Duplicati review: encrypted backups you choose

Duplicati is free open-source backup software that stores encrypted, compressed copies of your files on a cloud service or a file server you choose.¹ It is for someone who wants those copies on a schedule from a Windows, Mac, or Linux computer.¹ The data is scrambled with AES-256, a way to lock data with a passphrase, before it is uploaded.¹ A lost passphrase cannot be recovered.⁶

Last checked October 28, 2026.

At a glance

What it is: A backup program that encrypts files, then sends the copies to storage you choose.¹

Works on: Windows, macOS, and Linux. The install guide also covers Docker and a Synology package.¹⁷

Price: Free to download. You choose the cloud service or file server that stores the copies.¹

Licence: MIT for the core. Files in the proprietary/ folder use a separate licence.²

Best for: Scheduled, encrypted backups from a computer you look after.

Official site: duplicati.com

What Duplicati does (and how it protects your privacy)

Duplicati is a backup client: the program on your computer that makes the copies. It stores encrypted, incremental, and compressed backups on cloud storage and remote file servers.¹ The first backup holds the full contents. Later backups are differential, the project’s word for storing the changes, so the upload stays smaller.¹ You can include whole folders, only some file types, or a custom filter.¹

The privacy benefit is where the scrambling happens. Duplicati uses AES-256, or GNU Privacy Guard if you choose that instead, to secure the data before uploading.¹ The built-in method follows the AES Crypt format. Duplicati 2.4 still writes version 2 of that format unless you set version 3, which uses a stronger key derivation.³ Each uploaded volume, one of the backup files, gets its own random key, plus an HMAC, a check value that fails if the encrypted file is changed.³ The storage service receives those encrypted volumes.

A scheduler can run the job, and the list of destinations includes S3, SFTP, WebDAV, FTP, and common cloud drives.¹ The welcome page can offer the Duplicati Console, a separate management site. Choose to proceed without connecting if you want the program on its own.⁷

Key features of Duplicati

Encryption before upload: Built-in AES-256, or GNU Privacy Guard if those programs are installed.¹³
Smaller later backups: The first run is the full set. Later runs store the changes.¹
A schedule: Duplicati can start the job on its own.¹
Storage you pick: S3, SFTP, WebDAV, FTP, and several cloud drives.¹
Filters: Whole folders, chosen file types, or rules you write.¹
Open files: Volume Snapshot Service on Windows, Logical Volume Manager on Linux.¹
Old copies: Smart backup retention keeps a daily copy, then fewer as they age.⁶
Two ways to run it: A browser page with a tray icon, or the command line.¹⁷

Pros and cons

Pros

Free, open-source client. The core uses the MIT licence.¹²
AES-256 encryption happens before the upload.¹
You choose the cloud service or file server. Each backup needs its own folder.¹⁶
Windows, macOS, and Linux, with the page opening in your browser.¹⁷
Stable release 2.4.0.1, dated 7 October 2026, focuses on restore, abort handling, and hardening of the server and remote control.⁸
From version 2.3 the saved passphrase is encrypted by default, using Windows Credential Manager, the macOS Keychain, or libsecret on Linux.⁵

Cons

A lost passphrase cannot be recovered.⁶
Encryption can be turned off. The setup guide says to do that only when you control the destination and already protect it.⁶
Usage reports stay on until you opt out. The settings switch still allows one startup report unless an environment variable is set first.⁴
On a Linux machine with no keyring, the settings database does not encrypt the passphrase unless you supply a key.⁵
Downloads are for Windows, macOS, and Linux, plus Docker and Synology. No phone app is listed.¹⁷
Files under proprietary/ in the source repository follow a separate licence, not the MIT text that covers the core.²

Is Duplicati safe and private?

