shouldiuse.io

Report

Should I Use Duplicati?

forum.duplicati.com·Analyzed 3 days ago··Based on 14 sources

Store securely encrypted backups in the cloud!

Verdict

Depends

Buy it if you're technical and want free, encrypted backups to your own cloud storage.

Confidence: Medium

Skip it for business-critical data that needs vendor SLAs, audited security, or guaranteed restores.

Free open-source encrypted cloud backup: powerful for technical users, but recent CVEs and reliability gripes demand tested restores.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free open-source core; hosted plans optional
  • Ease of use: 3/5. GUI helps, but setup and troubleshooting demand skill
  • Feature depth: 4/5. Dedup, compression, encryption, many cloud backends
  • Support quality: 2/5. Community forum only; no vendor SLA
  • Security posture: 2/5. Strong AES-256 design, but recent CVEs
  • $0 Starting price Free open-source client
  • Yes Free tier Core backup client is free
  • $2M Initial funding Open Core Ventures, Duplicati Inc launch
  • AES-256 Encryption Client-side before upload

Pricing

Free / Open source

$0

  • Full backup client
  • AES-256 encryption
  • Community support

Company (hosted)

Not published in sources

  • Hosted management of backups

Enterprise

Not published in sources

  • Enterprise plan referenced by reviewers
Best for and not for

Best for

  • Homelab and self-hosting users
  • Personal PC backup to cloud storage
  • Zero-knowledge encrypted backups on a budget
  • Technical users comfortable troubleshooting

Not for

  • Businesses needing vendor SLAs or support contracts
  • Non-technical users who won't verify restores
  • Compliance-driven orgs needing audited security
  • Anyone wanting paid, on-call vendor support

Biggest gotcha

  • highRestores matter most; Reddit reports of failures mean you must test restores regularly⁸
  • mediumCore is free, but hosted Company and Enterprise plans exist with unpublished pricing²
  • mediumSupport is community-forum only; no vendor SLA14
  • mediumChanging volume encryption password isn't supported, complicating key rotation after exposure

Pros

  • Free, open-source with client-side AES-256 encryption³
  • Backs up to many cloud backends including Backblaze B2⁶
  • Deduplication and compression reduce storage costs⁶
  • ITPro named it their new favourite backup tool⁴
  • Active community forum and open development

Cons

  • Recent privilege-escalation CVE (2026-16157)11
  • CERT flagged v2.3.0.1 as vulnerable10
  • Recurring reliability complaints push users away⁸
  • Some users uninstalled despite high hopes14

Security

Client-side AES-256 encryption by design, but 2026 CVEs (privilege escalation, permission issues) require prompt patching.

  • CVE-2026-16157Privilege escalation vulnerability in Duplicati11
  • VU#847406CERT notes Duplicati v2.3.0.1 is vulnerable10
  • CVE-2026-76159Incorrect permission assignment issue12
  • Login auth bypassAuthentication bypass using server-passphrase documented by researcher

What users say

Users praise the free, powerful encrypted backups while repeatedly complaining about reliability and trust issues.

“I finally started using Duplicati and I should have sooner”
XDA Developers review
“Duplicati review: Our new favourite backup tool”
ITPro
“duplicati has crossed me for the last time”
Reddit, r/selfhosted

Companies that use it

  • YIT

Methodology

Based on ~20 public sources across reviews, security advisories, and official pages. Some quotes truncated in source snippets.

Sources

  1. Duplicati official siteduplicati.com
    official
  2. Duplicati pricing plansduplicati.com
    official
  3. duplicati/duplicati on GitHubgithub.com
    official
  4. ITPro: Our new favourite backup toolitpro.com
    review
  5. Cloudwards Duplicati Review 2026cloudwards.net
    review
  6. Backblaze: Deduped, Compressed, Encrypted Backupsbackblaze.com
    review
  7. XDA Developers: I should have started soonerxda-developers.com
    review
  8. Reddit: duplicati has crossed me for the last timereddit.com
    review
  9. Reddit: Is duplicati still bad?reddit.com
    review
  10. CERT VU#847406kb.cert.org
    security
  11. CVE-2026-16157 privilege escalationsentinelone.com
    security
  12. CVE-2026-76159 permission issuerapid7.com
    security
  13. Open Core Ventures: Duplicati Inc launchopencoreventures.com
    news
  14. Forum: Had high hopes but wound up uninstallingforum.duplicati.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.