Welcome to the Duplicati Documentation! This site contains documentation for using the open source Duplicati client, including best practice, pro tips, and trouble shooting.

If you cannot find an answer on this site, you can always ask a question on our helpful forum 🤗.

Jump right in

Contributing

If you spot an error or want to add something to the documentation, head over to the and open an issue or pull request.

With a configured backup, you can have a schedule that runs the backup automatically each day. Having the backup run automatically is recommended because it makes it less likely that the backups are not recent if they are needed.

Even if the backup already has a schedule there may be times where you want to manually run a backup. If you have just configured a backup, you may want to run it ahead of the scheduled next run. If you are within the UI you can click the "Start" button for the backup.

Once the backup is running, the top area will act as a progress bar that shows how the backup progresses. Note that the first run of a backup is the slowest run because it needs to process every file and folder that is part of the source. On later runs it will recognize what parts have changed and only process the new and changed data.

If you need to automate starting a backup without using the UI, you can use ServerUtil to trigger backups from the commandline.

After running a backup, the view will change slightly and show some information about the backup.

The Duplicati package types

For desktop and laptop users, the most common application type is called the "GUI" package, which is short for Graphical User Interface. The GUI package includes the core components, a webserver to show the user interface and a tray icon (also called a status bar icon).

For users installing in environments without a desktop or screen, there are also commandline only, remote management and Docker versions. Depending on your setup, you may also want to use one of those packages on a desktop or laptop.

This page covers only the GUI installation.

Jump to the section that is relevant to you:

Install Duplicati on Windows

The most common installation format on Windows is the MSI package. To install on Windows you need to know what kind of processor is on your system. If you are unsure, you are most likely using the 64-bit processor, also known as x64. There is also a version supporting Arm64 processors, and a version for legacy 32-bit Windows called x86.

Simply head over to the and download the relevant MSI package. Once downloaded, double-click the installer. The installation dialog lets you adjust settings to your liking and will install Duplicati. The first time Duplicati starts up, it will open the user interface in your browser. At this point you are ready to .

Install Duplicati on MacOS

For MacOS the common installation method is to use a DMG file with the application file. Most modern MacOS machines are using the Apple Silicon which is called Arm64 in Duplicati's packages. If you are on an older Mac that has a 64-bit Intel processor, you can use the x64 package instead.

Once you know which kind of Mac you have, header over to the and download the relevant DMG file. Open the file and drag Duplicati into the Application folder, and then you can start Duplicati.

The first time Duplicati starts up, it will open the user interface in your browser. At this point you are ready to .

Install Duplicati on Linux

Most Linux distributions work well with Duplicati but there are only packages for Debian based distributions (Ubuntu, Mint, etc) and for RedHat based based distributions (Fedora, SUSE, etc). For other distributions you may need to manually install some dependencies.

For Linux distributions there are packages for the most common 64-bit based system with x64, support for Arm64 and the predecessor Arm7 aka ArmHF which are commonly found in NAS boxes and the older Raspberry Pi series.

Install on Debian-based Linux (Ubuntu, Mint, etc)

To install Duplicati on a Debian based system, first download the .deb package matching the system architecture, then run:

This will install all dependencies and place Duplicati in the default location on the target system. The first time Duplicati starts up, it will open the user interface in your browser. At this point you are ready to .

Install on RedHat-based Linux (Fedora, SUSE, etc)

To install Duplicati on a RedHat-based system, first download the .rpm package matching the system architecture, then run:

This will install all dependencies and place Duplicati in the default location on the target system. The first time Duplicati starts up, it will open the user interface in your browser. At this point you are ready to .

Install on another Linux distribution

For other linux distributions you can use the .zip file that matches your system architecture. Inside the zip files are all the binaries that are needed, and you can simply place them in a folder that works for your system. Generally, all dependecies are inlcuded in the packages so unless you are using a very slimmed down setup, it should work without additional packages.

The first time Duplicati starts up, it will open the user interface in your browser. At this point you are ready to .

The most important reason to make a backup is the ability to recover the data at a later stage, usually due to some unforseen incident. Depending on the incident, the original configuration may not be available.

To start a restore process in Duplicati, start on the "Restore" page.

If the backup configuration is already existing on the machine, you can choose it from the list. In this case you can click "Restore" and skip to the section on .

The restore and browsing process are fastest when using a configured backup, because Duplicati can query a local database with information. If the local database is not present, Duplicati needs to fetch enough information from the remote storage to build a partial database when performing the restore.

If you have exported the backup configuration and have the configuration available, you can click the "Start" button on "Restore from configuration" and skip to the

This page is not yet completed. See the section on the CLI interface.

This page is not yet completed. See the section on the recovery tool.

Duplicati supports backups to the Sia network which is a large-scale decentralized storage network. To use the Sia destination, use a this URL format:

sia://<host>:<port>/<path>
  ?sia-password=<password>

If the host is supporting unauthenticated connections, you can omit the password. The default port is 9980 if none is supplied and the default path is /backup if none is supplied.

Advanced options

To adjust the amount of redundancy in the Sia network, use the option --sia-redundancy. Note that this value should be more than 1.

Once Duplicati is running, you can set up a backup through the UI. If the UI is not showing, you can use the TrayIcon in your system menu bar and choose "Open". If you are asked for a password before logging in to the UI, see how to access without a password.

In the UI, start by clicking "Add backup", and choose the option "Add a new backup":

If you have an existing backup configuration you want to load in, see the section on import/export.

To set up a new backup there are some details that are required, and these are divided into 5 steps:

1. (descriptive name, passphrase)

2. (where to store the backups)

3. (what data should be backed up)

4. (automatically run backups)

5. (when to delete old backups and more)

1. Basic configuration

For the basic configuration, you need to provide a name and setup encryption:

The name and description fields can be any text you like, and is only used to display the backup configuration in lists so you can differentiate if you have multiple backups.

The encryption setup allows you to choose an encryption method and a passphrase. Encryption adds a minor overhead to the processing, but is generally a good idea to add. If you opt out of encryption, make sure you control the storage destination and have adequate protections in place.

To avoid weak passphrases, Duplicati has a built-in passphrase generator as well as a passphrase strength measurer.

2. Storage destination

The storage destination is arguably the most technical step because it is where you specify how to connect to the storage provider you want to hold your information. Some destinations require only a single setting, where others require multiple.

Due to the number of supported backends, this page does not contain the instructions for how to configure it. Instead, each of the supported destinations is described in detail on the .

When the details are entered, it is recommended that you use the "Test destination" button which will perform some connection tests that helps reveal any issues with the entered information.

When the destination is configured as desired, click the "Continue" button.

3. Source data

In the third step you need to define what data should be backed up. This part depends on your use. If you are a home user, you may want to back up images and documents. An IT professional may want to back up databases.

In the source picker view you can choose the files and folders you would like to back up. If you pick a folder, all subfolders and files in that folder will be included. You can use the UI to unselect some items that you want to exclude, and they will show up without a selection marker.

For more advanced uses, you can also use the filters to set up rules for what to include and exclude. See the section on if your have advanced needs.

Once you are satisfied with the source view, click the "Continue" button to continue to the schedule step.

4. Schedule

Having an outdated backup is rarely an ideal solution, but remembering to run backups is also tedious and easy to forget. To ensure you have up-to-date backups, there is a built-in scheduler in Duplicati that you can enable to have Duplicati run automatically.

If you prefer to run the backups manually, disable the scheduler, and you can use to trigger the backups as needed.

