Recovery Tools (Downloads)

The recovery tools are standalone programs that ship with your instance and are published here as well, with no login, no account and no purchase. Every one of them is needed at exactly the moment your server is gone, so a copy that lives only on that server is not a recovery tool.

Download These Before You Need Them

Nothing here is secret. The Recovery Kit is inert without your trustees’ shares, and the Backup Decryptor is open code you can read end to end. They are deliberately not behind a sign-in: in a real disaster your identity provider may be part of what is down, and a recovery tool you have to authenticate to reach is one you cannot reach. Download them now, before you need them, and keep a copy somewhere that is not your instance.

Before you use a downloaded file, check that its SHA-256 hash matches the one printed on its card below. Do this every time, and especially for the Recovery Kit. It reconstructs a private key in plaintext by design, which makes a tampered copy the highest-value target in this product: a malicious version would work perfectly, reconstruct your key correctly, and quietly send it somewhere. The published SHA-256 is the only thing that tells the two apart.

Your own instance prints the same value for the Recovery Kit, in every trustee’s printed instructions. That is the point of publishing it here too: a file that vouches for itself proves nothing, and two independent places agreeing is what makes the check worth doing. If they ever disagree, stop and contact us — do not use the file. The command that prints a file’s hash on macOS, Linux and Windows is in the technical part, under Check The Hash Before You Trust The File.

The Tools

Offline Recovery Kit

zonitix-key-recovery.html

The disaster it is for: Your instance is gone, or we are unreachable, and an escrowed key has to be reconstructed.
What it is: A single self-contained HTML file. Trustees each open their sealed share in it and recombine the threshold — any 2 of the 3 that the Key escrow screen issues — back into the original key. It has zero external references, uses only what the browser already has built in, and works with the network cable pulled. It will still work in ten years, on a laptop that has never heard of us.
When you would reach for it: Open it from local disk, on a machine that is offline. It reconstructs a private key in plaintext, by design — that is the whole job — so it is not a thing to run on a page loaded from the internet.

Download zonitix-key-recovery.html

22.7 KB

SHA-256

a07dea21341d426d8a94ed2b5cf8c8c3981c8e8f3063781bc27b159edb3e5e4c

Backup Decryptor

backup-decrypt.js

The disaster it is for: Total box loss. You have your off-site backups and nothing to open them with.
What it is: Everything sent off your server — logical dumps, base tarballs, WAL segments — is encrypted. The app decrypts it for you, but after total loss there is no app. This is that missing half: a command-line program that decrypts a single object or a whole directory, with a self-test command that proves itself before you need it.
When you would reach for it: This is the sharpest case for publishing here. It is the tool you go looking for after the server it used to live on has stopped existing.

Download backup-decrypt.js

32.1 KB

SHA-256

4a28938d1253031bb9efa21c935cbbfaad042294cecc3df457490e0a72ea8a07

A Rehearsal Is The Only Proof

Recovery you have never rehearsed is a hope, not a plan. Both tools are safe to try on a day when nothing is wrong: the Backup Decryptor has a self-test command that proves itself against data it generates, and the Recovery Kit can be opened offline and read without any share loaded. Doing that once, now, is worth more than anything on this page.

Background on what is escrowed and why is under Key Escrow & Recovery.

If something here is not working as you expect, start with When something goes wrong.

The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.

The Recovery Kit uses only the browser’s own crypto.subtle. Everything sent off your server is AES-256-GCM ciphertext, and the Backup Decryptor is a zero-dependency Node CLI.

The rehearsal described above, under A Rehearsal Is The Only Proof, uses one command for the Backup Decryptor: backup-decrypt.js selftest.

Check The Hash Before You Trust The File

These commands print a file’s SHA-256 hash. Why the check matters is in the plain part above, under Download These Before You Need Them.

Compare the output with the hash on the tool’s card above

# macOS
shasum -a 256 zonitix-key-recovery.html

# Linux
sha256sum zonitix-key-recovery.html

# Windows (PowerShell or cmd)
certutil -hashfile zonitix-key-recovery.html SHA256

Related reference

Key Escrow & Recovery

API Authentication