diff --git a/dashboard/src/components/BackupSiteAddDialog.vue b/dashboard/src/components/BackupSiteAddDialog.vue
index 517cb07b6..836ec4b32 100644
--- a/dashboard/src/components/BackupSiteAddDialog.vue
+++ b/dashboard/src/components/BackupSiteAddDialog.vue
@@ -379,11 +379,11 @@ defineExpose({
           <fieldset :disabled="busy">
             <input style="display: none;" type="submit"/>
 
-            <div class="warning-label">{{ $t('backups.configureBackupStorage.encryptionDescription') }}</div>
             <div class="error-label" v-if="formError.generic">{{ formError.generic }}</div>
             <FormGroup>
               <label for="encryptionPassswordInput">{{ $t('backups.configureBackupStorage.encryptionPassword') }} <sup><a href="https://docs.cloudron.io/backups/#encryption" class="help" target="_blank"><i class="fa fa-question-circle"></i></a></sup></label>
               <PasswordInput id="encryptionPassswordInput" v-model="encryptionPassword" :placeholder="$t('backups.configureBackupStorage.encryptionPasswordPlaceholder')" required />
+              <div class="warning-label">{{ $t('backups.configureBackupStorage.encryptionDescription') }}</div>
               <div class="error-label" v-if="formError.password">{{ formError.password }}</div>
             </FormGroup>
             <FormGroup>
diff --git a/src/backupsites.js b/src/backupsites.js
index 4f6336c05..3a6e7bd6f 100644
--- a/src/backupsites.js
+++ b/src/backupsites.js
@@ -304,6 +304,7 @@ async function setEncryption(backupSite, data, auditSource) {
     if (data.encryptionPassword) {
         const encryptionPasswordError = validateEncryptionPassword(data.encryptionPassword);
         if (encryptionPasswordError) throw encryptionPasswordError;
+        if (data.encryptionPassword === data.encryptionPasswordHint) throw new BoxError(BoxError.BAD_FIELD, 'password hint cannot be the same as password');
         encryption = hush.generateEncryptionKeysSync(data.encryptionPassword);
         encryption.encryptedFilenames = !!data.encryptedFilenames;
         encryption.encryptionPasswordHint = data.encryptionPasswordHint || '';
@@ -519,7 +520,7 @@ async function add(data, auditSource) {
     const limits = data.limits || null,
         encryptionPassword = data.encryptionPassword || null,
         encryptedFilenames = data.encryptedFilenames || false,
-        encryptionPasswordHint = data.encryptionPasswordHint || null;
+        encryptionPasswordHint = data.encryptionPasswordHint || '';
 
     const formatError = backupFormats.validateFormat(format);
     if (formatError) throw formatError;
@@ -534,6 +535,7 @@ async function add(data, auditSource) {
     if (encryptionPassword) {
         const encryptionPasswordError = validateEncryptionPassword(encryptionPassword);
         if (encryptionPasswordError) throw encryptionPasswordError;
+        if (data.encryptionPassword === data.encryptionPasswordHint) throw new BoxError(BoxError.BAD_FIELD, 'Password hint cannot be the same as password');
         encryption = hush.generateEncryptionKeysSync(encryptionPassword);
         encryption.encryptedFilenames = !!encryptedFilenames;
         encryption.encryptionPasswordHint = encryptionPasswordHint;