Move n8n from Cloud to self-hosted: migration checklist

Short answer

How do you move n8n workflows from Cloud to a self-hosted instance? Download each workflow as JSON from the Cloud Editor UI, import that file on the instance you run, create each credential again there, and activate the workflow before you rely on it. Editor UI Download is the Workflow menu item that saves the workflow open on the canvas as a JSON file. That JSON includes credential names and IDs, not credential secrets. This page does not ask you to run a Server CLI export on n8n Cloud. That command is documented for a self-hosted instance. The menu wording and the credential warning are from n8n's export and import page, checked Oct 18, 2026.

Decide whether to move on n8n Cloud vs self-hosted. This page starts after that decision.

If the reason is an execution cap, check the count before you move. An execution is a single run of a workflow. On paid plans, only production executions count toward the quota: executions started automatically by a trigger, a schedule, or polling. A Schedule Trigger counts one execution every time it fires. A polling trigger counts one execution only when it finds new data. Those sentences are from n8n's understand executions page, checked Oct 18, 2026. What else does not count, and the arithmetic at each volume, is on what n8n costs by executions. This page does not restate those tables.

Moving off Zeabur on a deadline? That move is a separate page.

Before you start — what does and doesn't move

What won't move from n8n Cloud to self-hosted? The Cloud export for a workflow is JSON. When you Download from the Workflow menu, the file includes credential names and IDs. While IDs aren't sensitive, the names could be, depending on how you name your credentials. HTTP Request nodes may contain authentication headers when imported from cURL. Remove or anonymize that information before you share the file. On a private move the same warning still holds: Download carries credential references, not credential secrets. That warning is on the export and import page, checked Oct 18, 2026.

The encryption key is the value in a self-hosted instance's config file, or N8N_ENCRYPTION_KEY, that n8n uses to decrypt credentials. n8n's backup and restore page says a restored database or an encrypted credential export can't be decrypted without that key, and it documents a --decrypted export that writes credentials in plain text. Neither n8n Cloud's encryption key nor a decrypted Cloud export is on the Cloud pages read for this guide. Do not plan this move as a same-key restore.

The same backup page says a self-hosted Server CLI --backup export contains workflows and credentials only. It does not include:

• Users and their roles. After importing into a fresh instance, n8n shows the owner setup screen again, and the first person to complete it becomes the owner.
• Execution history and logs.
• Variables.
• Instance settings, including the encryption key.

That list describes the self-hosted CLI export. It is not a command you run on n8n Cloud. The Cloud pages read on Oct 18, 2026 — export and import, and download workflows — do not describe an export of those four items.

Step 1 — Export from n8n Cloud

How do you export a workflow from n8n Cloud? From the Canvas header, select the Workflow menu, then Download. Download saves the workflow open on the canvas as a JSON file on your computer. That menu item is one workflow at a time. Repeat it for each workflow you need. Exported workflow JSON files include credential names and IDs. While IDs aren't sensitive, the names could be, depending on how you name your credentials. HTTP Request nodes may contain authentication headers when imported from cURL. Remove or anonymize this information from the JSON file before sharing it, and keep the file private on a move: it carries credential names and IDs, not credential secrets. Menu names and that warning are from export and import, checked Oct 18, 2026.

The same menu also lists Import from URL and Import from File. Those are import actions, covered in Step 2. The page also documents copy-paste of nodes between Editor UIs.

Workflows from the most recent Cloud backup

n8n documents a second Cloud path, for instance owners, on download workflows, checked the same day. Instance owners can download workflows from the most recent backup, using the Cloud admin dashboard:

1. Log in to n8n.
2. Select Admin Dashboard to open the dashboard.
3. In the Manage section, select the Export tab.
4. Select Download Workflows.

