shouldiuse.io

Categories

VERDICT

Duplicati Review

Depends

Should I use Duplicati?

Duplicati is a free, open-source backup solution that offers zero-trust, fully encrypted backups for your data. Integrating with all major cloud providers ensuring your data is securely stored and easily accessible. - duplicati.com

· 1 month ago

Buy if you're technical and want free, encrypted backups to your own cloud storage — and you'll patch promptly. Skip it if you need vendor support, proven reliability, or set-and-forget simplicity.

Confidence

Medium. Based on ~25 public sources: independent reviews, Reddit threads, CERT/NVD advisories, and vendor pages. Some review snippets were truncated, so quotes are partial.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Open-source client

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Duplicati ConsolePaid — see pricing page

Best for

  • Self-hosters and homelab users
  • Technical users backing up to B2/S3
  • Budget-conscious encrypted backups
  • MSPs wanting a free backup agent

Not for

  • Non-technical users wanting set-and-forget backup
  • Businesses needing vendor SLAs or support contracts
  • Anyone unwilling to patch quickly after CVEs
  • Compliance-driven teams needing audited tooling

Gotchas - check before you buy

high

v2.3.0.1 has a published CERT alert (VU#847406) — run only the latest release

high

Web UI login bypass reported in certain configs; never expose it to the internet

medium

Reliability is the recurring complaint; some users switched to competitors after failures

low

Paid console pricing isn't in marketing copy; verify actual costs on the pricing page first

Pros and cons

Pros

  • Free, open-source core with AES-256 encrypted backups
  • Works with all major cloud providers, including Backblaze B2
  • Deduplication and compression cut cloud storage costs
  • Reviewers praise feature depth; called powerful and a favourite
  • Newly funded company ($2M) now driving active development

Cons

  • Reliability complaints recur; some long-time users left after failures
  • Recent CVEs: privilege escalation and permission flaws
  • Login auth bypass reported in certain configurations
  • Stable v2 only arrived in 2026 after a long beta
  • Help is forum-based; no vendor support on free tier

Sources & method

- 14 sources - Encryption design is solid (AES-256, zero-trust), but 2026 advisories mean you must run the latest patched version.

official x3review x5security x4news x2
  • VU#847406 — Duplicati v2.3.0.1 vulnerability, CERT/CC published an advisory against v2.3.0.1; patch to the newest release.
  • CVE-2026-16157 — privilege escalation, Privilege escalation vulnerability documented in NVD and SentinelOne databases.
  • CVE-2026-76159 — incorrect permission handling, Permission-related vulnerability listed by Rapid7.
  • Login authentication bypass (GitHub issue #5197), Bypass possible via DB server access in certain configurations.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free core does what paid rivals charge for
  • Ease of use: 3/5. Web UI works, but setup and trust issues recur
  • Feature depth: 4/5. Encryption, dedup, compression; rivals say it out-features them
  • Support quality: 2/5. Community forum only; no vendor support on free tier
  • Security posture: 3/5. AES-256 zero-trust design, but recent CVEs exist
  • 4.3/5 Cloudwards rating Duplicati Review 2026
  • 4.5/5 BestBackupReviews rating Free & open source backup review
  • Yes Free tier Open-source client, free forever
  • $2M Funding Initial backing via Open Core Ventures

Pricing

Open-source client

Free

  • AES-256 encrypted cloud backups
  • All major cloud providers
  • Community support only

Duplicati Console

Paid — see pricing page

  • Central management for teams/MSPs
  • Price cut announced alongside 2.3 stable

Security

Encryption design is solid (AES-256, zero-trust), but 2026 advisories mean you must run the latest patched version.

  • VU#847406 — Duplicati v2.3.0.1 vulnerabilityCERT/CC published an advisory against v2.3.0.1; patch to the newest release.⁶
  • CVE-2026-16157 — privilege escalationPrivilege escalation vulnerability documented in NVD and SentinelOne databases.⁷
  • CVE-2026-76159 — incorrect permission handlingPermission-related vulnerability listed by Rapid7.⁸
  • Login authentication bypass (GitHub issue #5197)Bypass possible via DB server access in certain configurations.⁹

What users say

Reviews are split: many call it powerful and unfairly criticized, while others report reliability problems severe enough to switch away.

“I finally started using Duplicati and I should have sooner”
XDA Developers
“duplicati has crossed me for the last time”
Reddit, r/selfhosted
“Is duplicati still bad?”
Reddit, r/selfhosted

Alternatives

Compare Duplicati with each alternative.

  • IDrive

    Managed backup service with vendor support; less setup work

Full analysis

Based on ~25 public sources: independent reviews, Reddit threads, CERT/NVD advisories, and vendor pages. Some review snippets were truncated, so quotes are partial.

Powerful free encrypted backup for technical users; spotty reliability history and recent CVEs make it risky for everyone else.

Methodology

Based on ~25 public sources: independent reviews, Reddit threads, CERT/NVD advisories, and vendor pages. Some review snippets were truncated, so quotes are partial.

Read how a report is made.

Sources

  1. Duplicati Review 2026 — Cloudwardscloudwards.net
    review
  2. Duplicati Backup Review — BestBackupReviewsbestbackupreviews.com
    review
  3. Duplicati review: Our new favourite backup tool — ITProitpro.com
    review
  4. Is duplicati still bad? — Reddit r/selfhostedreddit.com
    review
  5. duplicati has crossed me for the last time — Reddit r/selfhostedreddit.com
    review
  6. VU#847406 — CERT/CC advisorykb.cert.org
    security
  7. CVE-2026-16157 — SentinelOne vulnerability databasesentinelone.com
    security
  8. CVE-2026-76159 — Rapid7rapid7.com
    security
  9. Bypass Duplicati Login Authentication — GitHub issue #5197github.com
    security
  10. Duplicati console pricingduplicati.com
    official
  11. Duplicati 2.3 Stable release announcementduplicati.com
    official
  12. Open Core Ventures — Duplicati zero-trust backupopencoreventures.com
    news
  13. Duplicati: Deduped, Compressed, Encrypted Backups — Backblaze blogbackblaze.com
    news
  14. duplicati/duplicati — GitHub repositorygithub.com
    official

Add this review to your site

This check for Duplicati says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Duplicati Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.