Once satisfied with the schedule, click "Continue".

5. Retention and miscelaneous

Even though Duplicati has deduplication and compression to reduce the stored data, it is inevitable that old data is stored that will take up space, but is not needed for restore. In this final configuration step you can decide when old versions are removed and what size of files to store on the destination.

The size of remote volumes is meant for a balanced size usable with cloud-storage and a limited network connection. If you have a fast connection or store files on a local network, consider increasing the size of the remote volumes. For more information see .

For the retention setting, it is inveitable that the backups will grow as new and changed data is added to the backups. If nothing is ever deleted, the backup size will keep growing in size. With the retention settings you can choose how to automatically remove older versions.

The setting "Smart backup retention" is meant to be useful for most users where it keeps one daily backup and then gradually fewer versions going back in time.

Once you are satisfied with the settings, click the "Save" button.

You have now configured your backup! 🎉

When using Duplicati, you need to decide on what type of instance you want to use. Duplicati is designed to be flexible and work with many different setups, but generally you can use this overview to decide what is best for you:

• Home user, single desktop machine: TrayIcon or Agent

• Server backup or headless: Server, CLI or Agent

• Multiple machines: , or

The TrayIcon

The is meant to be the simplest way to run Duplicati with the minimal amount of effort required. The TrayIcon starts as a single process, registers with the machine desktop environment and shows a small icon in the system status bar (usually to the right, either top or bottom of the screen).

When running, the TrayIcon gives a visual indication of the current status, and provides access to the visual user interface by opening a browser window.

The Server

The mode is intended for users who want to run the full Duplicati with a user interface, but without a desktop connection. When running the Server it is usually running as a system service so it has elevated privileges and is started automatically with the system.

When running the server it will emit log messages to the system log and it will expose a web server that can be accessed via a browser. Beware that if you are running the Server as root/Administrator you are also running a web server with the same privileges that you need to protect.

When the Server is running it will lock down access to only listen on the loopback adapter and refuse connections not using an IP address as the hostname. If you need to access the Server from another machine, make sure you protect it and and also add .

When running the Server you also need to , either by getting a , , or .

The Agent

The mode is intended for users who wants to run Duplicati with remote access through the . The benefit from this is that you do not need to provide any local access as all access is protected with HTTPS and additional channel encryption from the Agent to the browser you are using.

If you have multiple machines to manage, using the console enables you to access all the backups, settings, logs, controls, etc. from one place.

The Command Line Interface (CLI)

The mode is intended for advanced users who prefer to manage and configure each of the backups manually. The typical use for this is a server-like setup where the backups are running as cron scheduled tasks or triggered with some external tool.

Mixing types

For some additional flexibility in configurations it is also possible to combine the different types in some ways.

Combining Server and TrayIcon

It the server is used primarily to elevate privileges, it is possible to have the TrayIcon run in the local user desktop and connect to an already running Server. To do this, change the TrayIcon commandline and add additional arguments:

The --no-hosted-server argument disables launching another (competing) server, and the two other arguments will give information on how to reach the running server.

Triggering Server jobs externally

If you prefer to use the Server (or TrayIcon) but would like to trigger the backups with an external scheduler or event system, you can use the to trigger a backup or pause/resume the server.

Using the CLI for on Server backups

If you are using the Server (or TrayIcon) but you want to run a command that is not in the UI, it is possible to use the CLI to run commands on the backups defined in the Server. Note that the Server and CLI use different ways of keeping track of the , so you need to obtain the storage destination url and the database path from the Server and then run the CLI.

Duplicati supports storing files with Rackspace CloudFiles, which is a large-scale object storage, similar to S3. With CloudFiles you store "objects" (similar to files) in "containers" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

To use CloudFiles, you can use the following URL format:

cloudfiles://<container>/<prefix>
  ?cloudfiles-username=<username>
  &cloudfiles-accesskey=<access key>

Using a different API endpoint

The default authentication will use the US endpoint, which will not work if you are a customer of the UK service. To choose the UK account, add --cloudfiles-uk-account=true to the request:

If you need to use a specific host, you can also provide the authentication URL directly with the --cloudfiles-authentication-url option. If you are providing the URL, the --cloudfiles-uk-account option will be ignored.

User interface

To configure the Mega.nz backend, enter a unique path for the backup to be stored at, the username and password.

URL format for Commandline

To use the storage destination, you can use the following URL format:

Two-factor authorization

It is possible to provide a two-factor key with the option --auth-two-factor-key but since this value changes often, it is not suitable to use in most automated backup settings. This is a design choice from Mega.nz and cannot be fixed by Duplicati.

The Duplicati console is a paid option for handling monitoring of Duplicati backups, but has a free usage tier. To get started with the console, head over to the Duplicati Console page and sign up or log in.

If you connect your local instance to the Duplicati Console, this will automatically enable reporting to be sent from the Duplicati client to the console. Within the console, visit the Alert Center to configure what notifications you want to received.

Duplicati supports using Filen.io as the storage destination since stable release v2.2. Note that Duplicati encrypts volumes before uploading them to Filen.io, but will encrypt them again using the Filen encryption scheme so they can be downloaded from Filen.

User interface

To configure the destination for Filen.io, choose a unique path for the backup, and then provide the username and password to authenticate.

URL format for Commandline

To use Filen.io, use the following URL format:

You can also supply a Two-Factor code if your account is protected by 2FA, but note that you need to type in a new 2FA code each time you access the storage as Filen does not have support for API keys.

Duplicati only supports the V2 Auth protocol and will only encrypt data using the version 002 encryption mode. There is experimental support for reading data encrypted with version 003 if you need to upload files outside of Duplicati.

Duplicati supports using Dropbox as a storage destination. Note that Duplicati stores compressed and encrypted volumes on Dropbox and does not store files so they are individually accessible from Dropbox.

User interface

To configure the Dropbox destination you need to pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

URL format from Commandline

To use Dropbox, use the following URL format:

To use Dropbox you must first obtain an AuthID by using a Duplicati service to log in to Dropbox and approve the access. See the for different ways to obtain an AuthID.

Duplicati strives to make it as easy as possible to set up backups, and using the built-in scheduler makes it easy to ensure that backups are running regularly. Because it is easy to set up a backup and forget about, it is possible to have a backup running with little interaction.

Despite all efforts to make Duplicati as robust as possible against failures, it is not possible to handle every possible problem that may arise after the initial setup. Common failure causes is revoked credentials, filled storage, missing provider updates, etc.

To avoid discovering too late that the backup had stopped working for some reason, it is highly recommended to set up automated monitoring of backups. Duplicati has a number of ways that you can use to send reports into a monitoring solution:

• Duplicati Console

Duplicati supports backups to the Tahoe least-authority file store, Tahoe-LAFS.

User interface

To configure the TahoeLAFS destination, enter the server and the path.

URL format for Commandline

To use the TahoeLAFS destination, use this URL format:

If you have moved to a new machine and want to restore files to the new machine, you can follow the steps outlined in . If instead, you have already moved files to the new machine and would like to set up the new machine to continue backups made on the previous machine, there are a few ways to do this.

Note: it is possible to restore files across operating systems, but due to path differences it is not possible to continue a backup made on Windows on a Linux/MacOS based operating system and vice versa.

Note: do not attempt to run backups from two different machines to the same destination. Before migrating, make sure the previous machine is no longer running backups automatically. If both machines run backups, one instance will detect that the remote destination has been modified and will refuse to continue until the local database has been rebuilt.

