borgbackup.org

BorgBackup stores your files as content-defined chunks and keeps exactly one copy of each identical chunk in the repository. That single rule is why a daily "full" backup costs little more than the changes since yesterday, while every historical version stays complete and browsable. The mechanism applies across files, across machines, and across years of history — so the savings compound the longer you use one repository.

The core mechanism: content-defined chunking

Borg does not treat a file as one indivisible object. It splits file content into variable-sized chunks, where the boundaries are determined by the content itself rather than by fixed offsets. This is what "content-defined" means: the same byte sequence tends to produce the same chunk boundaries regardless of where it sits in a file or which file it came from.

Each chunk is then identified by a hash. Before writing anything, Borg checks whether a chunk with that identity already exists in the repository:

• Chunk already present → it is not stored again; the archive simply references the existing copy.
• Chunk is new → it is compressed, encrypted, and written once.

Because identity is based on content, two identical chunks are indistinguishable to Borg whether they came from the same file, a different file, a different machine, or a backup taken three years ago.

What this looks like over time

The site's own visualization makes the arithmetic concrete. Three nightly backups of the same machine:

Across the three nights, 24 chunk occurrences were seen, but duplicates collapse into a single stored copy each. Night 2 reuses seven chunks and adds one; night 3 reuses six and adds one. The repository grows by the genuinely new data, not by the total data touched.

Two consequences follow directly:

• Daily full backups stay cheap. You can take a complete backup every night without the storage cost scaling with your total data size — it scales with your changes.
• History stays complete. Deduplication removes redundant storage, not redundant versions. Old chunks are retained, so you can still recover the state of a file from any prior archive.

Why it works across machines and years

The deduplication domain is the repository, not the individual backup run. Once a chunk exists in a repository, any later archive — from any source — that contains the same content will reference it rather than store it. This is why the site describes chunks as stored once "across files, across machines, across years of history."

A practical implication: pointing several machines at one repository lets them share chunks. If two machines hold identical files (a shared document set, the same OS packages, a common codebase), that content is stored once for both. The benefit is largest where content overlaps — repeated backups of similar data — and smallest where every byte is unique.

What Borg adds around the chunks

Deduplication is the storage-efficiency layer; the surrounding features determine what you can do with the result:

• Compression — each new chunk is compressed before storage. You choose the trade-off: lz4 for speed, zstd for balance, zlib and lzma for maximum squeeze, or none.
• Authenticated encryption — chunks are encrypted with AES plus cryptographic authentication. The backup server only ever sees ciphertext, so it does not need to be trusted.
• Mountable archives — any archive can be mounted as a regular filesystem via FUSE, so you can browse old versions of your files like any folder.
• No daemons or agents — a backup is one command against a repository on a local disk, a USB drive, or any machine reachable over SSH.

What to check before relying on it

• Repository scope determines savings. Chunks deduplicate only within a single repository. Splitting backups across separate repositories forfeits cross-source sharing.
• Compression choice affects cost, not correctness. It changes speed and size, not whether deduplication happens.
• Encryption means the server can't deduplicate for you. Because the server sees only ciphertext, all deduplication decisions happen client-side before data leaves your machine.

If your goal is to understand whether Borg will save you space: it will, in proportion to how much repeated content your backups contain. The more often you back up similar data to the same repository, the closer a "full" backup gets to costing only its changes.

BorgBackup encrypts every chunk it stores using AES with cryptographic authentication, so the repository only ever contains ciphertext. The practical consequence: the machine holding your backups never needs to be trusted, because it cannot read or undetectably alter what it stores. This applies to any repository you create with encryption enabled — local disk, USB drive, or a remote host reached over SSH.

What "authenticated encryption" means here

Borg combines two properties in one step:

• Encryption (confidentiality): data is unreadable without your key.
• Authentication (integrity): each chunk carries a cryptographic tag. If a chunk is modified, truncated, or swapped, Borg detects it and refuses to use it.

That second property is what separates Borg from tools that only encrypt. A malicious or compromised backup server sees ciphertext, and if it tries to tamper with it, the tampering surfaces as a verification failure rather than silently corrupting your restore.

Why the backup server doesn't need to be trusted

The page states this directly: "Your backup server never needs to be trusted — it only ever sees ciphertext."

The mechanism behind that claim:

1. Borg splits your files into content-defined chunks on the client.
2. Each chunk is encrypted and authenticated before it leaves the client.
3. The repository (local or remote) stores only those encrypted chunks.

So a remote host running borg serve handles opaque blobs. It can enforce quotas and access rules, but it has no path to your plaintext and no key material.

