How Does Duplicati Keep Backups Secure?

Updated

Duplicati protects backups by encrypting data on your machine before it is sent to storage, so the storage provider only ever holds encrypted files. This applies to the free, open-source Duplicati engine and to the platform described on duplicati.com, which is built around zero-trust, fully encrypted backups. The practical result: anyone with access to your bucket, NAS, or cloud account sees ciphertext, and only someone holding your passphrase can restore the data.

Encryption happens before data leaves the machine

The security model starts at the client, not at the storage destination. Duplicati encrypts backup data locally and then uploads it, which is why the site describes the backups as "zero-trust" and "fully encrypted." The storage provider is treated as untrusted by design — it stores and serves files, but it is not given the keys needed to read them.

This is the key difference from backup tools that rely on server-side encryption, where the provider holds the keys. With Duplicati, the encryption boundary is your own device.

What "zero-trust" means here

Zero-trust in this context is about not trusting the storage layer with your plaintext:

  • Encryption is applied before upload, so the destination never receives readable data.
  • The storage provider is not part of the trust boundary. Whether you use AWS S3, Azure Blob Storage, Wasabi Hot Storage, Backblaze B2, WebDAV, SFTP, or local hardware, the data arrives already encrypted.
  • Access is controlled by your passphrase, not by the provider's account permissions. Someone who gains access to your storage account still cannot read the backup contents without the passphrase.

You choose the storage, so you control exposure

Duplicati's "Bring your own storage (BYOS)" model means you decide where encrypted data lands. The site lists several supported directions:

Direction Example from the site
On-prem to cloud Local servers, NAS, desktop, and laptop to AWS S3, Azure Blob Storage, Wasabi Hot Storage, or Backblaze B2
Cloud to on-prem Microsoft 365, Google Workspace, or S3 buckets to an on-prem SAN or private S3 cluster
Local to local Local machine backups to NAS via SFTP or SMB, keeping traffic on the internal network

Because encryption happens first, the choice of destination affects availability, cost, and data-sovereignty compliance — not whether the data is readable by the provider.

Independent platform backup and centralized control

The site describes "Independent Platform Backup" and a console that manages encrypted backups across S3, WebDAV, SFTP, and local hardware. For organizations, the relevant security features are:

  • Centralized backup policies — create a configuration once and push it to multiple clients, so encryption settings are applied consistently rather than per-machine.
  • Silent, agent-based deployment — agents run in the background and are not accessible on the host, reducing the chance of local tampering or casual access.
  • Multi-site management — global admins can delegate local backup management to regional IT staff while keeping a clean separation between departments.

What to verify before you rely on it

Encryption strength depends on how you configure and protect the backup:

  1. Set a strong passphrase and store it safely. Duplicati encrypts before upload, but a weak or lost passphrase undermines either confidentiality or recoverability.
  2. Test a restore. Confirm you can decrypt and restore from your chosen destination before you need it.
  3. Keep the passphrase out of the storage account. If the passphrase and the encrypted data sit in the same compromised account, the zero-trust benefit is reduced.

For the exact encryption options and defaults, check the Duplicati documentation for your version, since the site's overview focuses on the zero-trust, fully encrypted model rather than specific cipher settings.