If you have access to backup configurations, jump to the . And if you have no configurations, jump to the .

While it is not required that you keep a copy of the backup configuration, it can sometimes be convenient to have all settings related to a backup stored in a single file.

Export

To export from within the user interface, expand the backup configuration and click "Export ..."

On this page you should select "To File", which is default. The option to export "As commandline..." is not covered here, but allows you to get a string that can be used with the .

One of the supported notification methods in Duplicati is the open-source , supported by a variety of projects, including commercial enterprise offerings.

To send a notification via XMPP you need to supply one or more recipientes, an XMPP username and a password.

In the UI you can configure these mandatory values as well as the optional values.

The basic options for sending XMPP notifications can be entered into the general settings, which will then apply to each backup. It is also possible to apply or change the settings for the individual backups by editing the advanced options. Here is how it looks when editing it in the user interface:

You can toggle between the two views using the "Edit as list" and "Edit as text" links.

The secret provider was introduced in Duplicati version 2.0.9.109 and aims to reduce the possibility of leaking passwords from Duplicati by not storing the passwords inside Duplicati.

To start using a secret provider you need to set only a single option:

This will make the secret provider available for the remainder of the application.

You can then insert placeholder values where you want secrets to appear but without storing the actual secret in Duplicati. For commandline users, the secrets can appear in both the backend destination or in the options.

As an example:

The secret provider will find the three keys prefixed with $

When Duplicat is running, it collects some basic non-identifying telemetry, such as what version of Duplicati is running, what operating system it is running on and similar values. When running a backup it also collects the type of connection, the duration, the size of the remote and local filesets.

The purpose of this data collection is to give us an insight into how Duplicati is used and determine how we can best focus on making Duplicati better. We are sharing the aggregated data that we collect on a public page:

Opting out

In normal Duplicati operations, the files at the remote destination should never be handled by anything but Duplicati. Changing the remote files will always result in warnings or errors when Duplicati needs to access those files.

However, in certain exceptional scenarios, it may be required that the file contents are accessed manually.

Processing files encrypted with AES encryption

The files encrypted with the default AES encryption follows the

Duplicati has a wide variety of storage destinations, but the has even more! If you are familiar with Rclone, you can configure Duplicati to utilize Rclone to transfer files and extend to the full set of destinations supported by Rclone.

If you are using Rclone, some features, such as bandwidth limits and transfer progress do not work.

Duplicati does not bundle Rclone, so you need to download and install the appropriate binaries before you can use this backend.

User interface

Duplicati supports backups to the which is a large-scale decentralized storage network. The destination supports two different ways of authenticating: Access Grant and Satellite API.

User interface

To configure the Storj destination, choose the satellite that you will connect to, then provide the access grant. The bucket and path can be used to control where the data is stored within the network.

Duplicati uses , one for the and one for each backup. This page describes the overall purpose of the local database and how to work with it. The database itself is stored in the same folder as the server database and has a randomly generated name.

If you have access to the backup files generated by Duplicati, you only need the passphrase to restore files. As described in the , it is also everything that is needed to continue the backup. But to increase the performance and reduce the number of remote calls required during regular operations, Duplicati relies on a database with some well-structured data.

The database is essentially a compact view of what data is stored at the remote destination, and as such it can always be created from the remote data. The only information that is lost if the database is recreated are log messages and the hashes of the remote volumes. The log messages are mostly important for error-tracing but the hashes of the remote volumes are important if the files are not encrypted, as this helps to ensure the backup integrity.

Prior to running a backup, Duplicati will do a quick scan of the remote destination to ensure it looks as expected. This check is important, as making a backup with the assumption that data exists, could result in backups that can only be partially restored. If for the check fails for some reason, Duplicati will exit with an error message explaining the problem.

The WebDAV protocol is a minor extension to the HTTP protocol used for web requests. Because it is compatible with HTTP it also supports SSL/TLS certificates and verification similar to what websites are using.

User interface

To use the WebDAV destination you must enter: server, path on server, username and password. Depneding on your setup, you may also need to add some advanced options as explained below.

The most versatile reporting option is the ability to send messages via the HTTP(s) protocol. By default messages are sent as a body in a request with the verb.

To use the option, you only need to provide the url to send to:

Besides the URL it is also possible to configure:

• The message body and type (JSON is supported)

The storage destination is implemented with the , so all details from that page applies here as well, but some additional features are supported by AWS.

User interface

To use an AWS S3 destination you need to fill out: bucket, folder path, server, AWS Access Key Id, AWS Secret Access Key. You can decide on the bucket name and path, and get the Key Id and Access Key from the IAM center.

Duplicati supports storing files on which is a large-scale object storage, similar to S3. In Tencent COS you store "objects" (similar to files) in "buckets" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

User interface

To configure the Tencent COS destination you must supply: bucket, path, app id, region, secret id, and secret key.

Duplicati supports storing files with OpenStack, which is a large-scale object storage, similar to S3. With OpenStack you store "objects" (similar to files) in "containers" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

User interface

To use the OpenStack destination you must fill out the fields: bucket, domain name, tenant name, auth uri, version and region.

User interface

To configure the Jottacloud destination you need to pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

Sending emails is supported by having access to an SMTP server that will accept the inbound emails. From on your SMTP/email server provider you need to get a url, a username, and a password. If you are a , otherwise consult your provider for these details.

Besides the connection details, you also need to provide the recipient email address. Note that SMTP servers may sometimes restrict what recipients they allow, but generally using the provider SMTP server will allow sending to your own account.

In the UI you can configure these mandatory values as well as the optional values.

The basic options for sending email can be entered into the general settings, which will then apply to each backup. It is also possible to apply or change the settings for the individual backups by editing the advanced options. Here is how it looks when editing it in the user interface:

You can toggle between the two views using the "Edit as list" and "Edit as text" links.

Duplicati supports using as a storage destination. Note that Duplicati stores compressed and encrypted volumes on pCloud and does not store files so they are individually accessible from pCloud.

The pCloud provider was added in Duplicati v2.1.0.100, and is included in stable release 2.2.

User interface

To configure the pCloud destination you need to first choose if you are working with the Global or EU servers. Then pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

Duplicati supports storing files on , aka Aliyun OSS, which is a large-scale object storage, similar to S3. In Aliyun OSS you store "objects" (similar to files) in "buckets" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

Note that the bucket id is globally unique, so it is recommended using a name that is not likely to conflict with other users, such as prefixing the bucket with the project id or a similar unique value. If you use a simple name, like data or backup it is likely already associated with another project and you will get permission errors when attempting to use it.

Duplicati supports using as a storage destination.

User interface

To configure the Microsoft Group destination you need to provide the group email. Then pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

Duplicati supports storing files on , which is a large-scale object storage, similar to S3. In iDrive e2 you store "objects" (similar to files) in "buckets" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them..

Note that the bucket id is globally unique, so it is recommended using a name that is not likely to conflict with other users, such as prefixing the bucket with the project id or a similar unique value. If you use a simple name, like data or backup it is likely already associated with another project and you will get permission errors when attempting to use it.

Note that iDrive has a similar offering called , which is not currently supported by Duplicati.

Duplicati supports using as the storage destination since stable release v2.2.

Duplicati supports storing files with Backblaze B2, which is a large-scale object storage, similar to S3. With B2 you store "objects" (similar to files) in "buckets" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

User interface

To configure the B2 destination you must supply: bucket, path in bucket, application id, and application key.

