unifi-extract

Decrypt and explore UniFi backup files (.unf and .unifi) entirely on your own machine. No network access, no browser, no data leaving your device.

UniFi backups are encrypted with a static, hard-coded key, not a per-user secret. This tool reproduces the decryption locally so you can inspect exactly what a backup contains. For the full format details, see DECRYPTION.md.

Why decrypt a backup?

A UniFi backup is an encrypted archive of the controller's whole state: device configs, WLANs, users, and the MongoDB or PostgreSQL database behind them. Reading any of it normally means restoring the entire backup onto a live controller. This tool reads the archive directly, which helps when you want to:

• Recover one value without a full restore. Pull a single WLAN passphrase, RADIUS secret, or device setting from an old backup without standing up a controller or overwriting your current config.
• Investigate an incident. See what a controller held at backup time for DFIR work, without touching production.
• Work an authorized engagement. A recovered backup yields password hashes, PSKs, TLS private keys, and API tokens straight from the file.
• Analyze and archive offline. Inspect backups on an air-gapped host and keep decrypted snapshots for later review, with no vendor tooling or network.

Features

• .unf site exports and classic controller autobackups (AES-128-CBC → ZIP).
• .unifi UniFi OS / UCore console full backups (AES-256-CBC → gzip → tar).
• Decode the embedded MongoDB dump to newline-delimited JSON.
• Extract every file, including the UCore PostgreSQL pg_dump for pg_restore.
• Runs offline; the binary never opens a network connection.

Install

go install github.com/EvilBit-Labs/unifi_extract@latest

Or build from source (dev tools are pinned via mise):

mise install     # provisions go, golangci-lint, etc.
just build       # -> bin/unifi-extract

Usage

unifi-extract <command> [flags] <backup-file>

Commands:
  info          Summarize a backup (type, version, timestamp, entries, doc count)
  decrypt       Write the raw decrypted container (.zip for .unf, .tar for .unifi)
  extract       Unpack every file from the backup into a directory
  mongo         Decode the MongoDB dump to newline-delimited JSON (NDJSON)
  sites         List the sites contained in a full backup
  site-export   Export one site from a full backup as an importable .unf

Flags:
  -o, --out string    Output path (file or directory, per command)
      --type string   Force format: "unf" or "unifi" (default: by extension)

Examples

# Overview of what a backup holds
unifi-extract info backup.unf

# Decrypt to a plain ZIP / TAR for manual inspection
unifi-extract decrypt backup.unf -o backup.zip
unifi-extract decrypt console.unifi -o console.tar

# Unpack everything to a directory
unifi-extract extract console.unifi -o ./console

# Dump the MongoDB collections as NDJSON, one document per line
unifi-extract mongo backup.unf > docs.ndjson
unifi-extract mongo console.unifi --pretty

# List sites in a full backup, then export one as an importable .unf
unifi-extract sites console.unifi
unifi-extract site-export console.unifi --site Default -o default.unf

Development

just check   # lint + test + build
just test    # go test -race -cover ./...
just lint    # golangci-lint run ./...

Security

Backup files decrypt with a key shared across all installations. The encryption is obfuscation, not confidentiality. Anyone with the file can read it. Extracted output contains secrets (password hashes, WLAN PSKs, RADIUS secrets, TLS private keys, API tokens); handle it accordingly.

This project is for inspecting your own backups. It is not affiliated with or endorsed by Ubiquiti.