Offsite Backup Manager: Understanding and Protecting Your Backup Encryption Keys

Following the recent Offsite 2026 OBM security vulnerabilities, we recommend that all existing Webvault Offsite Backup Manager customers review their encryption keys and consider establishing new backups using fresh encryption keys.

This article explains how to locate your existing encryption keys, preserve access to historical backups, and understand the options available for updating your backup encryption.

1. Understanding Account Passwords and Encryption Keys

Webvault Offsite Backup Manager uses two different types of credentials.

Account Password

Your account password is used to sign in to Webvault Offsite Backup Manager and authenticate with the backup server.  You can change this password without changing your existing backup encryption keys.

Backup Encryption Key

Your backup encryption key protects the actual contents of your backed-up files. Each backup set can have its own encryption key, which is established when the backup set is originally created.

Changing your account password does not change the encryption keys associated with existing backups.

This distinction is particularly important for customers who have used the office backup manager service for several years.

2. Why Your Previous Passwords May Still Be Important

Older versions of the software used by Offsite Backup Manager supported using the account password as the backup encryption key.

Before version 7.3, the default encryption configuration used the account password. From version 7.3 onwards, the software changed the default to generate a separate, random encryption key.  However, password-based encryption remained available as an option.

This means some customers may have backup sets that still use an account password from several years ago as their encryption key.

For example:

Although the account password has been changed several times, the original encryption key remains unchanged.

Important: Do not discard previous passwords that may have been used to encrypt historical backups.

These passwords should no longer be used for account authentication, but they may still be required to recover historical backup data.  Store them securely in a password manager or another protected location.

3. How to Find Your Existing Backup Encryption Keys

You can view the encryption key associated with each backup set using the Webvault Offsite Backup Manager application installed on your computer or server.

Step 1: Open Offsite Backup Manager

Launch the backup application and sign in to your account.

Step 2: Select Your Backup Set

1. Click Backup Sets on the main screen.

2. Select the backup set you wish to review.

3. If using an older version of the software, click Show advanced settings.

Step 3: Locate the Encryption Settings

1. Select Others from the backup set settings.

2. Scroll to the Encryption section.

3. Click Unmask encryption key to display the encryption key associated with the backup set.

The application will display the existing encryption key.

Step 4: Securely Save Your Encryption Key

Carefully copy the encryption key and store it somewhere secure.

We recommend using a password manager.

For each encryption key, record:

• Your Webvault backup account username.

• The name of the backup set.

• The encryption key associated with that backup set.

• The computer or server associated with the backup, where applicable.

If you have multiple backup sets, repeat this process for each one.

Different backup sets may use different encryption keys, even when they belong to the same backup account.

Important Precautions

Do not:

• Delete an existing backup set while reviewing its encryption settings.

• Change or remove any backup configuration unnecessarily.

• Store encryption keys in unprotected text files.

• Email encryption keys or passwords to other people using ordinary email.

• Assume that changing your account password has changed your encryption keys.

If you cannot locate your encryption key, contact Webvault Support before making changes to your backup installation.

4. Why You Should Preserve Your Encryption Keys

Your encryption keys may be required if you need to:

• Restore files onto another computer or server.

• Reinstall Webvault Offsite Backup Manager.

• Recover backups following a computer failure.

• Access historical backups created using previous versions of the software.

• Restore data after moving to a replacement computer.

The backup application may retain encryption information locally, allowing backups and restores to operate without repeatedly requesting the key.

However, this information may no longer be available if your computer fails, the application is removed, or its configuration is lost.

Without the correct encryption key, recovering your backed-up data may be impossible.

Although Ahsay provides encryption key recovery capabilities for some configurations, these should not be relied upon as a substitute for securely retaining your own keys.

We strongly recommend keeping a secure copy of every backup set's encryption key, independently of the computer being backed up.

5. Can I Change My Existing Backup Encryption Key?

Unlike an account password, the encryption key associated with an existing backup set cannot be changed directly.

The encryption key is established when the backup set is created.

These settings remain associated with that backup set throughout its lifetime.

For example, changing an account password does not:

• Generate a new encryption key for an existing backup set.

• Re-encrypt previously backed-up files.

• Replace the encryption key protecting historical backup data.

To begin using a different encryption key, you must create a new backup set with new encryption settings.

6. How to Begin Using New Encryption Keys

To replace the encryption key used for ongoing backups, a new backup set must be created.

For example:

Depending on the amount of data involved, this may require:

• Additional backup storage capacity.

• Additional internet bandwidth.

• Time to complete the initial backup.

• Changes to your existing backup schedules.

Once your new backup set has been successfully completed and verified through a test restore, you should continue running it until you have established a satisfactory history of recovery points that meets your backup retention requirements.

At that point, you should delete your original backup set job.  This is an important security measure because the original backups may be protected by encryption keys that could have been exposed during the security incident and if you leave the old backup in place you will use additional account storage.

Read Further to Refresh Your Encryption Keys: Offsite Backup Manager: Replacing Your Backup Sets with New Encryption Keys

7. Recommended Actions for Existing Customers

We recommend that all existing Offsite Backup Manager customers complete the following:

1. Locate your encryption keys. Review each existing backup set and securely record its encryption key.

2. Preserve historical passwords. Retain previous account passwords that may have been used for backup encryption.

3. Change your account password. Follow our guide Offsite Backup Manager: Changing Your Account Password.

4. Consider replacing your existing backup sets with new encryption keys: Offsite Backup Manager: Replacing Your Backup Sets with New Encryption Keys

5. Verify your backups. Confirm your scheduled backups continue operating and periodically test restoring important files.

Need Assistance?

If you are unsure how to locate your encryption keys, whether your historical passwords are still required, or how to establish new backups with fresh encryption keys, please contact Webvault Support via email support@webvault.com.au or call 1300 139 927