BorgBackup and restic are the two most popular modern backup tools for Linux servers. Both create encrypted, deduplicated snapshots, both are open source and reliable, and both are far better than plain archives. The differences come down to where you store backups and how you like to work.

At a glance

BorgBackup restic
Language Python + C Go (single binary)
Storage backends Local, SSH (borg must be on the server) Local, SFTP, S3, B2, Azure, GCS, REST server, any rclone backend
Encryption Yes (repokey/keyfile modes) Always on
Deduplication Content-defined chunks Content-defined chunks
Compression lz4, zstd, zlib, lzma (configurable) zstd (auto/max)
Append-only protection Via SSH key restrictions (borg serve --append-only) rest-server --append-only, or object storage locks
Performance Very fast, efficient Fast; strong parallelism with cloud backends
Mount snapshots borg mount restic mount
Popular wrappers borgmatic, Vorta (GUI) resticprofile, autorestic, Backrest (web UI)
Hosted repositories BorgBase, Hetzner Storage Box, rsync.net Any S3-compatible provider, B2

Choose restic if…

  • you want to back up straight to object storage (S3, Backblaze B2, Wasabi, R2, MinIO);
  • you like a single static binary with no dependencies;
  • you need many backends, or rclone integration.

See restic backup and rclone.

Choose Borg if…

  • you back up to an SSH server you control (a storage VPS, a NAS, BorgBase);
  • you want fine control over compression levels;
  • you like borgmatic, which wraps Borg, database dumps, retention, checks and monitoring hooks in one YAML file.

Quick Borg example

sudo apt install borgbackup
export BORG_REPO=ssh://[email protected]/./web1
export BORG_PASSPHRASE='…'      # better: BORG_PASSCOMMAND reading from a protected file
borg init --encryption=repokey-blake2
borg create --stats --compression zstd,6 ::'{hostname}-{now:%Y-%m-%d}' /etc /var/www /var/backups/db
borg prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6
borg compact
borg list
borg extract ::web1-2026-11-01 var/www/example.com

With repokey mode, the encryption key is stored in the repository, protected by the passphrase. Export it (borg key export) and keep it safe, together with the passphrase.

Quick restic example

export RESTIC_REPOSITORY=sftp:[email protected]:/srv/restic/web1
export RESTIC_PASSWORD_FILE=/root/.restic-pass
restic init
restic backup /etc /var/www /var/backups/db
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
restic restore latest --target /tmp/r --include /var/www/example.com

Things that matter more than the tool

  • Off-site: keep backups on a different server or provider. See VPS as a backup server and storage VPS.
  • Database consistency: back up dumps, not live data files. See database backup automation.
  • Protection against deletion: append-only repositories, pull-based backups, or immutable object storage, so a hacked server can’t wipe history.
  • Monitoring: alert when a backup fails or doesn’t run.
  • Restore tests: schedule them. See backup strategy (3-2-1).
  • Keys and passphrases stored outside the server.

Alternatives

  • rsnapshot: simple hard-link snapshots, with no encryption. See rsnapshot.
  • Duplicati: web UI. See Duplicati.
  • Kopia: similar to restic, with a GUI and many backends.

Quick reference

Situation Pick
Backups to S3/B2 restic
Backups to an SSH server Borg (or restic over SFTP)
Want a YAML-driven all-in-one Borg + borgmatic
Want a web UI restic + Backrest, or Duplicati
Simple, unencrypted snapshots rsnapshot

Related: Docker volume backups and WordPress backup without a plugin.

  • Backup
  • Linux
  • Comparison