BORG-KEY-EXPORT-RELATED-SECRETS(1)

📦 version 1.4.5, in alpine 3.24, arch rolling, ubuntu stonking

okay bestie, gather round, because this little page from the borg backup tool manual is genuinely one of the cutest tricks in the whole toolbox. the manual name is borg-key-export-related-secrets — say it three times fast, i dare you — and it's all about exporting secrets so you can build related repositories. yes, secrets. like gossip but for dedup metadata. 🫶

✨ NAME ✨

borg-key-export-related-secrets — export secrets for creating related repositories 🎀

🌸 SYNOPSIS 🌸

borg [common options] key export-related-secrets [options] [REPOSITORY] [PATH]

🦋 DESCRIPTION 🦋

so like. this command exports the deduplication secrets — that's id_key and chunk_seed, the iconic duo — out of a repository. and then you can use those secrets to initialize a related repository. slay.

related repositories share the same deduplication metadata but have their own independent encryption keys. it's giving "we're matching but we're not the same person." this is useful for:

  1. creating independent backup targets that still benefit from being "compatible" for future archive transfers. lowkey genius.
  2. preparing for a migration to Borg 2.0, where archives can be transferred between related repositories using borg transfer. main character energy honestly.

the exported secrets are stored in a JSON file. now listen — this file contains sensitive information and should be deleted immediately after usage. immediately. not "after i finish my snack." immediately. 🙈

Examples:

# Export secrets from an existing repository
$ borg key export-related-secrets /path/to/repo1 secrets.json

# Initialize a new related repository using these secrets
$ borg init --import-related-secrets=secrets.json --encryption=repokey /path/to/repo2
$ rm secrets.json
Important: when you're initializing a related repository using borg init --import-related-secrets, the new repository must use the same ID hash algorithm as the original repository — so it's either both HMAC-SHA256 or both BLAKE2. no mixing, bestie, this is not a smoothie. 🍓 - HMAC-SHA256: repokey, keyfile, authenticated - BLAKE2: repokey-blake2, keyfile-blake2, authenticated-blake2
Warning: please note that future Borg 2.0 versions might remove support for BLAKE2 in new repositories (see #8867). so like... enjoy it while it's here 💀

💅 OPTIONS 💅

see borg-common(1) for common options of Borg commands. that's where all the shared stuff lives, go say hi.

🎀 arguments 🎀

  • REPOSITORY — the repo you're pulling the secrets out of, bestie
  • PATH — where to store the secrets ✨

🌈 SEE ALSO 🌈

borg-common(1)

👑 Author 👑

The Borg Collective

and that's the whole page fr fr 💜 this was borg-key-export-related-secrets(1) from the borg backup tool, dated 2026-07-18. now go delete that JSON file. i'm watching. 👀✨

📦 where this page comes from