DEV Community

John
John

Posted on

Duplicati vs Backblaze Personal Backup: Is a Self-Hosted, Open Source Family Backup to a Home Server and B2 Worth It?

#selfhosted #opensource #privacy #backup

For a household with three or more laptops and one person willing to own the system, Duplicati backing up to a home server with a copy in Backblaze B2 beats Backblaze Personal Backup. It replaces per-computer subscriptions with storage you pay for by the terabyte, keeps the encryption passphrase entirely in your hands, and gives you a fast local copy for restores. Backblaze Personal Backup is still the better choice when nobody in the house wants to check backup reports, because it is unlimited, automatic and needs almost no configuration.

TL;DR

  • The hands-off couple (two laptops, no home server, nobody technical): stay on Backblaze Personal Backup, because the per-computer fee buys you setup and monitoring you would otherwise have to do yourself.
  • The family tech lead (four or five laptops, an always-on mini PC or NAS): run Duplicati to the home server plus B2, because one storage bill replaces several subscriptions and local restores take hours, not days.
  • The privacy-first parent (medical, tax and legal scans on the laptops): choose Duplicati with a passphrase only the family knows, because the provider never sees readable data or the key.
  • The photo-heavy household (several terabytes of phone and camera archives): combine both or use Duplicati with tight retention, because how you set up versioning decides whether storage stays flat or keeps growing.
  • The multi-home family (grandparents in another town, a student away at university): run Duplicati with B2 as the shared target, because remote laptops can back up without reaching the home network.
  • The "I want to learn" homelabber: run Duplicati in Docker next to other services, because it teaches you restore testing and monitoring, which carry over to every other self-hosted app.

The real tradeoff is simple: Backblaze Personal Backup charges you every month to take responsibility for the backups, while Duplicati is free and leaves that responsibility with you.

Table of contents

What does Duplicati actually do, and how is Backblaze Personal Backup different?

Duplicati is a free, open source backup client. It splits your files into blocks, deduplicates them, compresses them, encrypts them with AES-256 and uploads them to a storage destination you choose. That destination can be a local folder, an SFTP server, a WebDAV share, an S3-compatible bucket, Backblaze B2 and many others. You manage it through a web interface that listens on port 8200 by default, and it runs on Windows, macOS and Linux.

Backblaze Personal Backup is a commercial service. You install the client on a computer, it scans the drive, and it uploads everything to Backblaze's own data centres. There is no destination to pick and very little to configure. You pay a subscription per computer, and Backblaze takes care of storage, retention and the restore portal.

The key difference is in how each one is built. Duplicati is an engine that you connect to storage yourself. Backblaze Personal Backup is a finished product with the storage built in.

Aspect Duplicati Backblaze Personal Backup
Licence and cost model Open source, free; you pay only for storage Proprietary, per-computer subscription
Storage destination Any supported backend, including your own server Backblaze data centres only
Operating systems Windows, macOS, Linux Windows and macOS, no Linux client
What gets backed up Folders and filters you define Whole drive by default, with exclusions
Version history Retention rules you set 30 days by default, longer as a paid option
Who maintains it You Backblaze

For a family, that last row matters more than any other.

Who holds the encryption keys in each setup?

With Duplicati, encryption happens on the laptop before anything leaves it. You set a passphrase for each backup job, and Duplicati encrypts every block with AES-256, or with GPG if you prefer. The storage destination only ever receives encrypted .aes files. Neither Backblaze B2 nor your own server can read them without that passphrase.

That means the host you choose for the destination matters less for confidentiality. It could be a home server in the hallway cupboard, a NAS, a self-managed VPS or a managed platform. Yundera is a managed Personal Cloud Server, built on CasaOS, that runs self-hosted apps as Docker containers on a server dedicated to the user. In every one of these cases, the operator of the hardware sees file sizes and timestamps, never the contents.

Backblaze Personal Backup works differently, and the details matter:

  • Default mode: Backblaze encrypts your data but manages the key itself, so the company can technically decrypt your files.
  • Private Encryption Key (PEK): an optional passphrase that you set in the client. Backblaze cannot decrypt your data without it, and if you lose it the backup cannot be recovered.
  • Restoring with a PEK: web restores ask you to enter the passphrase in the browser, and decryption then happens on Backblaze's servers for the duration of the restore. That is a narrower guarantee than decryption that only ever happens on your own machine.
  • Duplicati's equivalent risk: if you lose the passphrase, the backup is just noise. If you export a job config with the password included, the resulting file is as sensitive as the passphrase.

