> For the complete documentation index, see [llms.txt](https://docs.duplicati.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplicati.com/technical-details/understanding-backup/encryption-algorithms.md). # Encryption Algorithms This page describes how Duplicati handles encryption The modular design in Duplicati makes it simple to add new encryption methods, if needed. By default, Duplicati ships with a built-in [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard)-based encryption and a [GPG](https://en.wikipedia.org/wiki/GNU_Privacy_Guard)-based encryption that requires GPG binaries to be present on the system. ## AES Encryption The built-in [AES encryption is an open-source C# port](https://github.com/duplicati/sharpaescrypt) of the open-specification [AESCrypt file format](https://www.aescrypt.com). The file format ensures that each volume is encrypted with a separate random file-encryption key (FEK), which makes it harder to perform analysis on the encrypted volumes. The file format also adds a [HMAC](https://en.wikipedia.org/wiki/HMAC) signature that prevents modifications to the encrypted volume. ### AES Crypt format versions Duplicati 2.4 can write two versions of the AES Crypt format. Version 2 is the format used by all earlier versions. Version 3 uses a stronger key derivation with a configurable number of iterations (`--aes-v3-iterations`, default `300000`). Duplicati 2.4 still writes version 2 unless `--aes-version=3` is set (the `duplicati-cli help aes` output lists `3` as the default, but version 2 is what is written). Volumes in version 3 can only be read by Duplicati 2.4 and later (and the 2.3.1 beta), so do not switch to version 3 if the backup must remain readable by older versions, for instance for a downgrade. Duplicati reads both versions regardless of the setting, so existing volumes keep working after a change. The option `--aes-minimal-header` leaves out the optional metadata (creator, timestamp) from the file header. ## GPG Encryption With GPG encryption the implementation requires the GPG binaries to be installed on the system. GPG is available on most Linux distributions, and in most package managers, but can otherwise be obtained via the [GnuPG download page](https://www.gnupg.org/download/). By default, GPG encryption is done with symmetric encryption and default options ([CAST-128](https://en.wikipedia.org/wiki/CAST-128)), using the provided passphrase. It is possible to supply custom arguments to GPG, to choose a different algorithm, or even set it up to perform asymmetric encryption where only the public key is present on the client. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.duplicati.com/technical-details/understanding-backup/encryption-algorithms.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.