Open Source Backup Software
Backup is the one tool you hope never to exercise, which is why its failures surface at the worst possible moment - a restore is the only real test, and plenty of backups pass every day until the day someone actually needs one. A copy that lives entirely inside a vendor's service is a dependency placed exactly where you need certainty most. The open source programs here do the deduplication and the encryption on your own machine, then write the result to storage you choose, from a local disk to object storage. Because the format and the restore commands are documented, you can prove a recovery works instead of trusting a dashboard's green checkmark.
restic
Fast, secure backup program with deduplication and support for local and cloud storage backends
Duplicati
Free, open-source backup client for encrypted, incremental cloud backups
Kopia
Cross-platform backup and restore tool with encrypted snapshots, deduplication, and CLI plus GUI
BorgBackup
Deduplicating backup software with compression, authenticated encryption, and SSH storage
Velero
Kubernetes backup and migration tool for cluster resources and persistent volumes
Backrest
Web UI and orchestrator for restic backups with snapshot browsing and restore
Vorta
Qt desktop front-end for BorgBackup on macOS and Linux
BackupPC
Open source backup system for storing Linux, Windows, and macOS backups on a server disk
Bareos
Open-source backup software for cross-network data protection, archiving, and recovery
Our picks
Encrypted, deduplicated file backups: restic restic is a single-binary command-line tool that stores encrypted, deduplicated snapshots, so each run adds only the data that changed and the repository stays confidential even on untrusted storage. It writes to local disks, SFTP, a REST server, and the major clouds, and can verify stored data is restorable. Backrest adds a graphical layer without hiding the engine.
Deduplicating backups over SSH: BorgBackup BorgBackup uses content-defined chunking to store only the chunks it has not seen, with client-side authenticated encryption and optional compression. It targets any host reachable over SSH and mounts archives as a file system for browsing and partial restores. Vorta gives it a desktop interface on macOS and Linux.
Backups with both CLI and GUI: Kopia Kopia creates encrypted, deduplicated snapshots with end-to-end encryption and error correction, storing to local, NAS, or cloud backends including S3, Azure, and B2. It ships both a command-line tool and the KopiaUI desktop app, and a repository server lets several machines share one storage location.
Kubernetes cluster backups: Velero Velero backs up and restores Kubernetes cluster resources and persistent volumes, and doubles as a migration tool for moving or replicating a cluster to development and test environments. It runs as a server in the cluster with a local CLI client and is a CNCF project. It is the specialized choice when what you protect is a cluster, not files.
What separates a backup that restores from one that does not
A backup is only ever tested at restore time, so choose for the recovery you will actually perform, not the job that runs quietly each night. Decide first what you are protecting: individual files, whole machines for bare-metal recovery, live databases that must be captured consistently, or a Kubernetes cluster. That last case is specialized enough that Velero exists only for it, while restic, BorgBackup, and Kopia focus on encrypted, deduplicated file backups. Copying a running database's files without coordinating with the engine is the classic way to produce an archive that looks fine and restores to garbage.
Then look at the repository format, because it shapes both cost and recovery. Chunked, deduplicating tools like restic, BorgBackup, and Kopia store only the blocks that changed, which saves space but depends on indexes and prune steps you should understand before a failure. Encryption should happen on your machine before anything leaves it, with keys documented separately from the repository. Confirm the same tool writes to local disk, a NAS, and object storage without changing how you restore, so the offsite copy is not a second procedure to learn.
Operations decide whether any of this survives a bad week: scheduling that fits your maintenance windows, retention that prunes the right generations, and loud alerts when a job is missed. Some people want a command line driven by scripts; others want a UI, which is where Vorta wraps BorgBackup and Backrest wraps restic without hiding the tool underneath. For many machines, client-server systems like UrBackup and Bareos centralize the work. Whatever you pick, run a real restore onto clean hardware before you rely on it.
Related categories
Frequently asked questions
How is backup software different from file sync?+
Sync keeps two locations matching; backup preserves recoverable history. If ransomware encrypts a synced folder, the damage syncs too and overwrites the good copy. Real backup software keeps point-in-time versions, applies retention rules, verifies stored data, and can restore to a different machine. Sync can be useful as transport, but on its own it is not a backup unless versioning and deletion protection sit on top of it.
How do I actually test that a backup will restore?+
Do a drill that starts without the original machine. Pick a date, retrieve the keys, restore to a clean virtual machine or spare hardware, and confirm the files or application actually open. Record how long it took and which manual steps were needed. A checksum-only verification, which tools like restic and Kopia can run, confirms the data is intact but does not prove permissions, bootability, or that you still know the procedure.
Can these tools back up databases safely?+
Only if you capture the database correctly. Copying its files while the service is running can produce an unusable backup. Use native dumps, transaction-log backups, or snapshots coordinated with the engine, often wired in through pre- and post-backup hooks that Backrest and other tools expose. For virtual machines, guest-aware hooks flush writes before the snapshot. Always verify by restoring into a separate instance and running an integrity check.
How do restic, BorgBackup, and Kopia differ?+
All three do client-side encryption and content-based deduplication, so daily backups add little beyond what changed. restic is a single command-line binary with broad cloud backend support and an optional web UI through Backrest. BorgBackup stores to any host over SSH and has Vorta as a desktop front end. Kopia ships its own CLI and KopiaUI and can point many machines at one repository. The right pick often comes down to backends and interface.
How do I protect backups from ransomware?+
Keep the backups separate from the systems they protect. Use credentials that can write new backups but not delete old ones, add append-only or immutable object storage where supported, and keep at least one offline or separately administered copy. Harden the backup server itself with patching and limited access. A ransomware plan also needs a clean restore environment, not just stored data, so include that in a drill.
Can I back up many machines from one place?+
Yes. Client-server tools are built for exactly this: UrBackup runs a central server that backs up Windows, macOS, Linux, and FreeBSD clients over the network, BackupPC pulls backups with no client-side software using rsync or SMB, and Bareos coordinates a director, storage daemons, and file daemons across a large fleet. These suit organizations with many endpoints better than a single-machine tool run per device.
What if the backup project stops being maintained?+
Your defense is a documented exit path. Prefer tools with an open repository format, standard encryption, and restore commands that work without a special web service, which most of the file-based tools here provide. Keep the installer for the version you run, export your configuration, and store recovery notes with your disaster documentation. If development slows, you can keep restoring while you evaluate a replacement rather than being stranded.