Encryption support in PMM Dump

The pmm-dump client utility performs a logical backup of the performance metrics collected by the PMM Server and imports them into a different PMM Server instance. PMM Dump allows you to share monitoring data collected by your PMM server with the Percona Support team securely.

Up until now dumps, created by the tool, were not encrypted. It was possible to encrypt them after they are done but this required additional actions from the user.

Starting from the upcoming PMM Dump version 0.8.0-ga released on October 29, 2025, dumps are encrypted by default.

Key points

• Dump files are encrypted by default with AES-256-based encryption.
• An auto-generated password is produced for each encrypted dump; it is printed at the end of the export operation or can be written to a file with --pass-filepath.
• You can provide a custom password with --pass.
• Disable encryption with --no-encryption only when you understand the risks.
• By default, for encrypted dumps, export logging to STDOUT is suppressed; use --no-just-key to override.

Why this matters

Encrypting PMM dumps prevents accidental exposure of monitoring and query data that may contain sensitive information (query text, hostnames, metrics). It brings PMM Dump in line with secure data-handling best practices and simplifies safe sharing with Percona Support.

Quick examples

Export (encryption enabled by default):

$ pmm-dump export --pmm-url='https://admin:admin@127.0.0.1' --allow-insecure-certs
... 
Password: ****************
$ ls pmm-dump-<TIMESTAMP>.tar.gz.enc

Provide a custom password:

$ pmm-dump export --pmm-url='https://admin:admin@127.0.0.1' --pass='My$trongP@ss'

Save auto-generated password to file:

$ pmm-dump export --pmm-url='https://admin:admin@127.0.0.1' --pass-filepath=/tmp/pmm-dump.pass

Disable encryption (not recommended):

$ pmm-dump export --pmm-url='https://admin:admin@127.0.0.1' --no-encryption

Import an encrypted dump:

$ pmm-dump import --pmm-url='https://admin:admin@127.0.0.1' --allow-insecure-certs \
--dump-path=pmm-dump-1758017090.tar.gz.enc --pass='My$trongP@ss'

Decrypt an encrypted dump (if needed):

$ openssl enc -d -aes-256-ctr -pbkdf2 -in dump.tar.gz.enc -out dump.tar.gz

Recommendations

• Prefer leaving encryption enabled.
• Use --pass-filepath to store passwords securely rather than relying on terminal output.
• Transfer encrypted archives over secure channels (SCP/SFTP) and share passwords via secure out-of-band channels.

Availability

Encryption support is included starting in the recent PMM Dump 0.8.0-ga release. Check your PMM Dump version (pmm-dump version) and the docs for exact version details.

Additional information

• Latest version for x86_64 platforms
• ARM binaries
• PMM Dump Documentation
• GitHub repository