How to Verify Encryption on a Bucket in Backblaze B2 Cloud Storage

Server-side encryption (SSE) protects your data by encrypting it before it is stored on disk by Backblaze B2 Cloud Storage. You can enable SSE on a bucket in the Backblaze web console. Additionally, you can access files that are encrypted with SSE using the same API calls as other Backblaze B2 files.

By default, SSE-B2 is disabled for a new bucket.

After you enable SSE-B2 for a bucket, all of the uploads from the time encryption is enabled are encrypted with SSE-B2 by default, unless you explicitly specify SSE-C encryption for a given file at upload time. Existing files in the bucket are not affected by default bucket encryption settings.

Verify Server-Side Encryption on a Bucket

Server-side encryption with Backblaze-managed keys is the default for new uploads and destination copies in new buckets. Existing buckets are enabled gradually; once enabled, their new uploads and destination copies also use SSE-B2.

You can verify the effective bucket default and the encryption used for an individual object in the Backblaze web console.

Verify the bucket default

1. Sign in to your Backblaze account.
2. In the left navigation menu under B2 Cloud Storage, select Buckets.
3. Locate the bucket and open its settings or details.
4. Verify that Default Encryption is SSE-B2 with AES256 when the default has been enabled for that bucket.

A bucket created before always-on encryption may show its previous state until it is included in the phased rollout. Existing objects are not retroactively encrypted.

Verify an object's encryption

1. Open the bucket and browse its files or objects.
2. Open the information or technical-details view for the object.
3. Review the Encryption value. SSE-B2 objects display AES256 or SSE-B2; SSE-C objects display the customer-managed encryption type.

Existing objects are not retroactively encrypted. An older object may show no server-side encryption if it was stored before always-on encryption took effect.

Use SSE-C for an individual object

To use a customer-provided encryption key for an object, supply the required SSE-C headers during upload or copy. SSE-C takes precedence over the SSE-B2 default for that object.