iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure online backups with layered protections: encrypt the data, protect both the backup account and its recovery email with multifactor authentication (MFA), keep a separate copy ransomware cannot reach, and test that you can restore files. Encryption and two-factor authentication (2FA) address different risks; neither alone prevents account takeover, deletion, or a failed recovery.
Encrypt backup data—and understand who holds the keys
Choose a service that encrypts data both in transit and at rest. Then check where encryption happens and who controls the keys. With provider-managed encryption, the service manages the keys. Client-side or end-to-end encryption can limit the provider’s ability to access plaintext, but you must preserve the password or recovery key: if you lose it, the data may be unrecoverable.
Encryption protects confidentiality; it does not stop someone with account access from deleting backups or changing settings. CISA recommends encrypted backups, while a joint CISA, FBI, and Australian Signals Directorate advisory warns that cloud backups using a cloud key-management service may be affected if the cloud environment is compromised. CISA’s ransomware guide and the joint advisory describe these risks and recommend protections.
Recommended Free Tools
Lock down the backup account and its recovery path
Turn on MFA for both accounts
Enable MFA on the backup account and on the email account used to reset it. A compromised email account can undermine otherwise strong backup-account protections. MFA adds a defense layer if a password is stolen, but it does not make an account invulnerable. CISA recommends phishing-resistant MFA where available, particularly for email and accounts that access critical systems. Its MFA guidance describes options such as cryptographic keys, fingerprints, face recognition, and device PINs.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
If your provider supports passkeys or FIDO2 security keys, consider using one, but first confirm that the provider supports your device and that you have a workable recovery method. A physical key is not useful if it is incompatible or is your only way back into the account.
Use unique passwords and prepare for device loss
Use a unique, strong password for each account, including the recovery email. A password manager can help manage unique passwords, but it does not replace MFA. CISA’s password guidance advises against password reuse and discusses password managers.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Review how you can regain access if you lose your phone, security key, or authenticator. Save recovery codes somewhere separate from the backed-up data and from the everyday device used to access it. Keep any encryption recovery key separately as well; account recovery and decryption are different problems, and recovering the account may not recover a lost encryption key.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep a copy ransomware and account mistakes cannot reach
Cloud backup is not automatically protected from a compromised account, accidental deletion, or synchronization of corrupted or encrypted files. Keep multiple copies in separate locations or security boundaries, with at least one offline or otherwise inaccessible copy where practical. CISA recommends offline, encrypted backups and regular checks of availability and integrity. The joint advisory recommends multiple encrypted copies in physically separate, segmented, secure locations.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
If you use an external drive for an additional copy, disconnect it when the backup is complete and the drive is not in active use. Malware may reach an attached drive. See CISA’s ransomware guide.
For organizational or advanced cloud setups, version control, deletion protection, and immutable or object-locked storage can help preserve recoverable data. These controls are service-dependent and can involve configuration, compliance, or cost considerations; they are not a universal consumer requirement. CISA discusses versioning and deletion protection in its cloud security guidance.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Test that you can restore files
A backup is only useful if you can retrieve a clean, usable copy. Choose a recurring test schedule based on how often your files change and how much recent work you can afford to lose; CISA calls for regular testing but does not prescribe one interval for every consumer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Restore a few representative files to a separate location so you do not overwrite current copies.
- Open the restored files and check that their contents are intact.
- Confirm that you can sign in and complete account recovery using the method you would rely on if your usual device or authenticator were unavailable.
- Check whether version history or deletion recovery can retrieve an earlier file if a recent copy is corrupted or missing.
CISA’s ransomware guidance recommends regularly testing backup availability and integrity.
What to check when comparing backup services
Service features vary, so verify the current provider documentation rather than assuming every service offers the same protections.
Quick Recap
| Protection | What to verify |
|---|---|
| Encryption and key custody | Is encryption performed on your device or managed by the provider? How are recovery keys stored, and what happens to access if the account or service is compromised? |
| MFA and recovery | Does the service support passkeys, security keys, or another phishing-resistant option? Can you regain access if you lose your device or authenticator? Is the recovery email protected with MFA too? |
| Version history and deletion protection | Can you retrieve an earlier clean version or recover deleted files? Are retention periods and deletion controls documented? |
| Separate copies | Can you maintain another copy offline or in a separate account, location, or security boundary? |
| Restoration | Can you restore files in a way that suits your needs, and have you tested that those files open? |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