The Server Message Block (SMB) / Common Internet File System (CIFS) backend provides native support for accessing shared network resources using the SMB/CIFS protocol. This backend enables direct interaction with Windows shares and other SMB-compatible network storage systems.

User interface

To use the SMB connection you must supply the server, shared name, path on server, username, password, and transport. See below for a description of the transport method.

Duplicati supports using as a storage destination. Note that Duplicati stores compressed and encrypted volumes on box.com and does not store files so they are individually accessible from box.com.

User interface

To configure the box.com destination you need to pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

Duplicati supports using as a storage destination. Note that Duplicati stores compressed and encrypted volumes on OneDrive and does not store files so they are individually accessible from OneDrive.

User interface

To use the OneDrive for Business dialog you must enter the server, path on server, account name and access key. You can use the "Add advanced option" button to configure some of the options described below.

Duplicati supports using as a storage destination. Note that Duplicati stores compressed and encrypted volumes on OneDrive and does not store files so they are individually accessible from OneDrive.

User interface

To configure the OneDrive destination you need to pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

Duplicati supports using as a storage destination. This page describes the SharePoint that uses the legacy API, for the .

User interface

To configure the SharePoint destination, enter the values for: server, path on server, account name, and access key.

The Service binary executable is a small helper program that simply runs the executable and restarts it if it exits. The purpose of this program is to assist in keeping the Server running, even in the face of errors. The Service binary is called Duplicati.Service.exe on Windows and duplicati-service on Linux and MacOS.

WindowsService

The Duplicati.WindowsService.exe

Even though Duplicati tries hard to reduce storage use as much as possible, it is inevitable that the remotely stored data grows as new versions of files are added. To avoid running out of space or paying for excessive storage use, it is important that unnecessary backups are removed regularly.

In Duplicati there are a few different settings that can be used to configure when a "snapshot" is removed. All of these options are invoked automatically at the end of a backup to ensure that removal follows a new version. If you use the Command Line Interface, it is possible to disable the removal and run the delete command as a separate step.

After deleting one or more versions, Duplicati will mark any data that can no longer be referenced as waste, and may occasionally choose to run a compact process that deletes unused volumes and creates new volumes with no wasted space.

Despite all deletion rules, Duplicati will never delete the last version, keeping at least one version available.

Delete older than

The most intuitive option is to choose a period that data is stored, and then to consider everything older than this period as stale data. The actual period depends on the actual use, but it could be 7 days, 1 year or 5 years for example.

This option is usually the prefered choice if the backups happen regularly, such as a backup each day, and then keep the last 3 months.

Keep versions

If the backups are running irregularly, where the backups are triggered by some external event, there may be long periods where there are no backups. For this case you can choose a number of versions to keep and Duplicati will consider anything outside that count as outdated.

Another special case is that if the source data has not changed at all, which is uncommon, Duplicati will not make a new version, as it would be identical to the previous version. In such a setup, it may be preferable to use a version count, despite regularly scheduled backups.

Retention policy

The retention policy is a "bucket" based strategy, where you define how many backups to keep in each "bucket" and what a "bucket" covers. With this strategy, it is possible to get something similar to style backup rotations.

The syntax for the rentention policy uses the to define the bucket and contents in that bucket. The bucket size is first, then a colon separator, and then the duration in the bucket. Multiple buckets can be defined with commas. As an example:

The first bucket is defined as being 7 days, and the value U means unlimited the number of backups in this bucket. In other words: for the most recent 7 days, keep all backups.

The second bucket is defined as 1 year, keeping a backup for each 1 week, resulting in rougly 52 backups after the first 7 days.

Any backups outside the buckets are deleted, meaning anything older than a year would be removed.

In the UI, a helpful default is called "Smart retention" which sets the following retention policy:

Translated, this policy means that:

• For the most-recent week, store 1 backup each day

• For the last 4 weeks, store 1 backup each week

• For the last 12 months, store 1 backup each month

Sharing the secret provider

If the secret provider is configured for the entry application (e.g., the TrayIcon, Server or Agent) it will naturally work for that application, but will also be shared within that process.

For the Agent, this means that setting the secret provider for the agent, will also let the server that it hosts use the same secret provider. When a backup or other operation is then executed by the server it will also have access to the same secret provider.

This sharing simplifies the setup by only having a single secret provider configuration and then letting each of the other parts access secrets without further configuration. If needed, the secret providers can be specified for the individual backups, such that it is possible to opt-out of using the shared secret provider.

How to avoid passing credentials on the commandline

To make passing arguments to the application a bit harder to obtain, the value for --secret-provider is treated as an environment variable if:

• It starts with $ optionally with curly brackets {}:

  • $secretprovider

No expansion is done on environment variables, so the entire provider string is required to be set as an environment variable.

How to protect against secret provider outages

If you run an operation and the secret provider is unavailable when the secrets are requested, the operation will fail. For most uses the occurence of an outage is so rare that this situation is acceptable.

However, for some uses it is important that the backups keep running, even in the face out outages. To handle this need, Duplicati supports an optional cache strategy:

Storing the secrets somewhere makes it more likely that it is eventually leaked. For that reason, the default is to use the cache setting None which turns off the caching fully and only relies on the provider.

The InMemory setting is the least intrusive version as it only stores the secrets in the process memory. This option is most useful when using a such that it stays in memory between runs.

Finally, the Persistent option will write secrets to disk, so it can handle situations where the provider is unavailable during startup, or where a shared provider does not work.

As the purpose of the secret provider is to prevent the secrets from being written to disk, the secrets are written to disk using a passhprase derived from the secret provider url. If the secret provider url does not contain a strong secret already, it is possible to add any parameter to the url to increase the strength of the key.

If the secret provider url changes, it is no longer possible to retrieve the cached values, and the next run will fail if the provider is unavailable, but will otherwise write a new encrypted cache file to disk.

The Agent is designed to be deployed in a way that is more secure and easier to manage at scale than the regular TrayIcon or Server instances. When the agent is running, it does not have any way to interact with it from the local machine.

On the very first run, the Agent will attempt to register itself with the Duplicati Console. If there is a desktop environment and a browser on the system, the Agent will attempt to open this with the registration link. In case there is no such option, the Agent will print out the link in the console or Event Viewer on Windows. The Agent will repeatedly poll the Console to find out when it is claimed.

As long as the Agent is not registered, restarting it will make it attempt to connect again.

Once the agent is registered, it immediately enables the connection and will be listed as a registered machine in the .

Simplified registration

To skip the registration step and have the agent connect directly to the console without any user intervention, it is required to first create a link that is pre-authorized on the Console. To do this head to the and click the "Add registration url" button.

Any machine can now use this pre-authorized url to add machines to your organization in the Console. You can click the "Copy" button to get the link to your clipboard and paste it in when registering a machine. Do not share this link with anyone as it could allow them to add machines to your account.

To revoke a link, simply delete it from within the portal. This will prevent new machines from registering, but existing registered machines will remain there.

With the registration link, start the Agent with a commandline such as:

This will cause the Agent to immediately show up in the Console. Future invocations of the agent will not require the registration url, but should the Agent somehow be de-registered, it will re-reregister if the url is set and the link is still valid.

Registration with deployment

To simplify starting the agent in larger scale deployments, it is possible to configure with the registration url.

To create a preload file manually, create a new file named preload.jsonwith the following content:

This file can then be distributed to the target machine before the package is installed. The describes the possible locations where Duplicati will look for such a file.

