Encrypted Backups on Cloud: Duplicati Guide

Yes, you can store encrypted backups on cloud services like Google Drive, OneDrive, and S3-compatible storage using Duplicati, and doing so is a solid way to keep your data private. Duplicati is a free, open-source backup program that encrypts your files locally before uploading them, so the cloud provider only sees unreadable ciphertext. This article explains how Duplicati’s encryption works, how to set it up, what to watch out for, and how it compares to other backup tools.

Formula

The calculator estimates how many backup versions you’ll keep and how much cloud storage they’ll consume. The number of backups kept is:

n = floor(d / t)

where d is the retention period in days and t is the backup interval in days. Total storage is simply the number of backups multiplied by the average size of one backup:

total = n × gb

This assumes each backup is full-size and independent. In practice, Duplicati uses deduplication and incremental backups, so the actual storage used is usually much lower—often 10–30% of the full size for daily changes.

Worked Example

Using the defaults: interval = 7 days, retention = 30 days, average backup size = 10 GB.

1. Number of backups: floor(30 / 7) = 4 (since 30/7 ≈ 4.28, you keep 4 full versions).
2. Total storage if each were full: 4 × 10 GB = 40 GB.
3. With deduplication, if only 2 GB changes per backup, the real total might be 10 + 2×3 = 16 GB.

The calculator shows the worst-case (no deduplication) figure. Use it to plan your cloud quota.

How Duplicati Encryption Works

Duplicati uses AES-256 encryption in CBC mode by default, with a key derived from your passphrase via PBKDF2. Before any data leaves your computer, it is encrypted and split into small blocks (typically 100 KB each). These blocks are then uploaded to your chosen cloud provider. The provider sees only random-looking files—no filenames, no folder structure, no file sizes beyond block size. Even the metadata (file names, dates, permissions) is encrypted inside the backup archive.

You can also choose to encrypt with GPG (GnuPG) instead of the built-in AES, but the default is fine for most users. The passphrase is the only key—if you lose it, your backup is unrecoverable. There is no backdoor.

Setting Up Duplicati for Cloud Backup

Duplicati supports a wide range of cloud targets: Google Drive, Microsoft OneDrive, Dropbox, Amazon S3, Backblaze B2, Box, and many others via WebDAV or SFTP. The setup process is similar across all of them.

1. Download and install Duplicati from the official site (duplicati.com). It runs as a local web service, accessed via your browser.
2. Click “Add backup� and choose a name and encryption mode. Select “Encryption: AES-256� and enter a strong passphrase. Store this passphrase in a password manager.
3. Choose the destination: pick your cloud provider from the list, then authenticate (usually via OAuth) or enter API keys.
4. Select the folders you want to back up. You can exclude certain subfolders or file types.
5. Set a schedule (e.g., daily at 2 AM) and retention policy (e.g., keep backups for 30 days).
6. Run the first backup. It will upload all data, which may take a while depending on your connection.

After the first full backup, subsequent runs are incremental, uploading only changed blocks. This keeps bandwidth and storage usage low.

Common Problems and Misconceptions

One common misconception is that encryption makes backups immune to cloud provider issues. It doesn’t—if the provider loses your data, you lose your backup. Encryption only protects confidentiality, not availability. Always follow the 3-2-1 rule: three copies, two different media, one offsite. Duplicati to cloud counts as one offsite copy.

Another issue is passphrase recovery. Duplicati does not store your passphrase anywhere. If you forget it, there is no way to recover the data. Write it down and keep it safe.

Performance can be an issue with very large backups (hundreds of GB). Duplicati is single-threaded for some operations, so CPU can become a bottleneck. Also, cloud API rate limits can slow down uploads. If you hit these, consider backing up in smaller chunks or using a provider with higher limits.

Corrupted backups can happen if the local disk runs out of space during a backup or if the cloud connection drops mid-upload. Duplicati has a “repair� function that can rebuild the backup index, but it requires the passphrase. Run a test restore periodically to verify your backups are usable.

