BorgBackup: deduplicating archiver with compression and authenticated encryption

BorgBackup, or Borg (about 13,800 stars on GitHub), is a deduplicating backup program maintained by Thomas Waldmann and the Borg community. It stores each backup as an archive inside a repository, deduplicates across all archives with content-defined chunking, compresses with lz4, zstd, zlib or lzma, and encrypts with authenticated encryption. Repositories live on a local disk or on any SSH host that has Borg installed.

Pick Borg when your backup target is a Linux box you control (a NAS, a VPS, a friend’s server) and you want very efficient storage, fast incremental runs and the ability to borg mount an archive as a filesystem to browse old versions. Its append-only repository mode lets a server accept new backups while refusing deletions, which is a strong defence against ransomware running on the client. For object storage backends, restic or Borg behind rclone is the usual answer.

Install it with apt install borgbackup, brew install borgbackup or pipx install borgbackup; standalone binaries are published on the Releases page. A first repository:

borg init --encryption=repokey-blake2 /mnt/backup/borg
borg create --stats --compression zstd /mnt/backup/borg::{hostname}-{now} ~/Documents
borg list /mnt/backup/borg
borg extract --dry-run /mnt/backup/borg::$(borg list /mnt/backup/borg --last 1 --format '{archive}')

Export the key with borg key export and store it away from the machine; with repokey modes the key is inside the repository but still useless without the passphrase. Careful: borg prune followed by borg compact permanently removes archives and frees their space; use --dry-run --list on prune first. Credit to the BorgBackup contributors; the project is BSD licensed.