Who is Duplicati for?

Homelab and self-hosting users Personal PC backup to cloud storage Zero-knowledge encrypted backups on a budget Technical users comfortable troubleshooting

Who is Duplicati not for?

Businesses needing vendor SLAs or support contracts Non-technical users who won't verify restores Compliance-driven orgs needing audited security Anyone wanting paid, on-call vendor support

shouldiuse.io

Duplicati Review

Depends

Should I use Duplicati?

Store securely encrypted backups in the cloud! - forum.duplicati.com

Analyzed September 25, 2026 · 1 month ago

Buy it if you're technical and want free, encrypted backups to your own cloud storage. Skip it for business-critical data that needs vendor SLAs, audited security, or guaranteed restores.

Confidence

Medium. Based on ~20 public sources across reviews, security advisories, and official pages. Some quotes truncated in source snippets.

Ratings

Value for money
Ease of use
Feature depth
Support quality
Security posture

Pricing

Free / Open source

ModelNot disclosed

Monthly feesNot disclosed

HardwareNot disclosed

Free tierYes

Company (hosted)Not published in sources

EnterpriseNot published in sources

Best for

Homelab and self-hosting users
Personal PC backup to cloud storage
Zero-knowledge encrypted backups on a budget
Technical users comfortable troubleshooting

Not for

Businesses needing vendor SLAs or support contracts
Non-technical users who won't verify restores
Compliance-driven orgs needing audited security
Anyone wanting paid, on-call vendor support

Gotchas - check before you buy

high

Restores matter most; Reddit reports of failures mean you must test restores regularly

medium

Core is free, but hosted Company and Enterprise plans exist with unpublished pricing

medium

Support is community-forum only; no vendor SLA

medium

Changing volume encryption password isn't supported, complicating key rotation after exposure

Pros

Free, open-source with client-side AES-256 encryption
Backs up to many cloud backends including Backblaze B2
Deduplication and compression reduce storage costs
ITPro named it their new favourite backup tool
Active community forum and open development

Cons

Recent privilege-escalation CVE (2026-16157)
CERT flagged v2.3.0.1 as vulnerable
Recurring reliability complaints push users away
Some users uninstalled despite high hopes

Sources & method

Analyzed September 25, 2026 - 14 sources - Client-side AES-256 encryption by design, but 2026 CVEs (privilege escalation, permission issues) require prompt patching.

official x3review x7security x3news x1

CVE-2026-16157, Privilege escalation vulnerability in Duplicati
VU#847406, CERT notes Duplicati v2.3.0.1 is vulnerable
CVE-2026-76159, Incorrect permission assignment issue
Login auth bypass, Authentication bypass using server-passphrase documented by researcher

Key stats

Value for money: 5/5
Rating
$0
Starting price
14
Sources
September 25, 2026
Analyzed

Value for money: 5/5. Free open-source core; hosted plans optional
Ease of use: 3/5. GUI helps, but setup and troubleshooting demand skill
Feature depth: 4/5. Dedup, compression, encryption, many cloud backends
Support quality: 2/5. Community forum only; no vendor SLA
Security posture: 2/5. Strong AES-256 design, but recent CVEs

$0 Starting price Free open-source client
Yes Free tier Core backup client is free
$2M Initial funding Open Core Ventures, Duplicati Inc launch
AES-256 Encryption Client-side before upload

Pricing

Free / Open source

Full backup client
AES-256 encryption
Community support

Company (hosted)

Not published in sources

Hosted management of backups

Enterprise

Not published in sources

Enterprise plan referenced by reviewers

Security

Client-side AES-256 encryption by design, but 2026 CVEs (privilege escalation, permission issues) require prompt patching.

CVE-2026-16157Privilege escalation vulnerability in Duplicati¹¹
VU#847406CERT notes Duplicati v2.3.0.1 is vulnerable¹⁰

CVE-2026-76159Incorrect permission assignment issue¹²
Login auth bypassAuthentication bypass using server-passphrase documented by researcher

What users say

Users praise the free, powerful encrypted backups while repeatedly complaining about reliability and trust issues.

“I finally started using Duplicati and I should have sooner”

XDA Developers review

“Duplicati review: Our new favourite backup tool”

ITPro

“duplicati has crossed me for the last time”

Reddit, r/selfhosted

Alternatives

Compare Duplicati with each alternative.

Kopia
Fast, modern open-source encrypting backup alternative
Duplicati vs Kopia
Restic
Fast, simple CLI backup praised in comparisons
Duplicati vs Restic
Duplicacy
Lock-free dedup; commonly compared head-to-head

rclone
CLI-based cloud sync when you don't need a GUI
Duplicati vs rclone

Companies that use it

Full analysis

Based on ~20 public sources across reviews, security advisories, and official pages. Some quotes truncated in source snippets.

Free open-source encrypted cloud backup: powerful for technical users, but recent CVEs and reliability gripes demand tested restores.

Methodology

Based on ~20 public sources across reviews, security advisories, and official pages. Some quotes truncated in source snippets.

Read how a report is made.

Sources

Duplicati official siteduplicati.com
official
Duplicati pricing plansduplicati.com
official
duplicati/duplicati on GitHubgithub.com
official
ITPro: Our new favourite backup toolitpro.com
review
Cloudwards Duplicati Review 2026cloudwards.net
review
Backblaze: Deduped, Compressed, Encrypted Backupsbackblaze.com
review
XDA Developers: I should have started soonerxda-developers.com
review
Reddit: duplicati has crossed me for the last timereddit.com
review
Reddit: Is duplicati still bad?reddit.com
review
CERT VU#847406kb.cert.org
security
CVE-2026-16157 privilege escalationsentinelone.com
security
CVE-2026-76159 permission issuerapid7.com
security
Open Core Ventures: Duplicati Inc launchopencoreventures.com
news
Forum: Had high hopes but wound up uninstallingforum.duplicati.com
review

Add this review to your site

This check for Duplicati says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Duplicati Independent review on Should I Use It

Badge code

<!-- Should I Use It badge. Keep this link. -->
<a href="https://shouldiuse.io/r/forum-15" target="_blank" style="display:inline-flex;flex-direction:column;align-items:flex-start;gap:8px;max-width:420px;box-sizing:border-box;padding:14px 16px;border:1px solid #d5dde4;border-radius:14px;background:#ffffff;color:#111111;font-family:Segoe UI,system-ui,sans-serif;line-height:1.25;text-decoration:none;box-shadow:0 8px 20px rgba(17,17,17,0.08);">
  <span style="display:flex;align-items:center;gap:10px;min-width:0;">
    <span style="display:inline-flex;align-items:center;flex:0 0 auto;border-radius:999px;padding:4px 10px;font-size:11px;font-weight:700;letter-spacing:0.06em;text-transform:uppercase;line-height:1.3;background:#fef7e0;color:#7a5510;">Depends</span>
    <span style="font-size:15px;font-weight:700;color:#111111;overflow-wrap:anywhere;">Duplicati</span>
  </span>
  <span style="font-size:12px;font-weight:500;color:#516271;">Independent review on Should I Use It</span>
</a>

Text link

<a href="https://shouldiuse.io/r/forum-15">Duplicati review on Should I Use It: Depends</a>

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

No comments yet.

Categories

Duplicati Review

Confidence

Ratings

Pricing