shouldiuse.io

Report

Should I Use Duplicati?

duplicati.com·Analyzed 6 days ago··Based on 14 sources

Duplicati is a free, open-source backup solution that offers zero-trust, fully encrypted backups for your data. Integrating with all major cloud providers ensuring your data is securely stored and easily accessible.

Verdict

Depends

Buy if you're technical and want free, encrypted backups to your own cloud storage — and you'll patch promptly.

Confidence: Medium

Skip it if you need vendor support, proven reliability, or set-and-forget simplicity.

Powerful free encrypted backup for technical users; spotty reliability history and recent CVEs make it risky for everyone else.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free core does what paid rivals charge for
  • Ease of use: 3/5. Web UI works, but setup and trust issues recur
  • Feature depth: 4/5. Encryption, dedup, compression; rivals say it out-features them
  • Support quality: 2/5. Community forum only; no vendor support on free tier
  • Security posture: 3/5. AES-256 zero-trust design, but recent CVEs exist
  • 4.3/5 Cloudwards rating Duplicati Review 2026
  • 4.5/5 BestBackupReviews rating Free & open source backup review
  • Yes Free tier Open-source client, free forever
  • $2M Funding Initial backing via Open Core Ventures

Pricing

Open-source client

Free

  • AES-256 encrypted cloud backups
  • All major cloud providers
  • Community support only

Duplicati Console

Paid — see pricing page

  • Central management for teams/MSPs
  • Price cut announced alongside 2.3 stable
Best for and not for

Best for

  • Self-hosters and homelab users
  • Technical users backing up to B2/S3
  • Budget-conscious encrypted backups
  • MSPs wanting a free backup agent

Not for

  • Non-technical users wanting set-and-forget backup
  • Businesses needing vendor SLAs or support contracts
  • Anyone unwilling to patch quickly after CVEs
  • Compliance-driven teams needing audited tooling

Biggest gotcha

  • highv2.3.0.1 has a published CERT alert (VU#847406) — run only the latest release⁶
  • highWeb UI login bypass reported in certain configs; never expose it to the internet⁹
  • mediumReliability is the recurring complaint; some users switched to competitors after failures⁵
  • lowPaid console pricing isn't in marketing copy; verify actual costs on the pricing page first10

Pros

  • Free, open-source core with AES-256 encrypted backups14
  • Works with all major cloud providers, including Backblaze B2
  • Deduplication and compression cut cloud storage costs13
  • Reviewers praise feature depth; called powerful and a favourite³
  • Newly funded company ($2M) now driving active development12

Cons

  • Reliability complaints recur; some long-time users left after failures⁵
  • Recent CVEs: privilege escalation and permission flaws⁷
  • Login auth bypass reported in certain configurations⁹
  • Stable v2 only arrived in 2026 after a long beta11
  • Help is forum-based; no vendor support on free tier

Security

Encryption design is solid (AES-256, zero-trust), but 2026 advisories mean you must run the latest patched version.

  • VU#847406 — Duplicati v2.3.0.1 vulnerabilityCERT/CC published an advisory against v2.3.0.1; patch to the newest release.⁶
  • CVE-2026-16157 — privilege escalationPrivilege escalation vulnerability documented in NVD and SentinelOne databases.⁷
  • CVE-2026-76159 — incorrect permission handlingPermission-related vulnerability listed by Rapid7.⁸
  • Login authentication bypass (GitHub issue #5197)Bypass possible via DB server access in certain configurations.⁹

What users say

Reviews are split: many call it powerful and unfairly criticized, while others report reliability problems severe enough to switch away.

“I finally started using Duplicati and I should have sooner”
XDA Developers
“duplicati has crossed me for the last time”
Reddit, r/selfhosted
“Is duplicati still bad?”
Reddit, r/selfhosted

Alternatives

Compare Duplicati with each alternative.

  • IDrive

    Managed backup service with vendor support; less setup work

Methodology

Based on ~25 public sources: independent reviews, Reddit threads, CERT/NVD advisories, and vendor pages. Some review snippets were truncated, so quotes are partial.

Sources

  1. Duplicati Review 2026 — Cloudwardscloudwards.net
    review
  2. Duplicati Backup Review — BestBackupReviewsbestbackupreviews.com
    review
  3. Duplicati review: Our new favourite backup tool — ITProitpro.com
    review
  4. Is duplicati still bad? — Reddit r/selfhostedreddit.com
    review
  5. duplicati has crossed me for the last time — Reddit r/selfhostedreddit.com
    review
  6. VU#847406 — CERT/CC advisorykb.cert.org
    security
  7. CVE-2026-16157 — SentinelOne vulnerability databasesentinelone.com
    security
  8. CVE-2026-76159 — Rapid7rapid7.com
    security
  9. Bypass Duplicati Login Authentication — GitHub issue #5197github.com
    security
  10. Duplicati console pricingduplicati.com
    official
  11. Duplicati 2.3 Stable release announcementduplicati.com
    official
  12. Open Core Ventures — Duplicati zero-trust backupopencoreventures.com
    news
  13. Duplicati: Deduped, Compressed, Encrypted Backups — Backblaze blogbackblaze.com
    news
  14. duplicati/duplicati — GitHub repositorygithub.com
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.