Several backup services make it easy to hand over your files and let someone else handle the storage. You’re entrusting their safety to whoever is storing them, hoping they stay private. I’ve simply never liked this model. I wasn’t expecting Duplicati to be much different. In fact, after installing it and backing up my files, I went looking for them on my connected storage, expecting to find them sitting there. But I didn’t find anything that looked like them, and that absence is the entire reason Duplicati has become the backup tool I trust most.

My file left home and came back a stranger

I backed up a photo, then went looking for it — and couldn’t find it

Credit: Tashreef Shareef / MakeUseOf

One of the first files I backed up was a photo. It felt like a basic file, but on my backup destination, instead of seeing what looked like that exact photo I had sent, the files didn’t have familiar filenames. Looking at the destination, I saw a lot of data, but none initially felt recognizable.

I found this quite interesting. Duplicati wasn’t copying my files to a destination like I was used to after years of using OneDrive and Dropbox. It processes my files on my computer before handing the resulting backup to the destination I chose. For me, this was an external drive.

Your backup location could be a network location or a storage service. There is a long list of destinations you may configure, including S3-compatible storage, Backblaze B2, Azure, SFTP, and WebDAV.

What I liked is the clear distinction that Duplicati allows: the software that makes the backup and the backup location itself, by extension the company or machine holding it, are two different things. I love the distinction, because it allows me more flexibility with storage locations.

Whoever’s storing my backup can’t simply open it

My passphrase never left my computer, and that’s the whole point

Those strange-looking files in my backup location were initially confusing, but that changed once I understood what Duplicati does before sending the files anywhere. It processes and encrypts files locally before sending them; by default, Duplicati uses AES-256, and you control the passphrase.

Any storage provider that ultimately stores my files gets encrypted backup data, so no neat copy of my photos and documents. The same is true even if you use Duplicati’s own integrated storage. The data is encrypted before sending and the passphrase is kept on the local machine.

Regardless of the storage destination, even though I still trust someone to store my backups, they have far less to work with. If an intruder accesses my storage, just by browsing through the encrypted backup data, they wouldn’t be able to open the backed-up files without the encryption passphrase.

However, your backups are not indestructible just because they are encrypted. An intruder or storage provider may delete the backups; you could lose access to them; or they could become unavailable during an outage.

Also, since I keep the encryption passphrase myself, Duplicati can’t simply reset my access and unlock my backup if I lose the passphrase. That protection also puts the responsibility on me to maintain access to the backup.

My computer kept a secret I didn’t ask for

Turns out “storing nothing” comes with one asterisk

Even though Duplicati isn’t storing my actual backups on its servers, information about the backups is still on my computer. Initially, I didn’t appreciate this, but it made sense later.

The local database helps Duplicati to keep track of the backups at your destination; this is why it can perform later backups without treating the entire data as new.

In addition to this, Duplicati has a server database on the machine running it, where it stores backup configuration and sensitive information such as encryption credentials and connection details. Even though it doesn’t hold the backup itself, it still knows information about the backups.

The database is somewhat like a map of the actual backup, even though it’s not the backup itself. So even if I lose the local database, Duplicati can recreate the information it needs by reading metadata from the remote backup. When my computer dies, or I replace it, I can reinstall Duplicati and access the backup again, as long as I still have the information needed to reach the destination and the encryption passphrase.

I wiped my computer to see if the backup would survive

I had used Duplicati for a while, and it was nice to see a set of encrypted files in my backup destination. However, the true test of backup is restoring files. I put it to the test. I set it up on a different machine, pointed it at the same backup path, and supplied the access information. I then tried restoring the same photo I had backed up.

Duplicati turned what had looked like meaningless data just a few seconds earlier back into the photo I had originally saved.

For years, I used backup systems that held my data, but with the range of backup destinations Duplicati offered, I finally found a backup tool that didn’t require the storage provider to hold my original files. This was a welcome change.

OS

Windows, Linux, macOS

Developer

Duplicati

Duplicati is an open-source backup client. It creates encrypted, incremental, and compressed backups of local files to various cloud storage services.