Duplicati vs. Other Tools

Compared to built-in cloud sync (like Google Drive’s folder sync), Duplicati offers versioning and encryption. Sync tools replicate deletions and don’t keep historical versions. Duplicati keeps point-in-time snapshots, so you can recover a file from last week even if it was deleted yesterday.

Compared to other backup tools like Restic or BorgBackup, Duplicati is easier for non-technical users because it has a web GUI. Restic is command-line only but often faster and more memory-efficient. Borg requires a Linux server or SSH target, not ideal for cloud-only users. Duplicati’s main advantage is its broad cloud support and user-friendly interface.

One downside: Duplicati’s development has been slow in recent years, and some users report bugs with certain cloud providers. However, for typical home and small business use, it remains a reliable choice.

Cost and Storage Considerations

Duplicati itself is free. You pay only for cloud storage. Prices vary widely: Google Drive and OneDrive offer a few GB free, while S3 and Backblaze B2 charge per GB/month. To estimate your monthly cost, use the calculator above to find total storage, then multiply by the provider’s per-GB price. For example, 40 GB on Backblaze B2 at $6/TB/month would cost about $0.24/month. On Google Drive, 100 GB costs about $2/month.

Be aware of egress fees—some providers charge to download data. Backblaze B2 gives free egress up to 3x your storage, while AWS charges after a free tier. If you plan to restore often, factor this in.

Also consider that Duplicati compresses data before encryption (using zip or 7z), which can reduce storage further, especially for text files. Enable compression in the backup options to save space.

Safety and Security Best Practices

To maximize safety:

• Use a strong, unique passphrase (at least 16 characters, mix of cases, numbers, symbols).
• Enable two-factor authentication on your cloud account to prevent unauthorized access to the backup files.
• Store the passphrase in a password manager, and consider writing it on paper and keeping it in a safe deposit box.
• Test restores monthly—restore a single file and a folder to verify integrity.
• Keep Duplicati updated to the latest version to get security patches.
• If you back up sensitive data like financial documents or medical records, encryption is essential—your cloud provider could be breached, but encrypted data remains unreadable.

Remember, encryption protects against unauthorized access, but it does not protect against data loss. Always maintain a second backup on a different medium, such as an external hard drive.

Frequently Asked Questions

Q: Can I use Duplicati with Google Drive for free?
A: Yes, Google Drive offers 15 GB free storage. If your backup fits within that, you can use Duplicati for free. However, be aware that Google may throttle API requests, so large backups might be slow. For more space, you may need a paid plan.

Q: What happens if I forget my Duplicati passphrase?
A: Your backup becomes unrecoverable. Duplicati does not store the passphrase anywhere, and there is no recovery mechanism. You would need to delete the backup and start over. Always keep a copy of your passphrase in a safe place.

Q: Does Duplicati encrypt file names?
A: Yes, file names and folder structures are encrypted as part of the backup metadata. The cloud provider only sees random block IDs and cannot infer what files you have.

Q: Can I restore a single file from a Duplicati backup?
A: Yes, you can browse the backup contents and restore individual files or folders. Duplicati downloads only the necessary blocks, so it’s efficient even for large backups.

Q: Is Duplicati safe to use with Backblaze B2?
A: Yes, Backblaze B2 is a supported destination and works well with Duplicati. B2 is designed for backups and offers low egress fees, making it a popular choice. Just ensure you have your passphrase backed up.

Q: How much storage do I need?
A: Use the calculator above to estimate. For a typical 100 GB folder with daily changes of 1%, a 30-day retention might use around 130 GB (100 + 30×1). But with deduplication, it could be less. Always plan for 1.5× your initial estimate to be safe.

Related

• Is Nextcloud Worth Self-Hosting?
• Restore Closed Tabs? How to Reopen in Any Browser
• Kodi vs Plex: Which Media Server Is Right?

in t | Backup interval (days) | days | 7 | 1 | 365
in d | Retention (days) | days | 30 | 1 | 3650
out n | Backups kept | backups | floor(d / t) | 0
out gb | Data per backup (GB) | GB | 10 | 0.1 | 10000
out total | Total stored (GB) | GB | gb * n | 0