Both tools can give you zero-knowledge storage. With Duplicati it is the only mode, and with Backblaze you have to turn it on yourself.

How much does it really cost to back up five family laptops over three years?

This guide does not quote list prices, because both companies change them and your local currency changes the totals too. What matters is the shape of each bill, and the two shapes are very different. Backblaze Personal Backup costs one subscription multiplied by the number of computers, so five laptops over 36 months means 180 computer-months, however much or little data each one holds. Duplicati itself costs nothing, so with Duplicati the bill grows with terabytes stored rather than with the number of devices.

Cost component Duplicati to home server + B2 Backblaze Personal Backup
Software Free, open source Included in each subscription
Main recurring cost B2 storage, billed per TB per month One fee per computer, per month or year
Effect of adding a sixth laptop Only its deduplicated data adds to the bill One more full subscription
Effect of a 2 TB photo archive Raises the B2 bill in proportion No change, storage is unlimited
Longer version history Costs only the extra blocks you keep Paid add-on for 1 year or forever
Up-front hardware Home server or NAS plus disks None
Electricity An always-on box, around the clock None

To work out your own break-even point, multiply the current per-computer price by the number of laptops and by 36. Then compare that with your expected B2 terabytes times 36, plus the cost of the home server spread over its lifespan. Families with many devices and modest data usually find Duplicati cheaper. One heavy user with several terabytes of raw photos on a single laptop can tip the balance back to Backblaze's unlimited plan.

Home server, B2 or both: a 3-2-1 layout for a household

The 3-2-1 rule asks for three copies of your data, on two different types of media, with one copy kept offsite. For a family, the laptop counts as the first copy. The home server gives you the second, fast copy, and B2 provides the offsite one. If you use only one destination, one of those requirements is missing.

There are two common ways to set this up with Duplicati:

  • Two jobs per laptop: one job sends backups to the home server over SFTP or to a network share, and a second job sends backups straight to B2. Each job keeps its own database and its own schedule, so if one destination fails, the other carries on. The cost is that the laptop does twice the work, and you have twice as many jobs to monitor.
  • One job plus a server-side copy: each laptop backs up only to the home server, and the server then mirrors the Duplicati destination folder to B2 with a tool such as rclone sync. Because the files are already encrypted, B2 receives the same opaque .aes volumes. The laptop does less work, but the offsite copy is only as healthy as the server that pushes it.
  • Where the server lives: a mini PC, a NAS, a self-managed VPS or a managed option such as Yundera can all act as the first destination. What matters is that the box is always on and its disks are separate from the laptops.
  • Ransomware separation: give the B2 application key write access but not delete access, or turn on Object Lock, so a compromised laptop cannot erase the offsite copy.

For most households, the second option is easier to keep running over time.

Should Duplicati run on each laptop or in Docker on a home server?

Duplicati backs up only the files it can read. A container on the home server cannot see the contents of a laptop unless that laptop shares its folders over the network. For laptops, that leaves you with two models, and only one of them holds up in a family setting.

  • Push from each laptop: install the Duplicati client on every machine and point it at the server or at B2. The laptop reads its own files directly, backs up while it is in use, and keeps working when it is away from home. This is the model to use for family devices.
  • Pull from the server: a Duplicati container mounts SMB shares that each laptop exports. This approach breaks whenever a laptop is asleep, renamed or on another network, and it means leaving shares open on every device. Avoid it for anything that moves around.
  • What the Docker instance is for: run Duplicati in a container to back up data that already lives on the server, such as photo libraries, shared documents and other app volumes. The official duplicati/duplicati image and lscr.io/linuxserver/duplicati both expose the web interface on port 8200. Mount the config directory to a persistent volume, because that is where each job's local database is stored.
  • Where that container can live: a home server, a NAS, a self-managed VPS or Yundera can each run it next to the other family services. On Yundera, apps are installed from an app store in one click rather than assembled from compose files by hand.
  • Protect the web interface: set a UI password from the first launch, and never expose port 8200 to the internet without authentication in front of it.

In practice, most households run Duplicati on every laptop and also in one container on the server.

