How does the backup passphrase work?
It must be strong, or the app refuses it. Nobody can recover a forgotten one, including us. Keeping it on the computer lets backups run by themselves.
The passphrase locks your backups, and only someone who has it can open them. Dictate Safe refuses a weak one. If you forget it, nobody can open your backups, including us.
#What it has to be
The meter under the passphrase checks five rules as you type:
- 12 or more characters
- A lowercase letter
- A capital letter
- A number
- A symbol, such as ! or -
Following the rules is not always enough, because the meter also judges how easy the passphrase is to guess. One built on a very common word or password is refused, even with symbols added, and runs like 1234, abcd or qwer, or repeated characters, count against it. The meter’s levels are Too weak, Weak, Fair, Strong and Very strong, and a backup can only be made at Fair or better. The app’s own advice: “Mixing unrelated words, numbers and symbols works well.”
Use only letters, numbers and the symbols on a standard keyboard. Accented letters are not accepted.
Or press Generate one for me. It makes a random passphrase of four groups of four letters and numbers, joined by dashes. Save it before you go on: the app asks you to confirm that you have.
#A backup with no passphrase
You can choose None under Lock with a passphrase. The screen then warns: “A backup with no passphrase is not private. It holds everything you have dictated, and anyone who gets the file can read it, whoever they are and wherever the file ends up, including a folder that a cloud service keeps in sync.” It will not save until you switch on “I understand that anyone who gets the file can read it.”
#If you forget it
Nobody can open your backups without it, including us. Dictate Safe cannot recover it, and there is no reset. Your history on this computer is not affected, only the backups.
To carry on with a new one, press Change settings in Settings → Backup and set a new passphrase. The backup made when you save is locked with it. Backups made before still open only with the passphrase they were made with.
The backup passphrase is also what unlocks your history if this computer ever loses the key to it. Forgetting it and losing that key means nobody can open your history. See why your history might say it is locked.
#Keeping it on this computer
Below the passphrase is a switch: keep this passphrase on this computer, in the macOS Keychain on a Mac or the Windows Credential Manager on a PC. With it on, Back up now does not ask for the passphrase, and automatic backups can run. Automatic backups need it, because nobody is there to type it, so choosing a schedule switches it on.
The trade-off, as the screen puts it: “It never leaves this Mac; anyone who can use this Mac account could read it.” A copy kept there is also lost with the computer, so save the passphrase somewhere else too. The app keeps it only after the backup it locked has been saved and checked.
To stop keeping it, press Stop keeping it next to Protection. The kept passphrase is removed, and automatic backups switch off. To keep it again, press Keep it and type the passphrase.
The meter is an estimate. A passphrase it calls Strong is hard to guess, not impossible. Each backup with a passphrase is locked with 256-bit AES, and the key is made from your passphrase by Argon2id, which makes every guess slow for anyone who has a copy of the file. A short or common passphrase is still the weak point, which is why the app refuses one.