# ENCRYPTION.ROTATE

> Switch encryption at rest to a new key file for every snapshot written from now on.

URL: https://docs.hotkv.com/commands/encryption-rotate/

```
ENCRYPTION.ROTATE new-key-file
```

- Group: Encryption
- Complexity: O(1)
- HotKV Cloud: Scale plan
- On-Premise: requires the encryption-at-rest license feature

`ENCRYPTION.ROTATE` loads the key in `new-key-file`, a file on the server
that holds a 32-byte key, and uses it for every snapshot written from then
on. Snapshots already on disk are not rewritten.

To finish a rotation:

1. Run `ENCRYPTION.ROTATE /path/to/new.key`.
2. Run [BGSAVE](https://docs.hotkv.com/commands/bgsave/index.md), so the current snapshot is written with
   the new key.
3. Point `key_path` (`encryption.key-file`) at the new key file, so the next
   restart uses it.
4. Keep the old key as long as you keep snapshots written with it: a
   snapshot can only be read with the key it was written with.

The command cannot be called from a script.

## Return value

Simple string `OK` in RESP2 and RESP3, or one of these errors:

| Case | Error |
| --- | --- |
| The file is missing, unreadable, or does not hold a 32-byte key | `ERR key rotation failed - check key file path and format` |
| No license that includes `encryption-at-rest` | `NOLICENSE encryption-at-rest requires a HotKV license. Contact sales@hotkv.com` |

## Examples

```
127.0.0.1:6379> ENCRYPTION.ROTATE /etc/hotkv/master-2026-10.key
OK
127.0.0.1:6379> BGSAVE
Background saving started
127.0.0.1:6379> ENCRYPTION.ROTATE /etc/hotkv/missing.key
(error) ERR key rotation failed - check key file path and format
```

## Compatibility

HotKV-only command.

## See also

[ENCRYPTION.INFO](https://docs.hotkv.com/commands/encryption-info/index.md),
[ENCRYPTION.VERIFY](https://docs.hotkv.com/commands/encryption-verify/index.md), [BGSAVE](https://docs.hotkv.com/commands/bgsave/index.md)