Duplicati

Duplicati is a free, open-source backup client that encrypts, compresses, and incrementally uploads files to cloud storage or a local destination, then handles the whole schedule through a browser-based web UI. It’s one of the few self-hosted backup tools built specifically around getting data off the box it lives on, into S3, Backblaze B2, a NAS over SFTP, or a second machine on the network, while the encryption key stays entirely in the user’s hands. For a homelab already running Nextcloud, Paperless-ngx, or a database nobody wants to lose, Duplicati is usually the answer to the question that comes right after “it’s backed up”: okay, but where does that backup actually go?

Is Duplicati still actively maintained in 2026?

Duplicati’s development pace has been a recurring question on self-hosting forums for years, mostly because the project spent long stretches in beta versioning while a core rewrite to .NET slowly matured. That history is real. It’s also history. The GitHub repository shows over 14,000 commits and 254 tagged releases, with the latest stable build, v2.3.0.1, published in April 2026. The official Docker image was rebuilt nine days before this was written, and the actively-maintained community image from LinuxServer.io ships weekly base updates on top of it. Anyone judging Duplicati by a two- or three-year-old forum thread is working from stale information: the project is stable-versioned, cross-platform (Windows, macOS, Linux, requiring .NET 8+), and shipping regularly.

What Duplicati actually does

Duplicati runs as a background service with a web UI on port 8200 by default, where backup jobs are set up as source folders, a destination, an encryption passphrase, and a schedule. The first run always uploads a full copy; every run after that is block-level incremental, only the changed pieces of a file travel over the wire, not the whole file again, which keeps bandwidth and storage costs down on slower uplinks or metered cloud storage. Everything is encrypted client-side with AES-256 (or GPG, if preferred) before it leaves the machine, so the destination, even a public cloud bucket, never sees plaintext. Destinations cover a long list: Amazon S3, Backblaze B2, Google Drive, Microsoft OneDrive and Azure, Dropbox, Box, any WebDAV or SFTP server, and dozens more through the backend list documented on the official site. Retention rules and email or webhook notifications on job success or failure round things out.

Installing Duplicati with Docker

The official duplicati/duplicati image is deliberately minimal, just the binaries needed to run the server, with configuration persisted to /data inside the container:

$ docker run -d \
--name duplicati \
-p 8200:8200 \
-v duplicati-data:/data \
-v /path/to/source:/source \
duplicati/duplicati

Left alone, the web UI generates a random login password on first launch, visible only in the container logs, so it’s worth setting one explicitly instead. A Compose file that fixes the password and adds the database encryption key the official docs recommend:

services:
  duplicati:
    image: duplicati/duplicati:latest
    container_name: duplicati
    restart: unless-stopped
    ports:
      - 8200:8200
    volumes:
      - ./data:/data
      - /path/to/source:/source
    environment:
      - SETTINGS_ENCRYPTION_KEY=change-this-key
      - DUPLICATI__WEBSERVICE_PASSWORD=change-this-password

The community alternative, linuxserver/duplicati, wraps the same application with LinuxServer.io’s usual PUID/PGID user mapping and a slightly different volume layout (/config, /backups, /source), which is convenient if the rest of a stack is already built around LinuxServer images through Dockge or Portainer. Either image lands on the same web UI at port 8200; the choice mostly comes down to which volume convention already matches the rest of the homelab.

Homelab use cases

The obvious target is offsite backup for whatever already runs self-hosted: a Nextcloud data folder, a Paperless-ngx document archive, an Immich photo library, or a database dump, encrypted and shipped to Backblaze B2 or a relative’s NAS over SFTP so one hardware failure doesn’t mean a total loss. Duplicati also fills the less glamorous middle ground between no backup at all and a full disaster-recovery setup: scheduled, verified, restorable archives that don’t need babysitting once the first job is configured. Because it deploys the same way as any other container, it slots directly into a stack managed through Dockge, and its release cadence is frequent enough that a notify-only tool is the better companion rather than an auto-updater; the Watchtower page covers why unattended restarts aren’t the right call for anything stateful, backup jobs and their databases included. The Docker & Containers category, our 3-2-1 backup strategy guide for homelabs, and the homelab setup guide for beginners cover where a backup job fits into a wider self-hosted stack.

Duplicati vs Restic and Kopia

Restic and Kopia solve the same core problem, deduplicated, encrypted, incremental backup, but from the command line first. Restic has no bundled web UI at all; scheduling and monitoring mean wiring up cron and a separate dashboard yourself. Kopia ships a web UI similar in spirit to Duplicati’s, plus a CLI, and tends to edge out Duplicati on raw restore speed thanks to content-addressable deduplication. Duplicati’s advantage is reach: more supported destinations out of the box, and a UI built for someone who’d rather click through a backup job than read a man page first.

Category	Duplicati	Restic	Kopia
Interface	Web UI built in	CLI only, no bundled UI	Web UI and CLI
License	MIT	BSD-2-Clause	Apache License 2.0
Destinations	Very broad (40+ backends)	Fewer, but covers major cloud providers	Broad, growing list
Best fit	Anyone who wants a GUI and no terminal for routine backups	Scripted, cron-driven backup pipelines	A middle ground: GUI plus scriptability

Duplicati: pros and cons

• Free and open source under the MIT license, no account or subscription required
• Client-side AES-256 encryption before anything leaves the machine
• Broad destination support: most major cloud providers plus SFTP, WebDAV, and local storage
• Web UI covers scheduling, retention, and restore without needing the command line

• Losing the encryption passphrase means losing the backup permanently; there is no recovery path
• Restore speed lags behind Kopia and Restic on very large datasets
• The project’s slower years left a reputation that doesn’t match its current release cadence

FAQ

Is Duplicati free?

Yes, entirely, under the MIT license. There’s no paid tier or account requirement for the software itself.

Is Duplicati still actively developed?

Yes. The GitHub repository has over 14,000 commits and 254 releases, with the latest stable version published in April 2026 and the official Docker image rebuilt within the last two weeks.

What happens if I forget my encryption passphrase?

The backup becomes permanently unrecoverable. Duplicati has no password reset or backdoor for encrypted archives by design; the passphrase never leaves the local machine, so store it somewhere outside the server being backed up.

Duplicati vs Restic: which one should I use?

Restic fits a scripted, cron-driven setup where a terminal is already the normal workflow. Duplicati fits better when the goal is a web UI that handles scheduling, retention, and restores without writing shell scripts.

Duplicati remains one of the more approachable ways to get encrypted, offsite backups running in a homelab without building a scripted pipeline by hand. The slow years are behind it; the current release cadence and the still-maintained official Docker image both point the other way. For anything that would genuinely hurt to lose, a Nextcloud install, a Paperless-ngx archive, a database backing another service, it’s worth pointing Duplicati at cloud or remote storage instead of trusting a single local disk.