That page says the download is workflows from the most recent backup. It does not say the file is every workflow, the live canvas, a named format, or that credential secrets are in it. It is not a one-step export of the whole instance, and it is not a Server CLI command. The per-workflow Download above is the step for the workflow currently open. After a free trial ends, the same page says you have 90 days to download workflows. After that, it says all workflows are permanently deleted and unrecoverable. That 90 days is the trial wording on that page. It is not a migration timeline.

n8n also documents command-line routes on the export page. n8n CLI packages are in Preview and may change. The page says that CLI runs from any machine with network access, and that n8n recommends it over Server CLI export and import for new work. It says n8n plans to deprecate Server CLI export and import, and that this is not yet scheduled. The page's sentence uses "deprecated" as the verb. This page does not give those package commands as the Cloud export. Server CLI export runs on a self-hosted instance you control. Do not run it on n8n Cloud.

Step 2 — Set up the self-hosted target and import

On a fresh instance, n8n's backup and restore page says the owner setup screen appears again, and the first person to complete it becomes the owner. Complete that setup before the Server CLI import commands. Those commands need an existing user, and imported credentials need an owner. If the instance has multiple users or projects, the command line page says --userId and --projectId each can't be used with the other. n8n setup problems is the page for an instance that will not come up cleanly. It does not replace the import below.

Import from File

In the Editor UI, from the Canvas header Workflow menu, Import from File imports a workflow as a JSON file from your computer. Import from URL imports workflow JSON from a URL. The file Download saved is the Import from File case. The export page, checked Oct 18, 2026, does not say that Import from File deactivates the workflow, and it does not say that matching IDs are overwritten.

Server CLI import, on the target only

The Server CLI runs on the self-hosted instance, not on n8n Cloud. On npm the n8n command is available directly. On Docker it runs inside the container. Both forms are from the command line page, checked Oct 18, 2026.

docker exec -u node -it <n8n-container-name> <n8n-cli-command>

Import one workflow JSON file, or every *.json file in a directory:

n8n import:workflow --input=file.json
n8n import:workflow --separate --input=backups/latest/

The command-line page says exports include the original IDs, and the same IDs already on the target are overwritten. The backup page says the same, and that imported workflows are deactivated by default. Activate them in the UI after importing, or pass --activeState=fromJson to restore each file's exported active state, which the backup page says only works in queue or multi-main mode. The command-line flag table says fromJson is multi-main mode only. The example on that same page says it is supported in multi-main and queue mode. This page quotes both sentences. It does not pick one.

Do not run import:credentials, a same-key restore, or --decrypted as a Cloud step. Those are how a self-hosted backup restores credentials, on the backup page. A Cloud reader has no documented encryption key to copy, and no documented decrypted Cloud export.

Step 3 — Reconnect credentials and reactivate

Credential secrets did not travel in the Download JSON from Step 1, which includes credential names and IDs only. On the target, create the credential again. n8n's create and edit credentials page, checked Oct 18, 2026, says you can create a new credential in the credential drop-down when editing a node on the workflow editor. Once the credential modal is open, enter the details the service requires. The page points at that service's page in the credentials library for the fields. When you save a credential, n8n tests it to confirm it works. This page does not add OAuth, token, or API-key steps beyond that.

After a Server CLI import, activate the workflow in the UI. The backup page says imported workflows are deactivated by default. Then test it with a manual run. n8n's executions page says to run a workflow manually by clicking Execute Workflow, and to unpublish workflows while testing through manual runs. That page also says a production workflow runs automatically once you publish a version. The backup page still says "activate" and "deactivated." This page does not treat those words as the same instruction. No page read for this guide states how long the move takes.

If a workflow uses a webhook, the public URL is a setting on the new host. n8n's configure webhook URLs with reverse proxy page, checked Oct 18, 2026, says n8n creates the webhook URL by combining N8N_PROTOCOL, N8N_HOST, and N8N_PORT. Behind a reverse proxy that combination will not work, because n8n runs internally on port 5678 and the proxy exposes it on port 443. Set N8N_WEBHOOK_URL so n8n can display the URL in the editor and register the correct webhook URLs with external services. That variable replaces WEBHOOK_URL, which is deprecated from n8n 2.35.0. Set N8N_PROXY_HOPS to 1. On the last proxy on the request path, set X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto. A DNS cutover procedure was not on the n8n pages read for this guide.

