Duplicati

What Duplicati actually is

Duplicati is a free, open source backup client that encrypts your files on the machine they live on and ships them to storage you already pay for — Amazon S3, Backblaze B2, Google Drive, OneDrive, MEGA, Azure, Rackspace Cloud Files, OpenStack Swift, Storj, IDrive e2, Tencent COS, Aliyun OSS, or anything that speaks SFTP, WebDAV or FTP. It runs on Windows, macOS and Linux, in a browser-based local UI or from the command line, and it is built around three properties: client-side AES-256 (or GPG) encryption before anything leaves the machine, incremental backups after the first full run, and deduplication with compression so you are not paying to store the same block twice.

The project is older than most of the cloud it writes to. Danish developer Kenneth Skovhede started it in 2008 — first as a graphical front-end for the command-line tool Duplicity, then rebuilt around its own storage format as "Duplicati 2". The GitHub repository in its current form dates to August 2014 and carries about 15,000 stars and 272 releases. In March 2024 the project changed shape: Duplicati, Inc. was incorporated in the United States to commercialize the codebase, Skovhede became CTO, Open Core Ventures provided funding, and the license moved from LGPL to MIT. The core remains MIT-licensed; a proprietary/ folder in the repository holds code under the company's own license. In May 2024 the first commercial product, the cloud-hosted Duplicati Portal (now billed as the Duplicati console), arrived to manage and monitor backups across machines.

That history matters when you evaluate it. This is not a hobby script that might disappear, and it is also not a pure community project any more — it is an open-core product with a company behind it, a stable release line (2.1.0.5 shipped in March 2025), signed releases, a forum, and a real manual at docs.duplicati.com. We file it under backup solutions; for the storage targets themselves, our benchmarks page covers object-storage and VPS options.

Pricing: what you really pay

The backup client is free. Full stop: download it, point it at your own storage, run as many backup jobs as you like. That is the product the DB row describes, and it remains true.

The company now also sells a management console, and this is where the numbers live. As listed on duplicati.com/pricing: the Free console tier is $0 and covers an insights dashboard, monitoring of up to 2 machines and the last 200 backups. Pro is $2 per machine per month billed annually ($2.50 month-to-month) for up to 100 machines, adding missed-backup alerts, AI backup analysis, remote management, three-year monitoring retention, 100 GB of integrated storage per machine and priority support. Enterprise starts at $3 per machine per month with a minimum of 10 machines on a yearly contract, adding organization management, SSO with MFA, agent-based deployment and configuration assistance. Extra integrated storage is $0.60 per 100 GB per month billed yearly, and self-hosted Microsoft 365 or Google Workspace backup (mailboxes, OneDrive, SharePoint, Teams, Gmail, Drive, calendar and contacts) is $0.50 per user per month billed yearly.

Our read: for an individual or a small shop, the honest total cost is the client (free) plus whatever your storage backend charges — a few dollars a month at Backblaze or Hetzner-class pricing. The console tiers are priced for fleet management, and $2 per machine per month for remote monitoring and missed-backup alerts is reasonable against products like Acronis or Veeam agents. The trap to avoid: paying for the console's included storage while also paying a separate provider, when the whole point of Duplicati is bring-your-own-storage.

Performance & infrastructure

There is no Duplicati infrastructure to benchmark — that is the design. You bring the storage, Duplicati brings the client. Backup speed is bounded by your upstream bandwidth, your CPU for encryption and compression, and the backend's per-request latency; the tool gives you bandwidth throttling, transfer settings, filters and scheduling to keep runs predictable. Differential backups after the initial full mean steady-state runs are small. Snapshots of open files are handled through VSS on Windows and LVM on Linux, so databases and locked files can be captured consistently.

The security model is the strongest infrastructure claim it makes, and it holds up: AES-256 (or GPG) encryption happens client-side, the passphrase never leaves your machine, and even the commercial console is positioned around zero-knowledge storage — your backups live in your own bucket or disk. Releases are GPG-signed. On paper this is the arrangement we recommend for anything sensitive: you control the keys and the storage account.

