A backup application with a browser interface that writes encrypted, deduplicated, incremental backups to more than twenty storage backends including S3, Backblaze B2, OneDrive, Google Drive, WebDAV and SFTP. It replaces consumer cloud backup subscriptions with storage you rent directly.
Our verdict on Duplicati#
Yes, it finally shipped. Duplicati 2.1.0.4 became the first stable release of the 2.x codebase on 31 January 2025, ending roughly eight years of recommending a beta as your backup tool, and the stable line has moved since: 2.2.0.0 in October 2025 and 2.4.0.0 on 3 September 2026, which added PAR2 parity data for remote volumes and a native VSS provider on Windows. The stable release is the one to run. Two things came with the 2.1 rewrite that bite existing users: it moved to .NET 8 with OS-specific builds and a mandatory web interface password, and automatic updating was removed, so you now patch it yourself. Its structural weakness is unchanged. Every job keeps a local SQLite database that mirrors the remote, and when that database and the remote disagree you are in for a recreate that can run for hours while it re-downloads volumes. Restores work without it, but the tool feels broken while it happens.
Who Duplicati is for#
Choose it if
- Someone who wants a scheduled encrypted backup they can configure in a browser, on a machine where nobody will ever write a cron job.
- Backing up to consumer storage that restic and Borg do not speak natively: OneDrive, Google Drive, Dropbox, Jottacloud, pCloud.
- A Windows desktop that needs open-file snapshots, which 2.4.0.0 now does with a native VSS provider instead of a VCRedist dependency.
- Households where the person who set it up will not be the one clicking restore.
Look elsewhere if
- Your backup set is millions of files or many terabytes. The per-job SQLite database and database recreate times are where Duplicati stops being pleasant.
- You want the backup process to be a single auditable command. Duplicati is a service with a web UI and a database, and that is more moving parts than restic or Borg.
- You need append-only or immutable remote storage enforced by the tool; Duplicati's client holds delete rights on the destination by design.
What running it actually looks like#
One container or one host service, listening on 8200. The Docker image is duplicati/duplicati and it needs /data mounted for the server database, job databases and configuration, plus read-only mounts of whatever you are backing up. Since 2.1.0 the web interface requires a password, so a container that starts without DUPLICATI__WEBSERVICE_PASSWORD set is not usable, and reaching it by hostname rather than IP also needs DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES. Set SETTINGS_ENCRYPTION_KEY at first run: it encrypts the credentials stored in the server database, and adding it later is more work. First run walks you through creating a job and picking a passphrase. Upgrades migrate the databases automatically (2.1.0 moved settings to v8 and job databases to v13), but there is no self-update any more, so you pull the new image or package yourself.
Resource profile#
- Memory
- 200 MB idle, around 700 MB in ordinary use. Estimates for a .NET 8 process with the web server running and one job active. Memory tracks the working set of the job's SQLite database and the block size in use, so old jobs still on the small legacy block size are the expensive ones.
- CPU and acceleration
- Compression and AES encryption during upload, plus a lot of SQLite work; database recreate and repair operations are CPU and IO bound for hours on large jobs, not minutes.
- Storage growth
- Remote volumes (dblock files) default to 50 MB with a 1 MiB deduplication block size on jobs created since 2.1.0. The local databases grow with block count, which is why an old job with the legacy small block size can carry a multi-gigabyte SQLite file.
- Operational load
- 3 of 5, Moderate. A real service with a per-job SQLite database, a web UI to secure, and a documented recovery path that involves rebuilding databases from the remote. Upgrades are manual since automatic updating was removed in 2.1.0, and the four release channels mean you have to think about which build you are on.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
Back up /data, which holds Duplicati-server.sqlite and every job's local database. That is the fast path, not the only path. The local database is described in the documentation as a compact view of what is already on the remote, so it can always be recreated from the destination; what you lose in a recreate is log history and remote volume hashes, not data, and restores are possible with no local database at all through the standalone restore flow. The passphrase is the real single point of failure, and it is stored in the server database, so if that database is encrypted with SETTINGS_ENCRYPTION_KEY you now need both. Write the backup passphrase down somewhere off the machine. Let the automatic sample verification run rather than disabling it for speed.
Derived backup shape
SQLite backup. sqlite3 <db> ".backup out.db" while running, or stop the container and copy. A live cp of a WAL-mode SQLite file can restore corrupt.
Traps and surprises#
Database recreate is the thing that ruins your evening
When the local job database is lost or disagrees with the destination, Duplicati rebuilds it from remote index files, and if those are insufficient it starts pulling down dblock volumes. On a large job that is hours of downloads and SQLite work, with a progress bar that appears stuck around the same percentage for a long time. It is not corruption and no data is lost, but do not start it ten minutes before you need a restore.
Mandatory password broke unattended container upgrades
2.1.0 introduced a compulsory web interface password and a new authentication scheme. Containers and services that used to come up with an open UI now refuse access until DUPLICATI__WEBSERVICE_PASSWORD is provided, and requests using a hostname are rejected unless that hostname is listed in DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES. People upgrading a long-running container hit both at once and conclude the image is broken.
Block size is fixed for the life of a job
2.1.0 raised the default deduplication block size to 1 MiB, which is a large improvement for big backup sets, but the change only applies to jobs created afterwards. Existing jobs keep the small legacy block size forever, and that is the main reason old installs carry huge job databases and slow recreates. The only fix is creating a new job and a new backup set, which means re-uploading everything.
Channel version numbers do not sort the way you expect
Duplicati ships canary, experimental, beta and stable in parallel, and the version numbers interleave. In early September 2026 the newest stable was 2.4.0.0 (3 September) while the newest beta was 2.3.1.1 (26 August), so someone on the beta channel was running an older feature line than someone on stable. Pick stable and stay there unless you have a specific reason, and check dates rather than version ordering.
No automatic updates since 2.1.0
The in-app updater was removed in the first stable release. Duplicati now expects to be updated by whatever installed it: your package manager, your container image pull, or a manual MSI. Installs that were relying on self-update quietly stop receiving fixes and stay on the old build indefinitely, which is a bad property for the software that owns your backups. Wire it into your normal patching.
Specifications#
- Category
- Backup and object storage
- Licence
- MIT (Permissive)
- Written in
- C# / .NET 8
- First release
- 2008
- Maturity
- Stable
- Datastore
- SQLite: one server database plus one local database per backup job
- Default ports
8200- Ships as
- docker, deb/rpm package, MSI/PKG installer, native binary
- arm64 builds
- Yes
- Identity
- Local accounts only. Local password only, mandatory since 2.1.0. Proxy setups are supported through `DUPLICATI__WEBSERVICE_PRE_AUTH_TOKENS`, but there is no OIDC or LDAP.
- Replaces
- Backblaze Personal Backup, Carbonite, CrashPlan, IDrive
- Project site
- duplicati.com
- Source
- github.com/duplicati/duplicati
- Documentation
- docs.duplicati.com
Alternatives to Duplicati#
Everything else in backup and object storage, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| Garage | 3, Moderate | 150 MB | AGPL-3.0-only |
| BorgBackup | 2, Light | 80 MB | BSD-3-Clause |
| Kopia | 2, Light | 200 MB | Apache-2.0 |
| MinIO | 4, Heavy | 250 MB | AGPL-3.0 (repository archived) |
| rclone | 2, Light | 40 MB | MIT |
| restic | 2, Light | 100 MB | BSD-2-Clause |
Where Duplicati comes up elsewhere#
Head to head
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.