Backblaze engineer here. The private encryption key is a completely standard PEM file from OpenSSL. We have two modes: by default the PEM file is secured by a

Backblaze engineer here. The private encryption key is a completely standard PEM file from OpenSSL. We have two modes: by default the PEM file is secured by a "pass phrase" known by Backblaze. In this lower security mode, the user data is essentially only secured by their email address and their chosen password on the Backblaze website, and the user can recover their password via email. That is a great mode if you are just backing up stuff you don't terribly mind somebody getting a copy - like photos of your cat. If you are concerned about security, the second mode is you set your own "pass phrase" on the PEM file. But oh my lord, make sure you remember that pass phrase because Backblaze never writes it to disk and if you forget it, NOBODY ON EARTH is getting your files. Not you, not the USA government, not Backblaze, that data is GONE. You cannot recover that password. This is a good security mode if you would be arrested if the NSA got a copy of your data, because we don't think it can be broken.