Home Assistant’s SecureTar v3 improves encryption for new backups. A recoverable archive still needs the right key and an accessible copy.

The project announced the change on March 26, ahead of the 2026.4 release. For a household running lights, sensors and routines through Home Assistant, the practical benefit is protecting the configuration without losing the ability to rebuild it.

A backup contains more than a layout you spent an evening arranging. It can include sensitive configuration and credentials that deserve careful handling.

New protection does not rewrite an old archive

The announcement describes stronger password-to-key processing and authenticated encryption, which aims to protect both confidentiality and integrity. New encrypted backups created with the updated format receive those protections; existing archives are not silently rewritten.

Do not read that as proof every old backup was easy to break. The project distinguishes weak, manually chosen passwords from its generated high-entropy passphrases. The relevant decision is how to create and retain suitable new backups, not whether to panic about every archive already kept.

Home Assistant says the Open Home Foundation funded a focused Trail of Bits assessment and follow-up fixes. The assessor’s published artifact is linked publicly, but its PDF contents could not be retrieved for this article. The project’s account of the review is therefore attributed, not presented as our independent inspection or a guarantee that every security risk is gone.

Check three things before the system fails

First, keep the recovery information available independently of the running installation. Home Assistant’s current backup instructions identify an emergency kit containing the encryption key needed for restoration.

Second, keep a usable archive somewhere other than only the device whose failure would trigger the restore. A file on a failed controller is an awkward definition of a recovery plan. Confirm the chosen storage actually receives the backup and does not merely show an enabled option.

Third, understand the copy you export. The documentation says a download through the Home Assistant backup page can be decrypted on the fly. Do not assume a file remains encrypted just because the stored original was encrypted. Check the export route before placing a copy on shared or less-protected storage.

CISA’s backup guidance recommends offline encrypted copies and testing recovery. That is a general security baseline, not an endorsement or audit of Home Assistant’s implementation.

A green backup status cannot prove a restore

Imagine a hypothetical household whose controller fails after months of successful scheduled backups. The archive exists, but the only saved key was on the failed machine. The schedule succeeded; the recovery arrangement did not.

A planned restore exercise on a separate suitable target can reveal that problem before a real outage. Follow the supported procedure, retain the live installation and check that the restored configuration contains what the household needs. This article did not perform that exercise and does not provide a destructive migration recipe.

The check should include access to the storage, the appropriate key and the dependencies needed after restoration. Protecting the archive and being able to use it are complementary goals. Neither can stand in for the other.

Home Assistant users retain more responsibility for their configuration than someone treating a cloud account as the entire home system. That responsibility can support privacy and flexibility when it is understandable. It becomes a burden if one technically inclined person is the only household member who knows how recovery works.

Write down enough for another trusted person to locate the recovery material and the supported instructions. An encrypted backup is most useful when it protects the household’s data and gives the household a credible way to return to normal operation.

Frequently Asked Questions

Will an update automatically convert my old backups?

No. The announcement distinguishes newly created backups from existing archives.

What else does restoration need besides a completed backup?

Access to the archive, the correct key and a suitable restore environment still need confirmation.

Is every downloaded backup still encrypted?

Do not assume so. The current documentation describes on-the-fly decryption through a backup-page download route.

Did this article independently review the full security audit?

No. It verifies the project’s announcement and current instructions; the linked assessor PDF contents were unavailable.