The SFTP destination is using the ubiquitous SSH system to implement a secure file transfer service. Using SSH allows secure logins with keys and is generally a secure way to connect to another system. The SSH connection is implemented with Renci SSH.Net.

User interface

To use the SFTP destination you must enter at least the shown information: server, port, folder path, and username. You must most likely also provide either a password or an SSH private key through the advanced options.

URL format for Commandline

To use the SFTP destination you can use a URL such as:

You can supply a non-standard port through the hostname, such as ssh://hostname:2222/folder.

Using key-based authentication

It is very common, and more secure, to use key-based authentication, and Duplicati supports this as well. You can either provide the entire key as part of the URL or give a path to the key file. If the key is encrypted, you can supply the encryption key with --auth-password.

Starting with Duplicati 2.2 it is now possible to provide an SSH private key file with the option --ssh-keyfile=/path/to/file or an inline key with the option --ssh-key=url-encoded-key . In the user interface you can drop the file with the private key, or paste in the contents.

Using key-based authentication from the Commandline

To use a private key inline, you need to url encode it first and then pass it to --ssh-key. An example with an inline private key:

Note that you need both the prefix sshkey:// and you need to URL encode the contents.

If you have the SSH keyfile installed in your home folder, you can use the file directly with --ssh-keyfile:

Note that Duplicati does not currently support key agents so you must pass the password here.

For best security it is recommended to use a separate identity and key files for the user, so a compromise of the keys does not grant more permissions than what is required.

Validating the host key

Since SSH does not have a global key registry, like for HTTPS, it is possible to launch a man-in-the-middle attack on an SSH connection. To prevent this, Duplicati and other SSH clients will use certificate pinning where the previously recorded host certificate hash is saved and changes to the host certificate must be manually handled by the user.

On the first connection to the SSH server, Duplicati will throw an exception that explains how to trust the server host key, including the host key fingerprint. Once you obtain the host key fingerprint, you can supply it with the --ssh-fingerprint option.

If the host key changes, you will get a different message, but also reporting the new host key, so you can update it. The option --ssh-accept-any-fingerprints=true is only recommended for testing and not for production setups as it will disable the man-in-the-middle protection.

If you are using the UI, you can click the "Test connection" button and it will guide you to set the host key parameters based on what the server reports.

Timeout and keep-alive

By default, Duplicati will assume that the connection works once it has been established. If the SSH server is malfunctioning it may cause operations to hang. To guard against this case, you can set the --ssh-operation-timeout option to enforce a maximum time the operation may take.

A different kind of timeout is when firewalls and other network equipment monitors the connections and closes them if there is no activity. Because Duplicati may open a connection and then perform a long operation locally, it may cause the connection to be closed due to inactivity. The option --ssh-keepalive can be used to define a keep-alive interval where messages are sent if there is no other activity.

Both options are default disabled and should only be enabled if there are special conditions in a setup where the options are needed.

Managed service providers (MSPs) can use organizations and sub-organizations in the Duplicati console to isolate tenants, delegate access, and safely offboard customers. The console enforces depth and licensing limits so MSP operators maintain strong governance while working across multiple customer environments.

The description below is targeted MSPs but can also be applied to larger organizations, where there is a need to isolate different areas, for example geographically or by organizational structures.

Hierarchy model

• Root organization: Created without a parent. MSP staff typically sign in to the MSP root and operate downstream organizations from that context.

• Sub-organization: Created under a parent organization to represent a customer or site. Each sub-organization handles references to the root and parent organizations. The hierarchy is currently limited to three levels to keep trees manageable.

• Detached organization: Created without a parent or shared root to start a completely new tree. MSPs can use this when a customer must live in an isolated tenant before being linked to a broader tree. Note that each root organization needs its own payment configuration.

Creating organizations from the console

1. Ensure ownership and licensing: The signed-in operator must be an owner of the current organization. Only organizations with Enterprise-level subscriptions can create sub-organizations, so confirm the MSP root has the right plan before adding customers.

2. Choose hierarchy placement:

   • To add a customer under the MSP tree, create a new organization while signed in to the MSP root (or an existing parent).

Delegating access across the hierarchy

• Security groups can be linked only downward from a parent organization to its descendants. To link a group, you must own the source organization, the target organization, and the security group itself.

• This model lets MSPs define shared automation or operator roles in the MSP root and selectively expose them to customer organizations without risking cross-tenant access.

An example setup for a multi-level enterprise organization could look like this:

Deleting organizations safely

1. Select the target: From the organizations list, pick the customer organization you need to remove. You cannot delete the organization you are currently operating from, and you must be an owner of the target organization.

2. Clear blockers: Deletion is blocked while the organization still has active subscriptions, child organizations, or customer resources (backup reports, connected agents, registered machines, client encryption keys, connection strings, or client backup configurations). Remove or migrate these items first.

3. Confirm removal: Once prerequisites are cleared, run the delete action. The console revokes accounts and other items that are not directly user managed.

MSP best practices

1. Add customers as sub-organizations: Create new orgs without the Detached flag so each customer anchors to the MSP root for consistent reporting and licensing checks.

2. Delegate access with intent: Link MSP-owned security groups down to specific customer orgs that require shared operational roles or automation.

3. Offboard cleanly: Before deleting a customer org, clear active subscriptions and resources, then delete to revoke linked access keys automatically.

The template system used in Duplicati is quite simple, as it will essentially expand Windows-style environment placeholders, %EXAMPLE%, into values. The same replace logic works for both the subject line (if applicable) and the message body.

Note: The description here only covers the text-based output (such as emails, etc). The template system for JSON is a bit different.

Duplicati has defaults for the body and subject line, but you can specify a custom string here. For convenience, the string can also be a path to a file on the machine, which contains the template.

An example custom template could look like:

Duplicati %OPERATIONNAME% for %backup-name% on %machine-name%

The %OPERATIONNAME% operation has completed with the result: %PARSEDRESULT%

Source folders: 
%LOCALPATH%

Encryption module: %ENCRYPTION-MODULE%
Compression module: %COMPRESSION-MODULE%

%RESULT%

The template engine supports reporting any setting by using the setting name as the template value. Besides the options, there are also a few variables that can be used to extract information more easily:

JSON output

If the output is JSON it needs to be handled different than regular text, to ensure the result is valid. The logic for this is to re-use the templating concept, but only as a lookup, to figure out what keys to include in the results.

An example template could be:

This will ensure that each of those values will be included in the extra element in the JSON output. The default template for JSON output includes all fields listed above, but no options are included by default.

The Environment Variable provider

The simplest provider is the env:// provider, which simply extracts environment variables and replaces those. There is no configuration needed for this provider, and the syntax for adding it is simply:

The File Secret provider

The file-secret:// provider supports reading secrets from a file containing a JSON encoded dictionary of key/value pairs. As an example, a file could look like:

The file provider also supports files encrypted with and you supply the decryption key with the option passphrase. Suppose the file is encrypted with the key mypassword you can then configure the provider:

To avoid passing the encryption key via a commandline, see .

To encrypt the file, you can use the provided with Duplicati:

Credential Manager (Windows)

On Windows XP and later, the can be used to securely store secrets. As the credentials are protected by the account login, there is no configuration needed, so the setup is simply:

Using libsecret (Linux)

The stores various credentials on Linux and integrates with various UI applications to let the user approve or reject attempts to read secrets. The libsecret provider supports a single optional setting, collection, which indicates what collection to read from. If not supplied the default collection is used. To use the libsecret provider, use this argument:

If you are using a system with a Gnome-based desktop, such as Ubuntu, you can use the application to manage your passwords.

