How to encrypt your backups before they leave your computer

A backup in the cloud is only as private as the key that unlocks it. If you encrypt your files on your own computer before they upload, the storage provider, anyone who gets into the account and anyone who steals the disk see only scrambled data. Free, open-source tools make this practical: Cryptomator for everyday files in a sync folder, Kopia, Duplicati or restic for scheduled backups, and age or VeraCrypt for a single archive or a USB drive. This article explains each one, and the one rule that matters most: the key is the backup.

Why encrypt before upload

When you copy files to an ordinary cloud folder, a readable copy now exists somewhere else. Many storage services encrypt their disks, but they hold the keys. That protects against a stolen hard drive in their building. It does not protect against someone who signs in to your account with a stolen password, a mistake in sharing settings, or a request to the provider.

Encrypting on your own device first changes that. The file is locked before it leaves, and only you have the key. The US cybersecurity agency CISA puts it at the top of its ransomware advice: maintain offline, encrypted backups of critical data.

There is a privacy duty too. Backups of client files contain personal information, and the Protection of Personal Information Act (POPIA) requires reasonable technical measures to protect it wherever it is kept.

What client-side encryption hides, and what it does not

Good tools encrypt both the contents of each file and its name. Someone looking at your storage sees a set of meaningless files.

Some things usually stay visible. rclone's documentation, for example, says plainly that file sizes, modification times and folder structure are not hidden in its encrypted mode. Cryptomator flattens the folder structure, but the number and rough size of files can still be seen. For most businesses that is an acceptable trade. What matters is that nobody can read the contents.

For everyday files in a sync folder: Cryptomator

Cryptomator creates an encrypted "vault" inside a folder that your cloud or Nextcloud client already syncs. You unlock the vault on your computer and it appears as an ordinary drive. Anything you save there is encrypted before your sync software uploads it.

• Each file is encrypted separately, with its name encrypted too, so changing one file uploads only that file.
• It works with the sync folder of most cloud services, including a Nextcloud folder, because Cryptomator does not sync anything itself.
• The desktop apps for Linux, macOS and Windows are free. The mobile apps are free to read a vault; writing to one is a one-time purchase.
• It is open source, under the GNU General Public License version 3.
• It offers a recovery key when you create a vault. Cryptomator says plainly that it cannot reset a vault password for you. Print the recovery key or store it in a password manager.

For a team, Cryptomator Hub manages vault access without sharing passwords, and has a free, self-hosted edition for small teams.

For scheduled, versioned backups

A sync folder copies changes, including mistakes and ransomware damage. A backup program keeps versions, so you can go back to last week. These open-source programs encrypt on your computer before anything is stored:

restic, Kopia and BorgBackup all assume the storage location cannot be trusted, which is exactly the point. With Duplicati, make sure you choose an encryption method during set-up, because it can be skipped.

For a single archive or a USB drive

• age encrypts one file with a passphrase or someone's public key. It suits a database export or a zip archive you are about to upload.
• GnuPG does the same with the OpenPGP standard, which Noiz also recommends for encrypted email.
• VeraCrypt creates an encrypted drive inside a file, or encrypts a whole USB stick or external disk. It is the natural choice for a backup drive you keep in a drawer.

The key is the backup

Every one of these tools says the same thing in its documentation: lose the password or key, and the data is gone for good. There is no reset, because nobody else has the key. That is the protection, and it is also the risk.

• Keep the key in a password manager. KeePassXC is free, open source and stores its database as an encrypted file on your own device.
• Keep one offline copy, printed or exported, in a safe place. BorgBackup can export its key as text for paper, and the UK National Cyber Security Centre (NCSC) suggests a printed key kept in a safe.
• Keep the key away from the backup and away from the computer being backed up. If one is lost or stolen, the other must not go with it.
• Protect the storage account with a strong password and two-factor authentication, so nobody can delete the encrypted copies either.

Check it works

A backup you have never restored is a hope, not a backup. Once your first backup has run, use a different computer, with only the stored key, to restore a few files. If you cannot do it calmly on a quiet afternoon, you will not do it during an emergency.

Where Noiz fits

Every Noiz shared hosting plan includes a weekly backup of the plan, kept off site. The Plesk backup overview explains where else you can store copies, preferably over SFTP or FTPS.

For files you work on every day, Nextcloud run by Noiz syncs to your desktop and phone, and a Cryptomator vault inside your Nextcloud folder keeps the most sensitive ones encrypted with a key only you hold. For servers and workstations that need backups under agreed terms, the Backup service is managed by Noiz, with capacity, retention, frequency and restore terms agreed with you before you buy, and backups encrypted at rest. Ask us which combination fits your business.

Sources

Checked 19 October 2026.

Guidance and law

• CISA, #StopRansomware guide
• NCSC, Principles for ransomware-resistant cloud backups
• NCSC, Always back up your most important data
• Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)

Tools

• Cryptomator, vault encryption, password and recovery key, pricing and source code
• Cryptomator Hub
• Kopia features
• Duplicati and setting up a backup
• restic references and preparing a repository
• BorgBackup, init and key export
• rclone crypt
• age
• GnuPG
• VeraCrypt
• KeePassXC

Noiz

• Backup service
• Shared hosting
• Nextcloud
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.