A hardware-locked encrypted backup (HWLE-BU) that is locked to a single hardware device using the device's unique hardware identity, based on a Physically-Unclonable Function (PUF) or other suitable means providing a unique hardware identity. The HWLE-BU is bound to a specific hardware identity such that only the physical device that created the HWLE-BU can decrypt it, i.e., restoring HWLE-BU data requires utilizing the same physical hardware device in the decryption process.