BlumeOps Docs

Restore 1Password Backup

3 min read

Restore 1Password Backup

How to recover a 1Password .1pux export from a borgmatic backup. This procedure assumes the worst case — indri and sifaka may both be gone. All you need is a copy of the borg repository and your Emergency Kit.

Prerequisites

  • A copy of the borg backup repository (from sifaka, or the BorgBase offsite repo)
  • borg, age, and openssl installed on any machine
  • Your 1Password Emergency Kit (fire safety box) — contains the master password and secret key
  • The borg repo passphrase (handwritten on the Emergency Kit as “Backup Archive Password”, or from /Users/erichblume/.borg/config.yaml if indri is accessible)

When to Use This

Use this procedure when you’ve lost access to 1Password and need to recover credentials from the encrypted backup created by mise run op-backup.

Procedure

1. Extract From Borg Repository

If you have direct access to the borg repository (e.g. mounted from sifaka or restored from off-site), extract directly:

mkdir -p /tmp/op-restore && cd /tmp/op-restore
 
# List recent archives — pick one from the output (e.g. "indri-2026-03-15T02:00:07")
BORG_PASSPHRASE="<your-borg-passphrase>" borg list /path/to/borg/repo --last 5
 
# Extract using the archive name from the list above
BORG_PASSPHRASE="<your-borg-passphrase>" borg extract \
  "/path/to/borg/repo::<archive-name>" \
  Users/erichblume/Documents/1password-backup/

If indri is available, you can use borgmatic instead:

ssh indri 'cd /tmp && mkdir -p op-restore && cd op-restore && \
  BORG_PASSCOMMAND="cat /Users/erichblume/.borg/config.yaml" \
  /opt/homebrew/bin/borg extract \
  "/Volumes/backups/borg/::<archive-name>" \
  Users/erichblume/Documents/1password-backup/'

Verify you have a .age file (~30-45 MB) and a .key.enc file (~200 bytes).

2. Decrypt the Age Private Key

The private key is encrypted with openssl aes-256-cbc. The passphrase is {master_password}:{secret_key} from your Emergency Kit.

cd /tmp/op-restore/Users/erichblume/Documents/1password-backup
openssl enc -d -aes-256-cbc -pbkdf2 \
  -in 1password-export-*.key.enc \
  -out key.txt

Enter the passphrase when prompted: {master_password}:{secret_key} (colon-separated, no spaces around the colon).

3. Decrypt the Export

age -d -i key.txt < 1password-export-*.age > export.1pux

4. Verify

The .1pux file is a zip archive. Verify it looks correct:

file export.1pux        # Should say "Zip archive data"
ls -lh export.1pux      # Should be ~30-45 MB
unzip -l export.1pux | head -20  # Should list files/ entries

5. Import Into 1Password

Open 1Password and use File > Import to restore from the .1pux file.

6. Clean Up

Remove all temporary files — the decrypted export and key contain secrets:

rm -rf /tmp/op-restore

Notes on the Borg Passphrase

All four borg repos use repokey encryption — the key is stored in the repo itself, so day-to-day recovery needs only the passphrase. The passphrase is handwritten on the physical Emergency Kit (“Backup Archive Password”) alongside the 1Password credentials; the handwritten copy is deliberate because this .1pux backup lives inside those same borg repos, so the borg secret must not exist only in 1Password. If a repo’s stored key is damaged, the paper-format key exports for all four repos sit in the 1Password “borg backup” and “borgbase” items, matched by repository ID — see borgmatic §Key escrow.

Graph View

Backlinks