Kopia
FreeEncrypted, deduplicated incremental backup — you choose where it lands
A cross-platform backup tool with both a GUI and a CLI. Data is encrypted and deduplicated locally before upload, so only changed blocks travel. Destinations include local disks, NAS, S3, Backblaze B2, Google Drive and WebDAV — and the provider only ever holds ciphertext. Snapshots, retention policies and scheduling are built in.
Why we picked it
Backup is the thing that feels unnecessary until the day it defines your year. Most people's actual situation is important files dumped into cloud storage, or nothing at all. And cloud sync is not backup — delete a file by accident or get hit by ransomware and sync faithfully propagates the damage.
Kopia is a well-balanced choice for personal backup. 13,858 stars, Apache-2.0. It has a GUI (KopiaUI) that restic lacks, and it is faster and lighter than Duplicati.
What it gets right technically:
- Encrypt before upload. Encryption happens on your machine with keys you hold, so it makes no difference whether the destination is S3, B2 or someone's cloud drive — the provider stores ciphertext.
- Block-level deduplication. Files are split into blocks and identical blocks stored once. Keeping ten versions of a large file costs far less than ten times the space, and several machines backing up to one repository share their duplicate system files.
- Incremental snapshots. Every backup is a complete, browsable snapshot restorable to any point, while only new blocks are transferred.
- Retention policies such as "keep daily for 7 days, weekly for 4 weeks, monthly for 12 months", with old snapshots pruned automatically.
- Compression and verification on transfer and restore.
In practice, KopiaUI is a desktop application where a few clicks create a repository, pick directories and schedule runs; the CLI suits servers and scripts. Both use the same repository format and can be mixed.
To be clear about:
- Strategy matters more than the tool. Follow 3-2-1: three copies, two media types, one offsite. Backing up only locally dies with the disk; backing up only to one cloud dies with the account.
- Test your restores. A backup you have never restored from is not a backup. Immediately after setup, restore a few files to a different directory and confirm the process works.
- Lose the password and lose the data. That follows inevitably from end-to-end encryption. Store the repository password separately — in KeePassXC or Bitwarden — and make sure that vault is itself backed up.
- It is not a disk imaging tool. It backs up files and directories, not whole drives. Restoring an entire system onto a new disk is the job of Clonezilla, Macrium and similar.
If you currently have no backup at all, installing this and scheduling a daily run is the highest return on one hour available anywhere on this site.