Home Page » News » Tutorials » How to Create an Encrypted Android Backup with Termux and GPG (No Root)

Create an Encrypted Android Backup with Termux and GPG

8 min read Learn step‑by‑step how to back up your Android apps and data, encrypt the backup with GPG using Termux, and store it safely on external media – no root required. September 30, 2026 19:30

Before you start

Backing up Android apps and personal data is a good habit, but storing the backup unencrypted on a PC or USB stick exposes you to privacy risks. This tutorial shows how to create a standard ADB backup, then encrypt it with gpg inside Termux – all without rooting the device. By the end you will have a single .ab file wrapped in a .gpg container that only you can open.

What you need

An Android phone running Android 7.0 or later.
A Windows, macOS, or Linux computer with platform‑tools (adb) installed.
Termux installed from F-Droid (to avoid Google Play’s version‑check).
Internet connection for the first run (to download packages).
A USB‑OTG adapter or a USB‑C cable to connect the phone to the computer.

Safety tip: The ADB backup can contain app data that includes passwords or tokens. Keep the unencrypted .ab file only on the phone until it is encrypted, then delete it securely.

1. Install and configure Termux

Open the Play Store or, preferably, F-Droid, search for Termux and install it.
Launch Termux. The first launch will set up the basic environment – wait for it to finish.
Update the package repository and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
Install the required utilities:
```
pkg install gnupg zip unzip tar -y
```
Why? gnupg provides the gpg command used for encryption; zip and tar help you compress large backups before encryption.
Generate a GPG key pair that will be used for encryption. Run:
```
gpg --full-generate-key
```
The wizard asks for key type, size, expiration and a user ID. For most users the default (RSA and RSA, 4096 bits, never expire) is fine. Remember the passphrase you set – you will need it each time you encrypt or decrypt.
Export the public key so you can import it later on your computer (optional but handy):
```
gpg --export -a "Your Name" > mypubkey.asc
```
Copy mypubkey.asc to your computer via USB, email, or any secure channel.

2. Create a plain ADB backup on the phone

Enable Developer Options on the phone (if not already): Settings > About phone > tap Build number seven times.
Open Developer Options and turn on USB debugging. Confirm the RSA key prompt when you connect to the computer.
Connect the phone to the computer with a USB cable. On the computer, verify the connection:
```
adb devices
```
You should see the device serial number followed by device. If it shows unauthorized, check the phone for the RSA prompt.
Run the backup command. Replace backup.ab with a name you like:
```
adb backup -apk -shared -all -f backup.ab
```
This command backs up installed apps (-apk), shared storage (-shared), and all user data (-all) into a single file. When the phone shows the backup UI, tap Back up my data and, if you want, set a temporary password – you can leave it blank for simplicity.
Wait for the progress bar to finish. The resulting backup.ab file resides on the computer’s current directory.

3. Transfer the backup to Termux for encryption

Copy the backup.ab file to the phone’s internal storage (e.g., /sdcard/Download) using the computer:
```
adb push backup.ab /sdcard/Download/
```
On the phone, open Termux and navigate to the download folder:
```
cd /sdcard/Download
```
Compress the backup to reduce size and add a layer of obscurity before encryption:
```
tar -cvf backup.tar backup.ab
```
You now have backup.tar in the same folder.

4. Encrypt the backup with GPG

Encrypt the tar file for yourself (only you can decrypt). Use the --encrypt flag and specify your own key ID (you can find it with gpg --list-keys):
```
gpg --output backup.tar.gpg --encrypt --recipient "Your Name" backup.tar
```
Why encrypt? The resulting .gpg file is AES‑256 encrypted (default) and signed with your private key, guaranteeing confidentiality and integrity.
Verify that the encrypted file exists and looks reasonable:
```
ls -lh backup.tar.gpg
```
Once you have confirmed the .gpg file, securely delete the unencrypted backup.tar and backup.ab files to avoid leaving plaintext on the device:
```
shred -u backup.tar backup.ab
```
If shred is not available, you can install it via pkg install coreutils and then run the same command.
Copy the encrypted backup to a safe location – for example, an encrypted USB‑OTG stick, a cloud folder with end‑to‑end encryption, or your computer’s encrypted drive:
```
adb pull /sdcard/Download/backup.tar.gpg ~/EncryptedBackups/
```

5. Verify the backup can be decrypted

On your computer (or inside Termux on another device), import the public key if you plan to decrypt elsewhere:
```
gpg --import mypubkey.asc
```
Decrypt the file to make sure the passphrase works:
```
gpg --output test.tar --decrypt backup.tar.gpg
```
If the command asks for the passphrase you set earlier and finishes without error, the encryption is sound.
Optionally, extract the original .ab file to double‑check its integrity:
```
tar -xvf test.tar
```
You should see backup.ab. You can now delete test.tar and backup.ab from the test location.

6. Restoring the backup (when you need it)

Transfer the encrypted .gpg file back to the phone (or keep it on the computer and use adb restore directly).

Decrypt it on the phone:

gpg --output backup.tar --decrypt backup.tar.gpg

Extract the original .ab file:
```
tar -xvf backup.tar
```
Run the restore command:
```
adb restore backup.ab
```
The phone will display a restore UI; follow the prompts to finish.

Troubleshooting

Common failure: ADB says "device unauthorized"

Make sure you accepted the RSA fingerprint prompt on the phone. If the prompt never appears, toggle USB debugging off and on again, then reconnect.

Encryption step fails with "gpg: no valid OpenPGP data found"

This usually means the public key ID was typed incorrectly. Run gpg --list-keys to copy the exact name or key fingerprint.

Decryption asks for a passphrase you don't remember

Unfortunately, without the passphrase the data cannot be recovered. This is why the tutorial stresses storing the passphrase in a password manager.

Large backups

If your backup exceeds the typical 2 GB limit of some file‑systems, split the encrypted file into chunks using split before moving it to external storage:

split -b 1900M backup.tar.gpg backup.part.

To reassemble, use cat backup.part.* > backup.tar.gpg before decryption.

With these steps you now have a repeatable, root‑free workflow for creating encrypted Android backups that you can store safely on any medium you trust.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.