¶ September 29, 2026 - Managed folder encryption and recovery keys
Here is a summary of changes shipped since our last update.
- Managed folder encryption. Folders can now be encrypted with an autogenerated key that HexOS manages for you. The key is stored securely with your HexOS account, so your folders unlock automatically when your server restarts, and you have nothing to remember. Passphrase encryption is still available for anyone who prefers it.
- Turn on encryption for existing folders. If you have folders that were created without encryption, you can now turn it on from the folder's page. HexOS handles the conversion: it creates an encrypted copy of your data, verifies every file, swaps the folder into place, and removes the unencrypted original only after everything checks out. Your data is protected at rest from that point on, and the folder becomes eligible for Buddy Backup. Encryption is a one-way change: if you need an unencrypted copy later, create a new folder and transfer the files from the file browser.
- Per-server recovery keys. Each server gets its own recovery key, a short code that protects every managed folder key on it. By default, HexOS keeps the recovery key for you ("Managed"). If you prefer end-to-end encryption where HexOS holds nothing that can open your data, choose End-to-end encryption in Settings > Recovery key and save the key yourself. An Emergency kit button downloads a branded PDF with your key and instructions for using it. The key can be rotated or handed back to HexOS at any time.
- Grow a pool with bigger drives. You can now add or swap in a drive that is larger than the others in a pool. Pick one and the dialog explains what you get: You can use this disk, but some capacity won't be available until all disks are replaced with larger ones. To unlock the full capacity, replace each drive one at a time. After the last replacement finishes, HexOS expands the pool on its own: the Activity Center shows Growing pool into its bigger drives and then Pool grown to use its bigger drives, with no action needed from you. Learn about using drives of different sizes.
- System folder locations are easier to manage. Each location's Used by list now shows exactly which apps and VMs use it, and only those block a change. A location is always a folder inside a pool, and one saved as a whole pool on an earlier version shows a notice so it can be moved to a folder. Changing a location only changes where new files go: nothing is moved or deleted.
Virtual Machines and Buddy Backup are in public beta. Both features are rolling out to everyone, first in small batches and then in larger ones as we monitor for any scaling issues. Both keep their Beta label until they leave beta on November 27. The updates below are for our current beta participants. Everyone else will get them as the rollout reaches their server.
Virtual Machines let you run Windows, Linux or an appliance like Home Assistant directly on your server, with a hands-off installation that sets up your account and installs the apps you choose before you ever sign in. Read the full announcement.
- Slow Network Mode. A new toggle in the console's More menu asks the guest to drop its animations and wallpaper, so a remote Windows desktop uses a fraction of the bandwidth. Measured on a Windows 11 guest: opening the Start menu went from 3.2 MB of screen updates to 0.8 MB, and dragging a window went from 5.7 MB to 40 KB.
- Ctrl+Shift+Esc in the console toolbar. A Windows guest's Task Manager can now be opened from the console with one click, since the key combination is normally caught by the viewer's own machine.
Buddy Backup lets you back up folders from one HexOS server to another, whether it is a second server you own or a friend's server across the internet, with end-to-end encryption over a private mesh network. Read the full announcement.
- The Backups section on the dashboard now loads only the server you are looking at, so it appears right away even if you have backups on several servers.
- Recover backups onto a new server. If you replace a server, a Recover button on the Backups page lets you pick a connection that belonged to the old server and restore your folders onto the new one. For managed keys, the restore continues on its own while you are signed in. For a self-managed recovery key, you are asked for it once.
- Move where a backup is stored. A donor can move a hosted backup to another of their own servers from the connection's Change server action. The backup moves with all of its restore points, verified snapshot by snapshot, and the owner of the data sees no interruption.
NOTE: All of these updates are applied automatically to your Command Deck. You may need to clear your cache. Help with clearing your cache is available here.