Back up your key today

tovio key export backup.key --passphrase-file pass.txt

Exports your root device secret to a portable file, encrypted with AES-256-GCM under a key derived from your passphrase by Argon2id. The salt and cost parameters travel inside the backup, so a future release can still open it.

Why this article is urgent

Protected content is encrypted to your key. If the key is gone, the content is gone — not locked, gone. There is no support path, no reset link, no administrative override. That is the property the whole product provides, and it cuts both ways.

A keychain is not a backup. It does not survive reinstalling an OS, a dead disk, or a wiped laptop.

The passphrase must come from a file

There is no --passphrase flag and no environment variable. A passphrase on a command line lands in shell history and the process table; requiring a file removes that failure mode rather than warning about it. The file's trailing newline is stripped for you.

Doing it properly

1. Export with a strong passphrase.
2. Store the backup somewhere that survives the machine dying — a password manager, an encrypted drive kept elsewhere.
3. Store the passphrase separately. Both in one place is one thing to lose.
4. Delete the passphrase file from the working machine once you are done.
5. Test the restore on another machine. An untested backup is a belief, not a backup.

tovio key import backup.key --passphrase-file pass.txt

Import restores the same identity and re-seals it into that machine's keychain. It refuses with TVO-KEY-003 if the backup belongs to a different identity than the repository already has — the wrong-backup mistake fails loudly instead of replacing your identity.

There is a second artefact, and it is not this one

Your recovery phrase, generated at tovio init, is a separate escrow that covers the case where the key itself is lost rather than the machine. Back up both. See I lost my key — that article is also where to look if you never noticed the phrase.

For teams

Make this part of onboarding. The failure arrives months later, and by then the person has real work only they can decrypt.