Coverage of backends is wide — the official list runs from S3 and Azure through Google Drive, OneDrive, Box, Dropbox, MEGA, Storj, OpenStack Swift, WebDAV, SFTP and FTP, with more in the docs — and there is both a friendly web UI (served locally) and a scriptable command line with update channels from stable to canary. Deduplication and compression cut storage costs meaningfully for document-heavy workloads.

Where it falls short

Duplicati's reputation problem is reliability of its own database, not of the backups. The long-standing complaint pattern in the forum and issue tracker is real: the local metadata database can get out of sync with the remote store after interrupted runs or crashes, and repairing or rebuilding it on large backup sets can take hours. The maintainers have invested heavily here — the test suite, the 2.1 rewrite and the corruption-hardening work all target it — and community reports describe setups surviving deliberate abuse (killed processes, corrupted databases, partial deletes). But we would not stake an untested recovery plan on any backup tool, and with Duplicati the first restore test is non-negotiable.

The 2.x line also spent many years in beta, which gave the project a "perpetually almost-done" feel and left a trail of mixed reviews. The stable release situation is much better now, but older reviews you will find online are describing a project in a different state.

Support is community-grade at the free tier: a forum, GitHub issues and the manual. Priority support is a Pro-tier line item, and enterprise configuration help is part of the Enterprise contract. That is normal for open source, but there is no one to page at 3 a.m. unless you are paying.

Finally, the open-core split is worth understanding before you standardize on it: the core engine is MIT, but parts of the repository (including pieces of the commercial console stack) are under the company's license. Nothing about that blocks self-hosting the client today, and the roadmap is clearly weighted toward the paid console — fine, sustainable, and worth knowing.

Who should pick this

We pick Duplicati when someone wants encrypted, versioned backups to storage they control and does not want a per-gigabyte vendor tax. It fits individuals backing up a family NAS to B2, small businesses protecting servers and workstations to S3 or a Hetzner box, homelabbers who want scheduled, verifiable backups, and schools or non-profits where the budget is the constraint. The Microsoft 365 and Google Workspace backup at $0.50 per user per month is one of the cheapest ways to satisfy "we need tenant backups" without moving your whole stack. The web UI is served locally rather than hosted in the vendor's cloud, so day-to-day backup operation never depends on someone else's uptime.

We would not pick it as a fleet-management product for a large MSP without buying the Enterprise console (and then you should trial the recovery workflow at scale first), and we would not pick it for anyone who needs vendor-backed, contractual restore guarantees — that is what enterprise backup suites sell, and Duplicati does not.

Key takeaways

• Free MIT-licensed backup client (since March 2024; LGPL before that) with client-side AES-256/GPG encryption, incremental backups, dedup and compression.
• Bring your own storage: S3, B2, Azure, Google Drive, OneDrive, MEGA, Storj, WebDAV, SFTP, FTP and more — no storage lock-in and no per-GB vendor markup.
• Project started in 2008 by Kenneth Skovhede; Duplicati, Inc. formed in 2024 (US, Open Core Ventures funded) with Skovhede as CTO; stable 2.1.0.5 released March 2025.
• Paid console tiers: Free ($0, 2 machines), Pro ($2/machine/mo annually), Enterprise (from $3/machine/mo, 10-machine minimum); M365/Google Workspace backup $0.50/user/mo.
• Main risk is the local metadata database getting out of sync after interrupted runs — test a full restore before trusting any setup.
• Best value for privacy-minded individuals and small teams; enterprise fleets should evaluate the console and support tiers deliberately.

Sources

• https://duplicati.com/
• https://duplicati.com/pricing
• https://github.com/duplicati/duplicati
• https://en.wikipedia.org/wiki/Duplicati
• https://grokipedia.com/page/Duplicati