Calmbu
BACKUP / NATIVE WINDOWS CODEX

How to back up Codex on Windows safely

A practical, security-conscious guide to protecting local Codex sessions, configuration, skills, and other persisted state on native Windows.

DIRECT ANSWER

What you need to know

Back up the persisted Codex state under CODEX_HOME, not only your Git repositories. On native Windows the default is %USERPROFILE%\.codex unless you have set CODEX_HOME. Keep the backup separate from the PC, protect or exclude credentials such as auth.json, and test recovery into a separate folder before trusting the copy.

What a complete Codex backup needs to cover

Git and Codex protect different layers of your work. Git records repository history. Codex also keeps user-level state outside an individual repository, including configuration, sessions, skills, logs, authentication material, and other runtime state under its state root.

OpenAI documents CODEX_HOME as the root for Codex state. If you have not changed it, Codex uses the .codex directory in your Windows user profile. Advanced configurations can also move SQLite-backed state, so record any custom state-location overrides as part of your backup plan.

  • Your native Windows CODEX_HOME, normally %USERPROFILE%\.codex
  • Any explicitly configured separate SQLite state location
  • Your Git repositories and uncommitted work, protected through Git and a separate file backup
  • A written note of custom configuration or environment-variable overrides

A safer manual backup process

  1. 01

    Locate the active state root

    Check whether CODEX_HOME is set. If it is not, use the .codex folder inside your Windows user profile. Do not assume a WSL path and a native Windows path are the same workspace.

  2. 02

    Close active Codex processes

    For a simple file copy, close Codex first so files are not changing while the copy is made. Automation built for live capture needs its own consistency controls; an ordinary copy command does not provide them.

  3. 03

    Handle credentials deliberately

    OpenAI says auth.json can contain access tokens and should be treated like a password. Do not place an unencrypted copy in a shared drive, repository, or broadly accessible synced folder.

  4. 04

    Store a separate copy

    Use a destination that can survive loss of the PC, such as protected external storage or a private synced location. A second folder on the same drive does not protect against device loss. If you keep repeated full-folder copies, unchanged data is stored again each time, so plan capacity and retention accordingly.

  5. 05

    Test the copy away from live state

    Inspect or reconstruct the backup in a separate folder. A copy is not a proven backup until you can read the expected state without changing your active Codex home.

Common mistakes

  • Backing up only the source repository and assuming Codex sessions are inside it
  • Copying auth.json into Git, a support ticket, or an unencrypted archive
  • Keeping the only backup on the same Windows drive
  • Retaining repeated full-folder copies without monitoring how quickly storage grows
  • Never checking whether the copied state can actually be reconstructed
  • Mixing native Windows Codex and WSL paths without confirming which environment owns the state
THE CALMBU BOUNDARY

What Calmbu currently claims

You can maintain this process yourself if you keep the active Codex locations, exclusions, storage, retention and recovery tests current. Calmbu packages that recurring work into maintained agent-aware protection, AES-256-GCM encryption, storage-efficient recovery points that reuse unchanged protected data, and required recovery checks. The public Windows installer remains gated.

See the recovery model How Calmbu verifies its claims

Common questions

Does copying my project folder back up Codex?

No. It protects that project folder, but Codex also keeps user-level state under CODEX_HOME. Use Git and project backups for code, and a separate Codex-state backup for the workspace layer around it.

Should I back up auth.json?

Treat auth.json like a password because it may contain access tokens. A security-conscious backup should exclude it or protect it with strong encryption and strict access controls. Signing in again is usually safer than moving a plaintext credential file.

Can I back up Codex while it is open?

A purpose-built backup tool can account for changing files, but a simple manual folder copy cannot guarantee a consistent point in time. Close Codex before a manual copy.

Will repeated manual Codex backups use more storage?

They can. If every backup is another complete folder copy, unchanged local workspace data is stored again each time. Calmbu reuses unchanged protected data across recovery points, so a new point does not require another complete copy. Actual storage use still depends on how much supported workspace data changes.

SOURCE BOUNDARY

Official references used for Codex facts

OpenAI documentation establishes Codex behaviour. Calmbu-specific statements describe the current product contract and are not presented as OpenAI guidance.

NEXT USEFUL ANSWERS

Continue the recovery plan