_KEY:

docker compose up -d postgres
docker compose cp ./n8n-2026-10-13.dump postgres:/tmp/n8n.dump
docker compose exec -T postgres pg_restore -U n8n -d n8n --clean --if-exists /tmp/n8n.dump
docker compose up -d n8n

After the restore, published workflows respond again and credentials work, as long as the key is the same.

Option 3: copy the volume (SQLite)

With the default database (SQLite), the n8n volume contains the database and the key. Stop n8n first so you don’t copy the database in the middle of a write:

docker compose stop n8n
docker run --rm -v n8n_data:/data -v "$PWD":/backup alpine tar czf /backup/n8n-data-$(date +%F).tgz -C /data .
docker compose start n8n

The volume name usually carries the folder name as a prefix (for example n8n-compose_n8n_data). Check with docker volume ls.

How often, and where to store it

• Schedule the dump or export with cron (every night, for example) and delete old copies.
• Store it off the VPS. A backup on the same disk does not protect you from losing the server.
• Test the restore now and then on a separate machine. A backup you have never restored is just a hope.
• Back up before every update (see how to update n8n).

Frequently asked questions

What do I need to include in an n8n backup?

The database (with workflows, credentials and executions) and the encryption key. Without the same key, the credentials in the backup cannot be read.

How do I export all n8n workflows?

Run n8n export:workflow --backup --output=<folder>. The --backup flag is shorthand for --all --pretty --separate and writes one JSON file per workflow.

Are exported credentials in plain text?

No. By default they are exported encrypted with the installation key. The --decrypted option exports plain text and should be used only for a migration, deleting the file afterwards.

Do workflows come back active after an import?

No. Imported workflows arrive unpublished; publish the ones that must stay active with n8n publish:workflow --id=<id>.