Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Restic encrypts and authenticates repository data before storing it, but encryption alone does not protect backups from deletion. To make backups both private and off-site, protect the repository password, use a remote backend separate from the computer being backed up, and verify that you can restore files.

What Restic encryption protects—and what it does not

Restic’s design uses AES-256 in counter mode (CTR) to encrypt repository data and Poly1305-AES to authenticate it. The repository password is processed with scrypt to derive keys; key files store information needed to derive the repository’s master keys. Restic says stored file contents and metadata cannot be accessed without the repository password, apart from informational metadata in key files, and that tampering can be detected. The project’s threat-model guarantee is: “Unencrypted content of stored files and metadata cannot be accessed without a password for the repository.” Restic design and threat model.

That guarantee depends on the documented assumptions: the backup host is trusted, the Restic binary is authentic, and an attacker cannot obtain the repository password. Encryption does not stop someone who can access the storage location from deleting repository files. Restic is therefore not, by itself, ransomware-proof or deletion-proof. Separate control of the destination, restricted credentials, and provider retention features may help with those risks, but they are separate protections to verify with the chosen service.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep the repository password recoverable

The password is not an optional convenience: Restic’s setup documentation warns that losing it makes the data irrecoverable. Store it in a secure password manager or another protected location that is separate from the repository, so loss of access to the backup destination does not also mean loss of the password. Restic: preparing a new repository.

#1 Best Overall
Sale
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
  • Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

A password change should not be confused with revoking a leaked master key. Restic’s design explains that a leaked key cannot simply be revoked without re-encrypting the repository. Adding another password does not, on its own, repair that exposure. Restic design and threat model.

Choose a destination that is genuinely off-site

A local repository can be useful, but a copy on the same computer is not a separate off-site backup. Restic’s README puts it plainly: “Saving a backup on the same machine is nice but not a real backup strategy.” A remote repository puts the backup somewhere other than the machine being backed up; the project documents these backend categories and services. Restic backends.

Rank #2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
  • Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
Backend What setup requires When it may fit
SFTP over SSH An SSH server and configured public-key access; unattended backups need passwordless login. You already operate an SSH/SFTP host and can manage its access and storage.
REST server A separately configured REST server. The setup guide covers HTTP or HTTPS and TLS certificate verification. You can operate or arrange a REST endpoint and manage its security.
Amazon S3 or S3-compatible storage Storage credentials and the correct endpoint, region, or provider-specific settings. You want object storage and can configure credentials and endpoint details for automated jobs.
Backblaze B2, Microsoft Azure Blob Storage, Google Cloud Storage, or OpenStack Swift Provider-specific account and backend configuration; consult the current Restic setup instructions. You already use one of these services or have a reason to select it.

Restic’s documentation establishes backend support, not which service is cheapest or best for a particular reader. Compare your ability to operate the backend, automation credentials, current storage and retrieval charges, geographic separation, deletion or retention controls, and the bandwidth available for restoring data. Verify prices, regions, egress charges, and retention terms directly with the provider; they are not established by Restic’s backend list. The supported-backend setup details are in Restic’s repository setup guide and the Restic backends list.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Set up a repository and make a backup

The exact configuration depends on the backend and Restic version. Use the versioned setup instructions for your destination rather than treating these orientation steps as a complete provider configuration.

Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
  • Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
  1. Prepare the destination. For SFTP, configure SSH access and a public key; for REST, set up the server; for S3 or compatible storage, obtain credentials and determine the required endpoint and region settings.
  2. Initialize the repository. Run restic init with the repository location and any backend configuration required by your setup. Restic prompts you to enter the new repository password twice.
  3. Create a snapshot. Run restic backup for the files or directories you intend to protect, supplying the repository configuration and password securely as described in the relevant setup instructions.
  4. Practice retrieval. Use restic restore to recover selected files or a snapshot to a safe location. Restic also documents restic mount as a way to access previous snapshots. Test the kind of recovery you would actually need; the documentation does not prescribe one universal test schedule.

See the repository preparation guide for backend setup and the Restic quick start for the basic backup and retrieval workflow.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Check repository health and understand extra data

restic check examines repository data. If it reports unreferenced pack files, that does not automatically mean the repository is broken: Restic’s FAQ says extra packs can remain after an interrupted backup or upload, and restic prune can remove such unreferenced data. Read the command output and the FAQ before cleanup, especially if a backup operation was interrupted. Restic FAQ and working with repositories.

Quick Recap

SaleBestseller No. 1
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$129.99
Bestseller No. 2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$229.99
Bestseller No. 3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$119.80
Bestseller No. 4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$208.99
Best Value
Sale
UnionSine 500GB Ultra Slim Portable External Hard Drive HDD-USB 3.0
  • [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
  • 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
  • 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
  • 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
  • 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Rank #4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue
  • Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.