AES-256, or GNU Privacy Guard, is applied before uploading.¹ Each AES Crypt volume has its own random key and an HMAC, so a changed file can be detected.³ GNU Privacy Guard’s default is CAST-128 unless you pass your own arguments, and it needs the GPG programs installed.³

The passphrase and storage passwords sit in Duplicati-server.sqlite on the backup computer.⁵ From version 2.3 those sensitive fields are encrypted by default, with the key in Windows Credential Manager, the macOS Keychain, or libsecret on Linux.⁵ A Linux machine with no keyring leaves the fields unencrypted until you set a key.⁵ Keep a spare passphrase. BellCrier’s password generator can make one, and on Linux gocryptfs can store a copy in an encrypted folder. A lost passphrase cannot be recovered.⁶

The project collects what it calls non-identifying telemetry: version, operating system, and, during a backup, connection type, duration, and file-set size.⁴ Choose “None / disabled” in Settings. To send nothing, including the startup event, set USAGEREPORTER_Duplicati_LEVEL=none before the first launch.⁴ Version 2.4.0.1 (7 October 2026) can limit other reports to message ids, counters, and dates, with no message text, errors, or file names.⁸ Login is hardened against weak passwords, and each remote-control request needs its own key.⁸

Duplicati Inc holds the 2026 copyright. The core is MIT, and proprietary/ uses a separate licence when that folder is present.² Releases are described as GPG-signed with public key 3DAC703D.¹ The 7 October 2026 notes call 2.4.0.1 a stable patch for 2.4.0.0.⁸

How to get started with Duplicati

Download stable 2.4.0.1, dated 7 October 2026, from the stable package list.⁸⁹ Windows uses an MSI (most likely x64; Arm64 and legacy 32-bit are listed). A Mac uses a DMG, Arm64 for Apple silicon and x64 for Intel, then you drag the app into Applications. Debian and Ubuntu use a .deb. Fedora, Red Hat Enterprise Linux, and SUSE use an .rpm. Other Linux systems can use a zip, and the GUI package is also an AppImage.⁷
Start Duplicati. It opens in your browser. Choose “Proceed without connecting to console”, then confirm, to keep management on this computer.⁷
Choose “Add backup”, then “Add a new backup”. From version 2.4.0.1 the order is name and passphrase, folders, destination, schedule, then retention.⁶ Leave encryption on, use the built-in passphrase generator if you want, and save that passphrase where you can still open it.⁶
Give the backup its own destination folder. Two backups in one folder will keep breaking each other. Use “Test now”, then continue.⁶
Turn the scheduler on. “Smart backup retention” keeps one daily backup, then fewer versions further back.⁶ Submit, let one backup finish, and restore one unimportant file so you know the copy opens.

Who should use Duplicati (and who might prefer something else)

Duplicati fits a home computer when you want encrypted backups on a schedule. It suits Windows, macOS, and Linux, with a cloud service or file server you already have.¹ You can skip the console and stay on the local browser page.⁷

For a desktop window on Borg backups, try Vorta. For the restic format in a browser, try Backrest. Duplicati is the closer match when one program should talk to many storage services and keep the schedule itself.¹

Frequently asked questions

Is Duplicati free?

Yes. It is a free, open-source client, and the MIT licence grants permission free of charge.¹² You choose the cloud service or file server. The welcome page can offer the Duplicati Console, and you can continue without it.¹⁷

Is Duplicati safe?

Volumes are encrypted with AES-256 before upload, and each AES Crypt volume has an HMAC.¹³ A lost passphrase cannot be recovered.⁶ Usage reports are on unless you opt out, and the saved passphrase is encrypted by default from version 2.3 when the computer has a keyring.⁴⁵

Does Duplicati work on Windows and Mac?

Yes. Windows uses an MSI, and a Mac uses a DMG. The first start opens in the browser.⁷ Stable version 2.4.0.1 is dated 7 October 2026.⁸

Does Duplicati work on iPhone?

The project lists Windows, macOS, and Linux, and the install guide adds Docker and Synology.¹⁷ Those pages do not list an iPhone or Android app.¹⁷