Step 4 — Make the new instance safe to keep

The move is not a backup of the new instance. n8n's backup and restore page says a complete self-hosted backup is the .n8n folder (~/.n8n by default: the config file with the encryption key, the SQLite database if you use SQLite, and filesystem binary and execution data if you use that storage) plus an external PostgreSQL backup if you use PostgreSQL, plus external binary or execution storage, a custom filesystem path, and N8N_CUSTOM_EXTENSIONS directories when you use them. With SQLite, stop n8n before copying .n8n. On Docker, .n8n lives in the n8n_data volume, mounted at /home/node/.n8n. n8n backups: a snapshot is not a backup is the longer page on that list. After the instance is up, the update cadence is how to update n8n safely. If setup itself breaks, use n8n setup problems.

Where to land

Where you run the new instance is a separate choice. Host kinds are on best n8n hosting. How much RAM and CPU to start from is on how much RAM and CPU n8n needs. Dated prices are on n8n hosting prices and n8n hosting prices — October 2026. This page does not restate them. The links below are every host in the dataset, in dataset order. The order is not a ranking, and affiliate status is not an input.

• Hostinger
• n8n Cloud
• Contabo
• DigitalOcean
• Elestio
• Render
• Hetzner
• Railway
• Vultr
• Linode (Akamai)
• Oracle Cloud
• Sliplane
• OVHcloud
• netcup

FAQ

How do I move n8n from Cloud to self-hosted?

Download each workflow from the Cloud Editor UI: from the Canvas header, open the Workflow menu and choose Download. That saves the workflow open on the canvas as a JSON file, and the file includes credential names and IDs, not credential secrets. On the self-hosted instance, complete owner setup before a Server CLI import, then use Import from File or, on that instance only, n8n import:workflow --input=file.json. Create each credential again in the credential drop-down while editing the node. n8n's backup page says workflows imported by the Server CLI are deactivated by default, so activate them in the UI and run each one with Execute Workflow before you rely on a schedule or a webhook. Do not run a Server CLI export on n8n Cloud. Checked Oct 18, 2026.

Do credentials move with exported workflow JSON?

No. Download, in the Workflow menu, saves the current workflow as JSON, and that JSON includes credential names and IDs. IDs are not sensitive. Names could be, depending on how you name your credentials, and HTTP Request nodes may contain authentication headers when imported from cURL. The file does not include credential secrets. On the target, create a new credential in the credential drop-down when editing a node. When you save a credential, n8n tests it to confirm it works. Same-key restore and a --decrypted export are described for a self-hosted backup. They are not documented as n8n Cloud export options. Checked Oct 18, 2026.

What won't move from Cloud to self-hosted?

Credential secrets do not move in the workflow JSON that Download saves. The Cloud pages read on Oct 18, 2026 — Export and import, and Download workflows — do not describe an export of the encryption key, users and roles, execution history and logs, variables, or instance settings. A self-hosted Server CLI --backup export contains workflows and credentials only and does not include those items. That command is not something you run on n8n Cloud. Instance owners can select Download Workflows on the Cloud admin dashboard Export tab. That page says the download is workflows from the most recent backup. It does not say the file includes credential secrets or those other items.

Are imported workflows active right away?

Not on the Server CLI path. n8n's backup page says imported workflows are deactivated by default. Activate them in the UI after importing, or pass --activeState=fromJson, which that page says only works in queue or multi-main mode. The command-line page's flag table says fromJson is multi-main mode only, and the example on that same page says multi-main and queue mode. The Editor UI Import from File page does not repeat the deactivated-by-default sentence. Checked Oct 18, 2026.

I'm moving because of the execution cap — how do I check my count first?

An execution is a single run of a workflow. On paid plans, only production executions count toward the quota: executions started automatically by a trigger, a schedule, or polling. A Schedule Trigger counts one execution every time it fires. A polling trigger counts one execution only when it finds new data. The worked examples and the plan arithmetic are on /n8n-cost-by-executions/. This page does not restate those tables. Checked Oct 18, 2026.