Restic — Fast & Secure Encrypted Backup Program

What it is

Restic is an open-source backup program that encrypts all data by default, deduplicates across snapshots, and supports over 20 storage backends including local disk, SFTP, S3, Google Cloud Storage, Azure Blob, and Backblaze B2. It ships as a single binary with no dependencies.

Restic targets system administrators, developers, and anyone who needs reliable automated backups. Its design philosophy prioritizes security (AES-256 encryption), efficiency (content-defined chunking for deduplication), and simplicity (one binary, clear CLI).

How it saves time or tokens

Restic's incremental backups only transfer changed data, making subsequent backups after the initial one finish in seconds for typical workloads. Deduplication across snapshots means storage costs stay low even with frequent backups. The uniform CLI works the same regardless of backend, so switching from local to S3 storage requires changing one parameter.

How to use

1. Install Restic via your package manager.
2. Initialize a repository on your chosen backend.
3. Run backup and restore commands.

# Install
brew install restic  # macOS
sudo apt install restic  # Debian/Ubuntu

# Initialize a repository
restic init --repo /backup/my-repo
# or with S3
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
restic init --repo s3:s3.amazonaws.com/my-bucket

# Backup a directory
restic -r /backup/my-repo backup /home/user/documents

# List snapshots
restic -r /backup/my-repo snapshots

# Restore a snapshot
restic -r /backup/my-repo restore latest --target /tmp/restore

Example

# Automated daily backup with retention policy
#!/bin/bash
export RESTIC_REPOSITORY=s3:s3.amazonaws.com/my-backups
export RESTIC_PASSWORD_FILE=/etc/restic-password

# Backup
restic backup /var/www /etc /home \
  --exclude='*.log' \
  --exclude='.cache'

# Prune old snapshots: keep 7 daily, 4 weekly, 12 monthly
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

Related on TokRepo

• DevOps tools — Infrastructure and operations tools
• Self-hosted solutions — Self-hosted infrastructure for data management

Common pitfalls

• Losing the repository password means losing all backups permanently. Restic has no password recovery. Store the password securely in a password manager and test restores regularly.
• The forget command without --prune removes snapshot references but does not free disk space. Always run forget with --prune to actually reclaim storage.
• First backup of large datasets takes significant time and bandwidth. Schedule initial backups during off-peak hours.