Duplicati

Overview

Duplicati is an open-source backup client with US-based maintainers, started around 2008, running on Windows, macOS, and Linux. Its goal is to encrypt and deduplicate local or server data and push it to arbitrary remote storage, from object stores to SFTP, WebDAV, and OneDrive.

It differs from sync tools like rclone by being a backup product, with version history, incremental chains, block-level deduplication, and integrity verification, so restores pick a specific version rather than hunting through a directory tree. For returning to last Wednesday's state, that difference decides the tool.

Its issues follow from the same design. Version history and dedup indices add structural complexity, and long-running deployments have reported index corruption and upgrade compatibility problems. Treat it as one link in a Backup & Migration chain rather than the only copy, keeping at least two independent mechanisms.

Core Strengths

• Block-level deduplication stores duplicates once, so multi-version archives stay far smaller than stacked full backups
• End-to-end AES encryption with self-held keys keeps archives ciphertext even in third-party storage
• 20+ targets spanning object storage, SFTP, WebDAV, and cloud drives, covering self-hosted and SaaS environments
• Both a web UI and a CLI, so non-operators can still schedule jobs

Product Ecosystem

Version chains and dedup storage

Each run writes only changed blocks and restores by version. Retention is the key setting, since too many versions fragment remote storage and slow restores while too few remove the rollback value, so a weekly plus monthly pair is typical.

Encryption and targets

A lost passphrase means unrecoverable data, so keep it offline, and prefer buckets with object lock to stop ransomware clearing history. Always run a full restore drill rather than trusting a green job status.

Drawbacks

• Index corruption and upgrade compatibility issues have been reported in long-running deployments, requiring periodic verification and rebuilds
• The web UI slows on very large jobs, and complex setups still need CLI or config files
• Large restores demand memory and disk IO, so low-spec VPS instances perform poorly
• Community-driven support, with enterprise SLAs and professional services sourced separately

Use Cases

• Encrypted backups of self-hosted servers (★★★★☆) - Dedup, encryption, and multiple targets suit pushing VPS data to object storage
• Scenarios needing version rollback (★★★★☆) - Version-based restores beat sync tools for returning to a specific day
• Zero-budget personal projects (★★★★) - Free and open source, with cost limited to storage and time
• Enterprise SLA requirements (★★) - No official SLA or professional services, so critical systems need a commercial complement

Pricing

The software is free and the real spending is storage plus operations time. Archives are encrypted by default, so a forgotten passphrase equals data loss, which means passphrase handling belongs in the runbook and stored separately from the backups.

FAQ

• What if I lose the passphrase? It is unrecoverable. Duplicati encrypts end to end with no backdoor or reset path, so the passphrase must be stored offline somewhere separate, ideally in a password manager plus a physical copy.

• Duplicati or rclone? Version rollback points to Duplicati, mirroring or cross-cloud migration points to rclone. Many teams run both, with rclone for mirrors and Duplicati for versioned backups.

• Is a green job status enough? No. Success only means the write did not error, while index damage or missing files can hide behind it. Sample restores monthly and run a full restore drill quarterly.