Setting up Duplicati on Windows, macOS and Linux family laptops

The setup wizard looks the same on all three platforms. What differs is how Duplicati gets permission to read files, and whether it keeps running when nobody is logged in.

  • Windows: install the .msi package. By default Duplicati runs as a tray icon, which means it only backs up while that user is logged in. On a shared family PC, register it as a service with Duplicati.WindowsService.exe install so it covers every account. Set the advanced option --snapshot-policy=auto so open files, such as Outlook data files, are captured through Volume Shadow Copy.
  • macOS: install from the .dmg, then grant Duplicati Full Disk Access under System Settings, Privacy & Security. Without it, folders such as Desktop, Documents and Photos are silently skipped or produce permission warnings. Check the first backup log for those warnings before you trust the job.
  • Linux: use the .deb or .rpm package and enable the systemd service it installs, so backups run without a desktop session. Run it as the user who owns the files rather than as root, unless you deliberately want system paths included.
  • What to select: pick the home folder for each user, not the whole drive. Add exclusions for caches, node_modules, browser profiles and cloud-sync folders that already have their own history. A smaller source set gives you faster backups and a smaller database.
  • Naming and schedule: name each job after the device and the destination, for example emma-laptop-to-server, and schedule it daily at a time the laptop is usually awake, such as early evening.

Once the first laptop works, export its job config and use it as a template for the others.

Block size, deduplication and smart retention: controlling storage growth

Duplicati deduplicates within a single backup job. A file that has not changed costs nothing on the next run, and a large file that has changed only uploads the blocks that differ. Deduplication does not work across jobs, so two laptops holding the same holiday photos store them twice. That alone is a good reason to keep shared family photos on the server and back them up once from there.

Setting What it controls Sensible family choice
--blocksize The deduplication unit. It is fixed once the first backup runs Leave the default for documents, and choose larger blocks for multi-terabyte photo or video jobs to keep the database small
Remote volume size (--dblock-size) Size of each uploaded .zip.aes file, 50 MB by default Keep 50 MB for B2, and raise it for a LAN server with many terabytes
Retention: smart The preset 1W:1D,4W:1W,12M:1M, which keeps daily versions for a week, weekly for a month, then monthly for a year Good default for laptops
Retention: custom Your own timeframe:interval pairs in --retention-policy Extend to 36M:1M if you want three years of monthly versions
Retention: keep all Every version, forever Avoid, because storage only grows
Compaction threshold (--threshold) Percentage of wasted space in volumes before Duplicati repacks them, 25 by default Lower it on B2 to reclaim space sooner, and raise it if download costs worry you

Retention controls cost much more than block size does. With smart retention, a laptop's backup stays close to the size of its live data plus the files that churn each month. With keep-all, a single year of re-edited RAW photos can multiply the storage used. Choose the policy before the first backup, then check the destination size after 30 days to confirm it has levelled off.

What happens when a laptop is asleep, off the home network or travelling?

Family laptops spend most of their time closed, on battery or at school. A backup design that assumes they are always plugged in at home will fall behind without anyone noticing.

  • Asleep at the scheduled time: Duplicati does not wake the machine. When the laptop wakes and the Duplicati service starts again, a missed run is carried out at the next opportunity, so a daily schedule still produces about one backup a day on any day the lid is opened.
  • Closed in the middle of a backup: the run is interrupted and partly uploaded volumes are left behind. The next run usually cleans them up on its own. If it reports missing or extra files, run Repair from the job menu before you do anything more drastic.
  • Away from home: a job that targets the home server over SFTP fails unless the laptop can reach it. Either put the laptops on a private mesh such as Tailscale or WireGuard, or give travelling devices a second job that writes straight to B2, which can be reached from any internet connection.
  • Backblaze in the same situation: the client uploads continuously whenever it is online, so travel matters less. External drives are the exception: if one has not been connected for 30 days, Backblaze deletes its backed-up data.
  • Hotel and tethered connections: Duplicati cannot detect metered links. Set an upload throttle on travelling laptops, or pause the job from the tray icon while you are tethered to a phone.

Check the "last successful backup" date for every device once a week. A laptop that drifts to 10 days without a backup is the realistic failure, far more likely than a corrupted archive.

How long does a full restore take with Duplicati compared to Backblaze?