Using the pass secret provider (Linux)

The is a project that implements a secure password storage solution on Linux system, backed by GPG. Duplicati can use pass as the secret provider:

If you want to use pass, make sure it is installed on the system. You also need a GPG key, and you can create one with:

As part of the key generation process, you are asked to enter an email address that will later be used to identify the key. Once you have the GPG key you can initialize pass with:

Using the KeyChain (MacOS)

For MacOS users the standard password storage is the program. The secrets stored here as application passwords can be used by Duplicati. The KeyChain can be enabled as a secret provider with:

For more advanced uses the options account and service can be used to narrow down what secrets can be extracted.

The Simple Storage Service, S3, was originally described, developed and offered by Amazon via AWS. Since then, numerous other providers have adopted the protocol and offer S3-compatible services. While these services are mostly compatible with the core S3 protocol, a number of additional AWS-specific settings are usually not supported and will be ignored.

This page deals with S3 in general, for a specific setup on AWS S3, refer to the AWS specific page.

When storing data in S3, the storage is divided into a top-level "folder" called a "bucket", and each bucket has "objects", similar to files. For most providers, an object name with /characters will be interpreted as subfolders in some way.

In the original S3 specification, the bucket name was used as part of the hostname, causing some issues with bucket names that are not valid hostnames, and some delays for new buckets caused by DNS update speeds. Newer solutions use a single shared hostname and provide the bucket name as a parameter.

For AWS S3, and most other providers, the bucket name is a global name, shared across all users. This means that simple names, such as backup or data will likely be taken, and attempts to use these will cause permission errors. For to make it unique. The Duplicati UI will recommend prefixing the account id to the bucket name, to make it unique.

User interface

To use the S3 backend you must fill in details for all the fields: bucket, folder path, server, AWS Access Key ID, and AWS Secret Access Key. Not that your provider may use different names for the different values, especially the Access Key Id and Secret Access Key may be called something like username and password.

With the advanced options you can choose many extra settings as described below.

URL format for Commandline

To use S3 as the storage destination, us a format such as:

Note that the default for S3 is to use unencrypted connections. The connections are secured with signatures, but all data transfered can be captured through the network. If the provider supports SSL/TLS, which most do, make sure to add --use-ssl=trueto also encrypt the connection.

Make sure you consult the provider documentation to get the server name you need for the bucket region. If you are using AWS, .

Choosing the client

The S3 storage destination can either use the or , and you can choose the library to use with --s3-client=minio.

Generally, both libraries will work with most providers, but the AWS library has some defaults that may not be compatible with other providers. While you can configure the settings, it may be simpler to use Minio with the default settings.

Using non-AWS storage

Most providers other than AWS S3 use an older version of the protocol, so to connect to them you often need to set either the option --s3-disable-chunk-encoding or use the Minio client with --s3-client=minio (but not both):

Creating the bucket

Since the bucket defines the place where data is stored, a bucket needs to be created before it can be used. All providers will offer a way to do this through their UI, and allows you to set various options, such as which geographical region the bucket is located in.

If you use Duplicati to create the bucket, you can also set the option --s3-location-contraintto provide the desired location. Support for this, and available regions, depends on the provider.

Storage class

With S3 it is also possible to set the storage class which is sometimes used to fine-tune the cost/performance/durability of the files. The storage class is set with --s3-storage-class, but the possible settings depends on the provider.

Configuring Duplicati to back up OpenClaw (formerly known as Moltbot or Clawdbot) is a smart move. Because OpenClaw stores highly sensitive data - including plain-text API keys, session tokens for WhatsApp/Telegram, and long-term memory - it is critical that your backup is encrypted and stored securely.

This guide assumes you have Duplicati installed and OpenClaw running locally.

Step 1: Locate your OpenClaw Data

Before opening Duplicati, you need to know exactly what you are backing up. By default, OpenClaw stores its configuration and "memory" in a hidden directory.

• Linux/macOS: ~/.clawdbot (or ~/.openclaw in newer versions)

• Windows: C:\Users\<YourUsername>\.clawdbot

Key files in this folder:

• clawdbot.json: Your main config and API keys.

• .bak.X files: Automatic rotating backups (these also contain secrets).

• memory/: Markdown documents containing the bot's learned context.

Step 2: Create a New Backup Job

1. Open the Duplicati Web UI.

2. Click Add backup > Configure a new backup > Next.

3. General Settings:

Step 3: Choose a Destination

Duplicati supports dozens of backends. To keep your "AI brain" safe, choose a destination that isn't on the same physical machine:

• Cloud Storage: Backblaze B2, Google Drive, or Dropbox.

• S3 Compatible: If you use a VPS (like DigitalOcean or AWS).

• Local/SSH: A NAS or a second computer on your network.

Remember to test the destination to ensure it is working as expected.

Step 4: Select Source Data

Navigate to the path identified in Step 1.

1. In the file tree, find your user directory.

2. Check the box for .clawdbot (or .openclaw).

3. Filter Rule (Optional): If you are running OpenClaw via Docker and have massive log files, you might want to exclude *.log

Step 5: Schedule and Retention

• Schedule: Since OpenClaw is an "always-on" assistant, a daily backup is usually sufficient. If you use it for heavy task automation, consider every 6 hours.

• Retention: Use Smart backup retention. This keeps one backup for each of the last 7 days, one for each of the last 4 weeks, and one for each of the last 12 months.

Step 6: Finalize and Run

On the last screen (Options), keep the default Remote volume size (50MB). Click Save and then click Run now to start your first backup.

⚠️ A Note on Security

Recent security audits (Jan 2026) have highlighted that OpenClaw stores credentials in cleartext. If your Duplicati destination AND passphrase is compromised, anyone who finds those files has full access to your connected Telegram, WhatsApp, and LLM accounts (OpenAI/Claude). Treat your Duplicati passphrase like the 🔑 to your house.

The most basic destination in Duplicati is the file backend. This backend simply stores the backup data somewhere that is reachable from the file system. The destination can be a network based storage as long as it is mounted when needed, a fixed disk, or a removable media.

User interface

In the user interface you simply need to either pick or type the path to where the backup data will be stored.

In the advanced options you can choose the options mentioned below.

URL format for Commandline

The file backend can be chosen with the file:// prefix where the rest of the destination url is the path.

Windows example:

Linux/MacOS example:

For most cases it will also work without the file:// prefix, but adding the prefix makes the intention clear.

Improving speed for local filesystems

Since Duplicati is intended to be used with remote systems, it will make a temporary file, and then copy the temporary file to the new location. This enables various retry mechanisms, progress reporting and failure handling that may not be desired with local filesystems.

To change this logic to instead use the operating system movecommand to move the file into place, avoiding a copy, set the option --use-move-for-put, on the file backend and also set --disable-streaming-transfers. With these two options, all special handling will be removed and the transfer speed should be the optimal possible with the current operating system. Note that setting --disable-streaming-transferswill not show any progress during transfers, if you are using the UI, because the underlying copy or move method cannot be monitored.

Disabling length verification

Because a local storage destination is expected to have a very low latency, the file backend will verify the length of the file after copy. This additional call is usually very fast and does not impact transfers speeds, but can be disabled for slightly faster uploads with --disable-length-verification.