Encryption works together with deduplication and compression

These three features are not separate modes — they operate in the same pipeline:

A detail worth understanding: deduplication happens on chunk content, so identical data still collapses to a single stored copy even though each copy is encrypted. You get the space savings and the confidentiality at the same time.

What this means for your setup decisions

• You can use an untrusted remote host. A VPS, a friend's server, or a shared machine is viable because it only stores ciphertext.
• Losing your key means losing your data. Encryption is only as recoverable as your key management. Store the passphrase or keyfile somewhere separate from the repository.
• Integrity checking is built in. You can verify a repository and detect tampering or bit rot without decrypting everything by hand.

The one-command starting point

The page frames setup as a single command: point Borg at a repository — local disk, USB drive, or any machine reachable over SSH — and go. No daemons, no agents, no lock-in. Encryption is configured when the repository is initialized, so the protection described above is in place from the first backup onward.

For the exact borg init encryption modes and their trade-offs, the install and documentation pages on borgbackup.org are the authoritative source, since available modes and defaults can change between series.

BorgBackup (Borg) is a deduplicating backup program with compression and authenticated encryption. It stores your files as content-defined chunks, keeps identical chunks only once, and writes everything to a repository that can live on a local disk, a USB drive, or any machine you can reach over SSH. It runs on Linux, macOS, BSD and more, is BSD licensed, and has been developed in the open since 2015. If you want space-efficient, encrypted backups without daemons, agents, or lock-in, Borg is built for that job.

What Borg actually does

Borg's core behavior comes down to three mechanisms that work together on every backup:

• Deduplication. Files are split into content-defined chunks. Identical chunks are stored exactly once — across files, across machines, and across years of history. Because chunk boundaries follow content rather than fixed offsets, inserting or shifting data doesn't cascade into storing everything again.
• Authenticated encryption. Backups use AES encryption with cryptographic authentication. The backup server only ever sees ciphertext, so it never needs to be trusted.
• Compression. You pick the trade-off per repository: lz4 for speed, zstd for balance, zlib and lzma for maximum squeeze, or none at all.

The practical result: daily full backups cost little more than the changes since yesterday, and the storage side of the equation stays small even as history grows.

How deduplication plays out over time

The clearest way to understand Borg is to watch what happens across repeated backups of the same machine.

Across three nights, 24 chunks are seen but only 10 are stored. Duplicate chunks collapse into a single stored copy, so history stays complete while the repository stays small. This is why Borg can keep many restore points without the storage cost multiplying.

What you can do with a repository

• Back up with one command. No daemons, no agents. Point Borg at a repository and go.
• Target almost any destination. Local disk, USB drive, or a remote machine over SSH.
• Mount archives as filesystems. With FUSE, any archive can be mounted as a regular filesystem, so you can browse old versions of your files like any folder.
• Install the way that suits you. Distribution packages, single-file binaries, or pip.

When Borg fits — and when to look elsewhere

Borg is a strong choice if you:

• want encrypted backups where the storage host is untrusted,
• are backing up the same machine repeatedly and want history without proportional storage growth,
• prefer a command-line tool over a managed service, and
• can reach your backup target locally or over SSH.

It's a weaker fit if you need a fully managed, GUI-driven product, or if your backup target can't be reached by a filesystem path or SSH. Borg is free and open source under the BSD license; the site doesn't state pricing or account requirements, so treat availability as a matter of installing the software rather than signing up for a service.

Getting started

The official site offers install options by distribution and recorded terminal demos — real text sessions you can pause and copy from, rather than marketing footage. A reasonable first step is to install Borg from your distribution's packages, create a repository on a local disk or USB drive, and run a first backup to see how much deduplication saves on your own data before pointing it at a remote host.

BorgBackup offers five compression settings: lz4 for speed, zstd for a balance of speed and size, zlib and lzma for maximum compression, and none to disable compression entirely. You choose one per repository or per archive, so the right pick depends on whether you care more about backup speed, storage space, or CPU load on the machine running the backup.

The available compression options

Borg's own documentation describes the trade-off as a spectrum from fast to maximum squeeze:

Borg also lets you tune the level within a compressor (for example, different zstd or zlib levels), so "zstd" is a family of settings rather than a single fixed point.

How compression interacts with deduplication

Compression and deduplication are separate mechanisms that both reduce repository size, and they work on the same content-defined chunks:

• Borg splits files into content-defined chunks and stores identical chunks only once — across files, machines, and years of history.
• Compression is then applied to the data that actually gets stored.