This section does not use benchmarks. Restore time depends mainly on the link between the backup and the laptop, so it is easier to reason from link speed. Moving 500 GB takes about 67 minutes at the theoretical rate of gigabit Ethernet. At 100 Mbit/s of internet download, the same data takes about 11 hours, before any protocol overhead or decryption. Real restores run slower than these figures, but the ratio between them holds.

Restore path What happens Main time factor
Duplicati from home server over LAN The client fetches volumes, decrypts them and rebuilds the files locally LAN speed and the laptop's disk and CPU
Duplicati from B2 Same process, but every volume comes over the internet Your download speed, plus B2 download fees
Duplicati on a replacement laptop The local database has to be recreated from the remote dlist and dindex files before files can be browsed Number of volumes, which can add a long wait for large jobs
Backblaze web restore You select files, Backblaze prepares a zip and you download it Preparation queue, then your download speed
Backblaze Downloader app Multi-threaded download of a prepared restore Your download speed
Backblaze USB restore A drive is posted to you, with a refund if you return it Shipping days, but no bandwidth used

The home server copy is the reason the hybrid design makes sense. For a dead laptop SSD, the local restore finishes the same evening. B2 then only matters when the house itself is the problem. Backblaze's posted drive is a strength that Duplicati cannot match: for a multi-terabyte loss on a slow rural connection, a courier beats any download.

Managing passphrases and exported configs without locking the family out

Duplicati's encryption is only as strong as your discipline with the passphrase. In a family the realistic risk is not an attacker. It is the one person who set everything up being unavailable on the day a laptop dies.

  • One passphrase per device: give each laptop's job its own long random passphrase rather than one shared family password. A leaked passphrase then exposes one person's backup, not everyone's, and you can rotate it by recreating a single job.
  • A shared vault, with care: store every passphrase, the B2 key ID and application key, and the server's SFTP credentials in a family password manager such as Bitwarden or a self-hosted Vaultwarden. Make sure at least two adults can open it.
  • Break the circular dependency: if the password vault is itself only backed up by Duplicati, losing the vault means losing the backups. Keep the vault's own emergency kit outside the system.
  • Export job configs: use Export on each job and save the resulting .json file. Without passwords, it is safe to store almost anywhere. With passwords included, encrypt it when you export and treat it like the vault itself. The file recreates the job on a new machine in minutes.
  • A printed recovery sheet: one page in a sealed envelope listing where the backups live, the name of the vault, and the order of the restore steps. Store it with the house insurance documents, not on a computer.
  • A second-person drill: once a year, have someone other than the admin restore one folder from B2 onto a spare laptop using only the sheet and the vault. Whatever they get stuck on goes back into the sheet.

Bandwidth, the initial upload and keeping the family connection usable

The first full upload is the hardest part of any offsite backup, and household upload speeds are usually much lower than download speeds. Do the arithmetic before you start. At a sustained 20 Mbit/s upload, 1 TB takes about 4.6 days at the theoretical maximum. While that runs, video calls and online games compete for the same link.

  • Seed over the LAN first: send every laptop's first backup to the home server, where gigabit Ethernet or Wi-Fi does the work. Only the server then has to push data to B2, and it can take as long as it needs without anyone carrying a laptop around.
  • Throttle Duplicati on laptops: set --throttle-upload on any job that writes directly to B2, for example to half of your measured upload speed. Duplicati also uploads several volumes in parallel, controlled by --asynchronous-concurrent-upload-limit. Lowering it smooths out spikes on a weak connection.
  • Schedule the server-to-B2 push: when rclone mirrors the server to B2, its --bwlimit option accepts a timetable such as 08:00,2M 23:00,off. That keeps the upload gentle during the day and uncapped overnight.
  • Stagger the jobs: do not schedule five laptops for 19:00. Spread them across the evening, or let the server absorb them all and handle the offsite push in a single queue.
  • Watch for data caps: some broadband and most mobile plans cap monthly traffic. The initial seed, any later compaction and a full restore from B2 all count against that cap.
  • Backblaze comparison: the Personal Backup client has its own throttle setting, but it always uploads straight from each laptop. You cannot seed through a local server first.

After the first seed, daily incremental uploads for documents and occasional photos are usually small enough that nobody notices them.

What breaks in Duplicati, and how do you notice before you need a restore?

Duplicati rarely fails loudly. Its weak point is the local SQLite database that tracks every block, and a run can stop with an error that nobody reads because nobody opens the web UI on a teenager's laptop.

