encrypted backups that actually restore, for free with kopia

backups are a faith-based religion for most people, and that's the problem

here's the uncomfortable truth, most people's backup strategy is "i think time machine is running" or "i have a folder on google drive, probably." nobody tests restores until the day their laptop dies, their ransomware hits, or they fat-finger a rm -rf on the wrong directory. that's when they find out the backup was corrupted, half-empty, or didn't exist at all. kopia fixes this for free, it's open source, it encrypts everything client-side, and it makes restoring a non-event instead of a crisis.

step 1: create the repository

a kopia repository is just the encrypted storage location your snapshots live in. it can be a local disk, a NAS, an external drive, or cloud storage like S3 or Backblaze B2. kopia encrypts the data before it ever leaves your machine, so even if you're using cloud storage, the provider never sees your files, just encrypted blobs.

kopia repository create filesystem --path /mnt/backup-drive

swap the filesystem path for s3 or b2 flags if you're pushing offsite, which you should be doing anyway. a backup that lives in the same room as the original is not really a backup, it's a copy that burns in the same fire.

step 2: snapshot something that actually matters

kopia snapshot create ~/Documents

this tells kopia "encrypt and back up everything in this folder right now." under the hood, kopia deduplicates and compresses as it goes, so repeated snapshots don't balloon your storage. only the changed bits get stored on subsequent runs. you can point this at your Documents, your home directory, a project folder, a docker volume, whatever actually hurts to lose. the point is you're not backing up your whole OS, you're backing up the stuff you can't just redownload or reinstall.

step 3: set a retention policy so you're not drowning in snapshots

kopia policy set --keep-daily 14 --keep-monthly 12

without a retention policy, you'll accumulate snapshots forever and eventually run out of storage or patience. this command tells kopia "keep the last 14 daily snapshots, and keep one snapshot per month for a year." so you get granular recent history for "oh no i deleted something yesterday" moments, and longer-term checkpoints for "wait, when did this file get corrupted" situations. kopia automatically prunes the rest, you don't have to babysit it.

step 4: the part everyone skips, actually restoring

this is the whole reason this post exists. a backup you've never restored is a backup you hope works, and hope is not a recovery plan.

kopia restore  ~/restore-test

run this to a throwaway test folder, not back over your real data. then open the files. check that documents open, that photos aren't corrupted, that the folder structure makes sense. do this once when you set the system up, and do it again every few months. it costs you ten minutes and it's the difference between a bad day and a catastrophic one. if your restore fails, you want to find that out on a random tuesday, not during an actual incident.

why this matters more than people think

ransomware doesn't just encrypt your files anymore, a lot of it specifically hunts for backup software and connected drives to destroy those first, knowing that's your safety net. an encrypted, versioned, offsite-capable backup like this one means even if your main system gets fully compromised, you have clean copies to restore from that the attacker couldn't touch or even read, because kopia encrypted it before it left your machine. that's the actual defensive value here, it's not just "don't lose files to a dead hard drive," it's "don't lose files to the worst day of your digital life."

the takeaway

kopia costs nothing, encrypts everything client-side, dedupes so it doesn't eat your storage alive, and gives you a retention policy so old snapshots clean themselves up. none of that matters if you never test the restore. set it up this week, run a test restore to a junk folder, confirm it actually works, then forget about it until your policy reminds you to check again. and send this to the one person in your life who still thinks "backup" is a verb they'll get to eventually.