Because deduplication already removes repeated chunks, compression mainly shrinks the unique data that remains. The two stack: a nightly full backup costs little more than the changes since yesterday, and those changes are stored compressed.

One practical consequence: if your data is already compressed (photos, video, zip files, most encrypted content), choosing lzma or zlib buys you very little while costing CPU time. In that case lz4, zstd, or none is usually the better trade.

How to choose

Work from the constraint that actually binds you:

• Backup window too long? Move toward lz4 or a low zstd level.
• Repository growing too fast? Move toward zstd at a higher level, then zlib, then lzma.
• CPU is the bottleneck (weak NAS, Raspberry Pi, busy server)? Prefer lz4 or none.
• Data is already compressed? none avoids wasted CPU for no space gain.
• Long-term archival, backups run rarely? lzma is reasonable because you pay the CPU cost once per archive.

A common starting point is zstd, then adjust in one direction once you've measured actual backup time and repository size on your own data. Borg's compression setting can be changed later, so you are not locked into an early choice.

What the site confirms

The BorgBackup homepage states the options directly: "Pick your trade-off: lz4 for speed, zstd for balance, zlib and lzma for maximum squeeze — or none at all." It also confirms the surrounding design — content-defined chunking for deduplication, authenticated AES encryption, and mountable archives — and that Borg is BSD-licensed free software installable on Linux, macOS, BSD, and more via distribution packages, single-file binaries, or pip. The site does not publish specific compression ratios or benchmark numbers, so treat any ratio claims as workload-dependent and test on your own data.

BorgBackup (Borg) is a deduplicating archiver with compression and authenticated encryption, and getting started takes one command: point Borg at a repository — a local disk, USB drive, or any machine reachable over SSH — and run a backup. There are no daemons, no agents, and no lock-in. This guide covers what you need before you start, the install options, and the first backup workflow.

What you need before starting

• A machine running Linux, macOS, BSD, or another supported platform.
• A place to store the repository: a local disk, a USB drive, or a remote host you can reach over SSH.
• Borg installed on the machine that runs the backup. If you back up to a remote host over SSH, Borg must also be installed there.

Install Borg

Borg's own documentation lists three installation routes:

Pick the one that matches how you already manage software on that machine.

Create a repository

A repository is where Borg stores deduplicated, compressed, encrypted chunks. Create one before your first backup, pointing at your chosen destination — a local path, a mounted USB drive, or an SSH location.

The key behavior to understand: Borg stores your files as content-defined chunks, and identical chunks are stored exactly once — across files, across machines, and across years of history. This is why daily full backups cost little more than the changes since yesterday. Your first backup writes everything; later backups mostly reference chunks that already exist.

Run your first backup

A backup is one command. Point Borg at the repository you created and at the data you want to protect. Because Borg does not run as a daemon or install an agent, there is nothing to keep running between backups — you invoke it when you want a backup.

What happens on that first run:

1. Borg reads your files and splits them into content-defined chunks.
2. New chunks are compressed using your chosen algorithm and encrypted.
3. Chunks are written to the repository; chunks already present are referenced, not stored again.

Choose compression

Borg lets you pick the trade-off per your needs:

• lz4 — speed
• zstd — balance between speed and size
• zlib and lzma — maximum compression
• none — no compression at all

There is no single correct choice; it depends on whether you value backup speed or repository size more.

Understand the encryption model

Borg uses AES encryption with cryptographic authentication. A practical consequence: your backup server never needs to be trusted, because it only ever sees ciphertext. That matters if you back up to a remote machine or shared storage you do not fully control.

Browse old versions without restoring

You can mount any archive as a regular filesystem with FUSE and browse old versions of your files like any folder. This is useful when you want to check or copy a single file from an earlier backup rather than performing a full restore.

Watch real sessions before you commit

Borg's site hosts recorded terminal sessions rather than marketing videos — every frame is real text, so you can pause the player and select and copy anything you see. If you want to see the commands in action before running them against your own data, these demos are the place to look.

Common sticking points

• Forgetting the repository must exist first. Create it before your first backup command.
• Assuming a remote host needs no Borg. If you back up over SSH, Borg has to be installed on the remote side too.
• Expecting the first backup to be as fast as later ones. The first run stores everything; subsequent runs benefit from deduplication and store mainly what changed.
• Treating the backup server as trusted. With Borg's authenticated encryption, it does not need to be — it only sees ciphertext.

Borg is free software under the BSD license, developed in the open since 2015, so you can inspect it, use it commercially, and rely on an active community for support.