  • Database and remote out of sync: messages such as "Found remote files that are not recorded in local storage" or "Detected non-empty blocksets with no associated blocks" mean the database no longer matches the destination. Try Repair first. If that fails, Recreate rebuilds the database from the remote index files, which can take hours on a large job.
  • Remote volumes that are never checked: by default, Duplicati downloads and verifies only one sample set of files after each backup, controlled by --backup-test-samples. Raise it, or set --backup-test-percentage so a meaningful share of the archive is checked each month. This trades some bandwidth for confidence.
  • Silent failures: set --send-http-url to a ping endpoint on a dead-man's-switch service such as Healthchecks.io, which you can also self-host. Use the success URL for successful runs, and let the check alert you when a device misses its window.
  • Email reports: --send-mail-to with --send-mail-level=Warning,Error,Fatal sends only the runs that need attention, so the messages do not get filtered as noise.
  • Upgrades: update the server container and the laptop clients deliberately rather than automatically, and read the release notes for database migrations first. A failed migration on one laptop is a nuisance. On the server holding everyone's data, it is an incident.
  • What Backblaze does for you: the Personal Backup client warns users by email when a computer stops backing up. With Duplicati, you have to build that warning yourself.

Wire up monitoring on the same day you create each job, not after the first scare.

Data sovereignty: why storage location and key custody matter for family files

Family laptops hold the most sensitive data a household has: passport scans, tax returns, children's medical letters and years of private photos. Data sovereignty comes down to two questions. In which jurisdiction does that data physically sit, and who can make it readable? Duplicati lets you answer both questions yourself.

Advantages of the Duplicati approach:

  • Location you choose: the primary copy sits on hardware in your own home. For B2, you pick a region when you create the account, including an EU Central region for families who want their data under GDPR rules.
  • Keys that never leave the laptop: decryption happens only on your own machines, including during a restore, so no provider ever handles plaintext.
  • No single vendor dependency: the backup format is open and the backends are interchangeable. If B2 changes its terms, you can point the same jobs at another S3-compatible provider.
  • Open source scrutiny: the encryption and file format can be read and audited, rather than taken on trust.

Backblaze Personal Backup also lets you choose a region when you sign up. Unless you set a Private Encryption Key, though, custody of the key stays with the vendor.

Sovereignty checklist for a family setup:

  • Region recorded: write down the B2 region and the physical location of the server on the recovery sheet.
  • Passphrases held only by family: none are stored on the server in plaintext.
  • Server disk encrypted: so a stolen home server exposes nothing beyond the encrypted volumes it already holds.
  • Scoped application keys: each B2 key is limited to one bucket, not the whole account.
  • Exit path tested: you have restored at least once from the offsite copy without the home server.
  • Retention matched to need: sensitive documents are not kept forever by accident.

Which setup fits your household?

The right choice depends less on how much data you have than on who will look after the backups in two years' time.

Profile Recommendation Main reason
Two laptops, nobody technical Backblaze Personal Backup No one has to own the monitoring
Four or five laptops, always-on server Duplicati to server, rclone to B2 One storage bill, fast local restores
Sensitive documents on every device Duplicati with per-device passphrases Keys never leave family hands
One user with several TB of RAW photos Backblaze for that laptop, Duplicati for the rest The unlimited plan absorbs the heavy user
Student or grandparent away from home Duplicati job straight to B2 Works without reaching the home network
Slow upload, rural broadband Duplicati to server, slow B2 seed The LAN does the heavy lifting
Linux laptops in the house Duplicati Backblaze Personal has no Linux client
Learning homelab skills Duplicati in Docker plus laptop clients Restore and monitoring practice that transfers to other apps

Next steps:

If you choose Backblaze:

  1. Install it on every computer and set a Private Encryption Key.
  2. Store the key in the family vault.
  3. Do a test restore of one folder.

If you choose Duplicati hybrid:

  1. Pick the server: a home server, a NAS, a VPS or Yundera.
  2. Create one job per laptop with smart retention.
  3. Mirror the server to a scoped B2 bucket.
  4. Add Healthchecks.io pings and run a second-person restore drill.

If you choose mixed:

  1. Keep Backblaze on the heavy-data laptop only.
  2. Move the other devices to Duplicati.
  3. Review the cost after 3 months.

Top comments (0)