Removable drives (mostly Windows)

For removable drives, the mount path can sometimes change when inserting the drive. This is most prominent on WIndows, where the drive letters are assigned based on what order the drives are connected. To support different paths, you can supply multiple alternate paths with --alternate-target-paths, where each path is separated with the system path separator (;on Windows, :on Linux/MacOS):

If you would like to support any drive letter, you can also use * as the drive letter (Windows only):

Because using multiple paths could end up attempting to make a backup to the wrong drive, you can use the option --alternate-destination-marker to provide a unique marker filename that needs to exist on the destination:

Using this option will scan all paths provided, either using the * drive letter or --alternate-target-paths, and check if the folder contains a folder with the given filename.

Authentication (Windows Only)

On Windows, the shares can be authenticated with a username and password (not with integrated authentication). This uses a to authenticate prior to accessing the share.

To use authentication, provide the --auth-username and --auth-passwordarguments to the query. Since the authentication in Windows is tied to the current user context, it is possible that the share is already mounted with different credentials, that may not have the correct permissions.

To guard against this, it is possible to drop the current authentication and re-authenticate prior to acessing the share. This can be done by adding the --force-smb-authentication option.

Duplicati supports backing up to Azure Blob Storage, which is a large scale object storage, similar to S3.

User interface

To configure Azure Blob Storage you must fill in: container name, account name and access key. To use a SAS token instead of an access key, use the advanced options.

The Container name is the name of the container in the Storage Account.

The Account name is the name of the Storage Account.

The Access key can be found on the Storage Account under "Security + Networking" -> "Access keys". You can use either key1 or key2.

If you want to use key rotation, consider using a and store the keys in the secret provider, so they are always up-to-date.

You do not need a separate container for each backup, you can use prefixes to distinguish them, but using individual containers makes it easier to manage rules for each backup.

URL format for Commandline

To use the Azure Blob Storage destination, you can use the following URL format:

Create container

You can create the container via the Azure portal, but if you prefer, you can also let Duplicati create the container for you. The .

If you use the UI, the "Test connection" button will prompt you if the container needs to be created.

Using a Shared Access Signature (SAS) token

Instead of using a traditional Access Key, you can also use a SAS token. To use this, supply it instead of the access key, for example:

The account name is the name of the Storage Account, and the SAS token must have access to read, write, list, and delete files in the container.

Cold storage

Since Duplicati stable version 2.2, Duplicati recognizes data in cold storage and will avoid downloading these files for testing. The recommended way to use this is to set up life-cycle rules that move files into cold storage after a period. Once the files are in cold storage, Duplicati will not attempt to read them.

However, if you have retention enabled, you must set --no-auto-compact as Duplicati will otherwise attempt to download the files from cold storage, in order to compact them.

Similarly, for a restore, you must manually move files from cold storage into the bucket before attempting the restore operation.

Duplicati supports using Microsoft SharePoint as a storage destination. This page describes the SharePoint that uses the Graph API, for the SharePoint provider that uses the legacy API, see SharePoint.

User interface

To configure the SharePoint v2 destination you need to pick a unique folder name for the backups, provide the site id, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

URL format for Commandline

To use SharePoint, use the following URL format:

To use SharePoint v2 you must first obtain an AuthID by using a Duplicati service to log in to Microsoft and approve the access. See the for different ways to obtain an AuthID.

Performance tuning options

If you need to gain more performance you can fine-tune the performance of chunked transfers with the options:

• --fragment-size

• --fragment-retry-count

• --fragment-retry-delay

For most uses, it is recommended that these are kept at their default settings and only changed after confirming that there is a gain to be made by changing them.

Duplicati supports using Google Drive as a storage destination. Note that Duplicati stores compressed and encrypted volumes in Google Drive and does not store files so they are individually accessible from Google Drive.

User interface

To configure the Google Drive destination you need to pick a unique folder name for the backups, and then authorize Duplicati to work on your behalf. Simply click the "AuthID" link in the text field and the authentication process will start and fill out the "AuthID" when you are done.

URL format from Commandline

To use Google Drive, use the following URL format:

To use Google Drive you must first obtain an AuthID by using a Duplicati service to log in to Google and approve the access. See the for different ways to obtain an AuthID.

Access levels

Duplicati can work with limited access to Google Drive, where it only has access to its own files. This access is recommended, because it prevents accidents where files not relevant for Duplicati can be read or written. On the community server, this option is called "Google Drive (limited)".

Unfortunately, the security model in Google Drive sometimes resets the access, cutting off Duplicati from accessing the files it has created. If this happens, it is not currently possible to re-assign access to Duplicati.

To recover from this situation, you must download the files from Google Drive, then delete them in Google Drive, and finally re-upload the files using the .

You can also choose to , and you can configure this to grant Duplicati full access to all files in Google Drive.

Team folder

If you need to use a Team Drive, set the option --googledrive-teamdrive-id to the ID for the Team Drive to use. If this is not set, it will use the personal Google Drive. For example:

Before you can install Duplicati, you need to decide on three different parameters:

• The type you want: , , , .

• Your package manager: apt, yum or something else.

To send a notification via Telegram you need to supply a channel id, a bot token and a an api key.

To obtain the bot token (aka bot id), message the @BotFather bot. After creating the bot, send a message to the bot, so it can reply. For more details on Telegram bots, see the .

After obtaining the bot token you can obtain the channel id with a cURL script:

To obtain the API key, follow the .

With all required values obtained, you can set up the Telegram notifications in the general settings:

Managed service providers (MSPs) can manage multiple customer tenants by combining the with user and security group tooling. This article explains how to set up the hierarchy, invite users, and reuse security groups across sub-organizations while keeping access auditable.

The main application in the Duplicati installation is the TrayIcon program, called Duplicati.GUI.TrayIcon.exe on Windows and simply duplicati on Linux and MacOS.

The TrayIcon executable is a fairly small program that has as the primary task to register with the operating system desktop environment, and place a status icon in the desktop tray, menu, or statusbar.

The TrayIcon is connected to the server and will change the displayed icon based on the server state. Opening the associated context menu, provides the option to quite, pause/resume, or open the UI.

The second task the TrayIcon is usually responsible for, is to host the . The server is responsible for handling stored backup configurations, provide a user interface, run scheduled tasks and more. When launching the TrayIcon, it will also transparently launch and host the server. It uses this hosted instance to subscribe to changes, so it can change the icon and signal the server state.

Duplicati supports storing files on , aka GCS, which is a large-scale object storage, similar to S3. In GCS you store "objects" (similar to files) in "buckets" which define various properties shared between the objects. If you use a / in the object prefix, they can be displayed as virtual folders when listing them.

Note that the bucket id is globally unique, so it is recommended using a name that is not likely to conflict with other users, such as prefixing the bucket with the project id or a similar unique value. If you use a simple name, like data or backup it is likely already associated with another project and you will get permission errors when attempting to use it.

Before you can install Duplicati, you need to decide on two different parameters:

• The type you want: GUI, Server, Agent, CLI.

• You machine CPU type: Arm64 or x64

Deciding on type

To use Duplicati on MacOS, you first need to decide which kind of instance you want: GUI (aka ), , , . The section on has more details on each of the different types. For home users, the common choice is the GUI package in .dmgformat. For enterprise rollouts, you can choose the .pkg packages.

Determine CPU architecture

Your Mac is most likely using Arm64 with one of the M1, M2, M3, or M4 chips. If you have an older Mac, it may use the Intel x64 chipset. To see what CPU you have, click the Apple icon and choose "About this Mac". In the field labelled "Chip" it will either show Intel (x64) or M1, M2, M3, M4 (Arm64).

