How to back up n8n workflows and credentials, and the two things that break the restore.

Most guides stop at "export your workflows". Here is what my self-hosted n8n template saves every night, checked against the n8n docs:

What to save • The database (PostgreSQL here). Workflows, credentials and execution history live in it. The dump is kept only after it has been read back in full with pg_restore -f /dev/null. pg_restore --list only reads the table of contents. • The encryption key. n8n generates it on first launch and stores it in the ~/.n8n folder, unless you set N8N_ENCRYPTION_KEY. Credentials are encrypted with it. Restore the database with another key and you get "Credentials could not be decrypted", and only the original key fixes it. Put the key in a password manager on day one. • The ~/.n8n data folder, as a tarball next to the dump.

Only need the workflows? n8n export:workflow --backup --output=backups/latest/ writes one JSON file per workflow. export:credentials --decrypted writes every secret in plain text, so treat that file like a password.

Two restore surprises • The CLI import deactivates every imported workflow by default. A database restore doesn't: workflows come back active, and on a test server with internet access, schedules can send yesterday's emails again. That's why the restore drill in my template starts n8n with no internet access. • A backup you never restored is a hypothesis. Quick test on the restored copy: open one credential. If its fields load, the key matches.

What does your n8n backup cover today: the database, the key, or only exported JSON?