BackupClaw 🦞

The privacy-first, zero-knowledge backup tool for OpenClaw bots.

BackupClaw allow you to securely encrypt and archive your OpenClaw bot's memory, configuration, and workspace without the data ever leaving your machine (unless you explicitly push it to our encrypted cloud).

Visit BackupClaw.com to create an account and manage your subscription.

📦 What gets backed up?

By default, BackupClaw targets the standard OpenClaw data directory: ~/.openclaw (on Linux/Mac) or %HOMEPATH%\.openclaw (on Windows).

This directory typically contains:

• config.json: Your bot's unique identity and credentials.
• memory.md / framework/: The bot's long-term memory and knowledge graph.
• workspace/: Active working files and session context.

Everything in this folder is compressed and encrypted into a single artifact.

🛡️ How it works (Security Architecture)

We prioritize Zero-Knowledge Privacy. This means:

1. Client-Side Encryption: Encryption happens on your machine before any data is touched.
2. Authenticated Encryption: We use AES-256-GCM to ensure both confidentiality and integrity.
3. Strong Key Derivation: We use PBKDF2 (SHA-256, 100,000 iterations) to derive encryption keys from your password, making it resistant to brute-force attacks.
4. Unique Salt & IV: Generated randomly for every backup, preventing rainbow table attacks.

Installation

npm install -g backup-claw

Usage

1. Local Backup

Navigate to your OpenClaw bot directory (or anywhere you like) and run:

backup-claw backup

• Default Input: ~/.openclaw
• Default Output: ./backup-claw.enc (in current folder)

You can customize these paths:

backup-claw backup --dir /opt/my-bot/.openclaw --output /backups/my-bot-v1.enc

IMPORTANT: You will be prompted for a password. We cannot recover this password. If you lose it, your data is gone forever. This is the price of privacy.

2. Restore (Local)

To restore a backup file:

backup-claw restore -f my-backup.enc

• Default Destination: Your home directory (restoring .openclaw to its original place).
• Custom Destination:

  backup-claw restore -f my-backup.enc -d /tmp/test-restore

3. Cloud Backup (Pro)

Support for encrypted cloud storage is available for subscribers.

Setup

1. Register: Create an account at BackupClaw.com.
2. Login: Authenticate your CLI:

   backup-claw login

   Prompts for your account credentials and saves a session token locally.

Commands

• backup-claw cloud-push: Encrypts your bot and uploads it directly to our secure cloud (Cloudflare R2).
  • Note: This uses the same Zero-Knowledge encryption as local backups.
• backup-claw cloud-list: List all your backups stored in the cloud.
• backup-claw cloud-restore: Download, decrypt, and restore a backup from the cloud.
• backup-claw cloud-delete: Permanently delete a backup from the cloud.
• backup-claw whoami: Check your current login status and subscription.
• backup-claw logout: Clear your local session.

4. Automation (CI/CD & Cron)

BackupClaw is designed for autonomous agents. You can run it non-interactively by setting the BACKUP_PASSWORD environment variable.

Linux/Mac:

export BACKUP_PASSWORD="correct-horse-battery-staple"
backup-claw cloud-push

Windows (PowerShell):

$env:BACKUP_PASSWORD='correct-horse-battery-staple'
backup-claw cloud-push

Troubleshooting

"Directory not found" Ensure you have initialized your OpenClaw bot at least once so the .openclaw directory exists.

"Bad Decrypt" or "Mac Verify Failed" This almost always means the password was incorrect or the file was corrupted. AES-256-GCM ensures that if the password is wrong, or the file is modified, the decryption will fail safely.

License

MIT