Installing the package

The packages can be obtained via the . The default package shown on the page is the MacOS Arm64 GUI package in .dmg format. If you need another version click the "Other versions" link at the bottom of the page.

If you are using the .dmg package the installation works similar to other application, simply open the .dmg file and drag Duplicati into Applications. Note that with the .dmg package, Duplicati is not set to start automatically with your Mac, but if you restart with the option to re-open running programs, Duplicati will start on login.

If you are using the .pkg package, Duplicati will install a launchAgent that ensures Duplicati starts on reboots. The CLI package installs a stub file that is not active, so you can edit the launchAgent and have it start the Server if you prefer.

Using the TrayIcon

If you have installed the GUI package, you will have Duplicati installed in /Applications and it can be started like any other application. Once Duplicati is started, it will place itself in the menu bar near the clock and battery icons. Because Duplicati is meant to be a background program, there is no Duplicati icon in the dock.

On the first start Duplicati will also open your browser and allow you to configure your backups. If you need access to the UI again later, locate the TrayIcon in the status bar, click it and click "Open". If you install the CLI or Agent packages, the Duplicati application is not available.

Using the Server

If you install the CLI package, Duplicati binaries are placed in /usr/local/duplicati and symlinked into /usr/local/bin and you can start the server simply by running:

When invoked as a regular user, it will use the same folder, ~/Library/Application Support/Duplicati, as the and share the configuration.

Note: If you install the GUI package or install from homebrew, Duplicati's binaries are not symlinked into the paths searched by MacOS. You can invoke the binaries by supplying the full path:

Using the Agent

With the there is a minimal setup required, which is to register the machine with the Duplicati Console. When installing the Agent package, it will automatically register the Duplicati agent with a launchAgent that starts Duplicati in an Agent mode.

If the Agent is not registered with the Console, it will open the default browser and ask to be registered. Once registered, it will run in the background and be avilable on the Duplicati Console for management.

If you have a for registering the machine, you can place a file in /usr/local/share/Duplicati/preload.json with content similar to:

Using the CLI

Using the CLI is simply a matter of invoking the binary:

Since the CLI also needs a local database for each backup, it will use the same location as above to place databases. In addition to this, it will keep a small file called dbconfig.json in the storage folder where it maps URLs to databases. The intention of this is to avoid manually specifying the --dbpath parameter on every invocation.

If you specify the --dbpath parameter, it will not use the dbconfig.json file and it will not store anything in the local datafolder.

Note: If you install the GUI package or install from homebrew, Duplicati's binaries are not symlinked into the paths searched by MacOS. You can invoke the binaries by supplying the full path:

Using the support programs

Each package of Duplicati contains a number of support utilities, such as the . Each of these can be invoked from the commandline with a duplicati-* name and all contain built-in help. For example, to invoke , run:

Note: If you install the GUI package or install from homebrew, Duplicati's binaries are not symlinked into the paths searched by MacOS. You can invoke the binaries by supplying the full path:

If you are starting Duplicati for the first time, it will ask you to pick a password. Picking a strong password is important to ensure unwanted access to Duplicati from other processes on the system. By default, Duplicati has chosen a strong random password and it is recommended for most users to not change the random password. It is not possible to extract the current password in any way and it is not possible to disable the password.

Access from the TrayIcon

The TrayIcon process will usually host the Server that presents the UI. Since the two parts are within the same process they can communicate securely, and this setup enables the TrayIcon to negotiate a short-term signin token with the server, even though it does not know the password.

This mechanism works for most default installations and is secure as long as the desktop is not compromised. This signin process is the reason that the default random password is prefered, because it is not possible to leak the password.

The downside is that you can bookmark the Duplicati page, but you may be asked for a password that you do not know when accessing the page. In this case, re-launching from the TrayIcon will log you in again.

If you prefer, it is possible to choose the password so you can enter it when asked. Optionally, you can also choose to disable the feature that allows the TrayIcon to sign in without a password, through the settings page.

Login with the TrayIcon is shown here for MacOS, but the same works on Linux and Windows:

Temporary signin token

When Duplicati starts up with the randomly generated password it will attempt to emit a temporary sign-in url. If you run either the or in a terminal, most systems will show the link here.

If you are running Duplicati as a service with no console attached, the link will end up in the system logs. On Windows you can use the utility to find the message with a sign-in url. For Linux you can view the system logs, usually:

Note that the regular output from journalctl is capped in width, so you cannot see the whole token. Pipe to a file or another program as shown above to get the full output.

For MacOS you can use the .

Once you have obtained the link, simply click it or paste it into a browser. Note that the sign-in token has a short lifetime to prevent it being used to gain unathorized access from someone who obtains the logs. If the link has expired, simply restart the service or application and a new link will be generated.

After a password has been set, the link will no longer be generated.

Change password with ServerUtil

If you are not using the TrayIcon or you have disabled the signin feature, but lost the password somehow, you can change the password with in some cases.

This works by reading the same database as the server is using and extracting the keys used to sign a sign-in token, and then creating a sign-in token. This sign-in token works the same way as the TrayIcon's signin feature. Note that the password itself cannot be extracted from the database, it can only be verified.

After obtaining a sign-in token, ServerUtil can then change the password in the running instance.

This only works if:

• The database is readable from the process running ServerUtil

• The database field encryption password is available to the process running ServerUtil

If these constraints are satisfied, it is possible to reset the server password by running:

If ServerUtil is launched in a similar environment (i.e., same user, same environment variables) this would allow access in most cases. There are a number of commandline options that can be used to guide ServerUtil in case the environments are not entirely the same.

For Linux user, you can usually use su or sudoto enter the correct user context, but some additional environment variables may be needed. The default location for the database is described in the , and a different location can be provided with --server-datafolder.

Example change with a different context

If you need to change the password for a Windows Service instance running in the service context, you can use a command such as this:

Similarly, if the service is running as root on Linux:

Change password from the Server

If the other options are not available, it is possible to restart the process and supply the commandline option:

This will write a hashed () version of the new password to the database and use this going forward. This process requires restarting the server, but is persisted in the database, so it is only required to start the server once with with the --webservice-password option and future starts can be done without the password.

Since commandline arguments and environment variables can be viewed through various system tools, it is recommended that the option is not set on every launch. A prefered way to set this would be to stop all running instances, start once with the new password from a commandline terminal, shut down, and then start again normally.

The option can also be supplied to the and processes, which will pass it on to their internal instance of the Server.

Disable sign-in tokens

It is possible to disable the use of sign-in tokens completely, which can increase security further. This is done by passing the option:

This will make the reject any sign-in tokens and prevent the access from the TrayIcon and ServerUtil without explicitly passing the password. With this option, it will require write access to the database to create a new token, but it will also require handling the password in a safe manner from all instances where this is needed.

This option can also be supplied to the process and is default enabled by the .

Duplicati uses the same setup for filters to select individual files. It is most prominent when choosing the sources, but can be applied in other places where individual files can be selected.

Path representations

Internally, Duplicati represents folders with a trailing path separator, which makes it easy to distinguish between the two types. This distinction is important when constructing filters, as Duplicati requires a full match, including the trailing path separator, before a match is considered. An example for Windows and Linux/MacOS:

• Windows

  • Folders

    • C:\Users\john\

• Linux/MacOS

  • Folders

    • /home/john/

For brewity, the remainder of this page will only use the Linux/MacOS format in examples, but the same can be applied to the Windows paths.

Filter types