How to Back Up Your EFS Certificate and Key in Windows 10

Backing up your Encrypting File System (EFS) certificate and key ensures you can still access your encrypted files if Windows is reinstalled, your user profile is corrupted, or you move to a new PC. Without this backup, encrypted files become permanently inaccessible. This guide walks you through the export process using the built-in Certificate Manager, covering both the certificate and the private key.

What You’ll Need

A Windows 10 PC with at least one file or folder encrypted using EFS (if you haven’t encrypted anything, there may be no EFS certificate to back up).
Administrator rights on the PC (to access the certificate store, though user certificates can usually be exported without admin).
A removable drive or a secure location to store the exported file (e.g., USB flash drive, external hard drive, or a password manager that supports file attachments).
A password you can remember for the export file (you’ll set this during the process).

Step-by-Step

Open Certificate Manager. Press Windows + R, type certmgr.msc, and press Enter. If prompted by User Account Control, click Yes.
Navigate to your personal certificates. In the left pane, expand Personal and click Certificates. You’ll see a list of certificates issued to your user account.
Locate the EFS certificate. Look for a certificate with Encrypting File System in the Intended Purposes column. If you don’t see that column, right-click the column header and add it. The certificate name typically matches your username or email.
Start the export wizard. Right-click the EFS certificate, choose All Tasks, then Export. This launches the Certificate Export Wizard.
Click Next on the welcome screen.
Choose to export the private key. Select Yes, export the private key and click Next. This option is essential – without it, the backup won’t include the key needed to decrypt files.
Select the export format. Choose Personal Information Exchange – PKCS #12 (.PFX) (the default). Leave the default options checked: Include all certificates in the certification path if possible and Enable certificate privacy. Click Next.
Set a password. Type a strong password twice. This password protects the .PFX file. You’ll need it when importing on another PC. Click Next.
Choose a file name and location. Click Browse, navigate to your USB drive or secure folder, and give the file a recognizable name (e.g., EFS-backup-2025.pfx). Click Save, then Next.
Review and finish. Check the summary, then click Finish. A confirmation message appears. Click OK.
Store the backup securely. Keep the .PFX file in a safe place. If you used a USB drive, label it and store it in a locked drawer or safe. Do not leave it on the desktop.

Common Mistakes

Exporting without the private key. Selecting “No, do not export the private key� results in a backup that cannot decrypt files. Always choose “Yes, export the private key.�
Choosing the wrong certificate. If you have multiple certificates, picking one that isn’t for EFS will not help. Verify the “Intended Purposes� column shows “Encrypting File System.�
Forgetting the password. The .PFX file is useless without the password you set. Use a password manager or write it down and store it separately.
Storing the backup on the same drive. If your hard drive fails, a backup stored on it is lost too. Always use a separate physical medium or cloud storage (encrypted).
Not testing the backup. After exporting, you should test the import on a different machine or a virtual machine to confirm the backup works.

Tips

Back up regularly. If you encrypt new files or change your password, consider re-exporting the certificate to keep the backup current.
Use a strong password. The .PFX password is your last line of defense. Use a long passphrase with a mix of characters.
Keep multiple copies. Store one copy on a USB drive and another in a secure cloud vault (e.g., an encrypted archive in your password manager).
Know your EFS certificate. You can also see it in the User Accounts control panel under “Manage your file encryption certificates.� That tool lets you back up and restore EFS certificates more directly.

Troubleshooting

I don’t see an EFS certificate in the list. If you haven’t encrypted any files yet, Windows may not have created an EFS certificate. Encrypt a test file first (right-click > Properties > Advanced > Encrypt contents), then check again.

The “Export� option is grayed out. This can happen if the certificate’s private key is not marked as exportable. In some cases, you can enable exportability by using the certutil command with the -exportPFX option, but this may require admin rights. Alternatively, use the “Manage your file encryption certificates� tool, which often handles this automatically.

I get an error saying “The private key is not exportable.� This usually means the key was created with a setting that prevents export. The easiest fix is to create a new EFS certificate: decrypt all your encrypted files, delete the old certificate from the store, then encrypt a file again to generate a fresh certificate. Then export that one.

The import fails on another PC. Make sure you have the correct password and that the .PFX file is not corrupted. Also, the importing user must be the same user account or have admin rights to install the certificate.

I lost my backup and can’t decrypt files. Unfortunately, without the private key, there is no built-in way to recover EFS-encrypted files. This is why a backup is critical. If you have a data recovery service, they may be able to help, but it’s not guaranteed.

Frequently Asked Questions

What exactly is an EFS certificate?

It’s a digital certificate that contains a public key and a private key. The public key encrypts files, and the private key decrypts them. Without the private key, encrypted files are unreadable.

Can I back up EFS without a USB drive?

Yes, you can save the .PFX file to any location, including a network drive or cloud storage. Just make sure it’s encrypted and password-protected.

Do I need to back up EFS if I use BitLocker?

Yes. BitLocker protects the entire drive, but EFS protects individual files and folders. They are separate features. If you use EFS, you should back up its certificate.

Can I use the same EFS certificate on multiple computers?

Yes, you can import the .PFX file on another PC. That will allow you to decrypt files that were encrypted with that certificate on the original PC.

What happens if I reinstall Windows without backing up EFS?

Your encrypted files will be inaccessible because the new installation has a new user profile and no matching private key. The files remain encrypted but are effectively lost.

Is there a way to recover EFS files without the certificate?

No official method exists. Data recovery specialists might attempt brute-force attacks, but it’s extremely difficult and usually not feasible. Always keep a backup.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →