Recommended Free Tools
The safest way to store personal Linux VPS backups is to use several layers: create application-consistent exports, archive them with client-side encrypted and deduplicated snapshots, keep one repository close for fast recovery, replicate another to a geographically separate destination, and rotate an encrypted external drive when the data justifies it. Keep passwords and key exports away from the VPS, enforce retention, and regularly perform test restores. Encryption protects the contents, but it does not stop someone who can reach a repository from deleting it, so deletion-resistant or offline copies are essential.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The backup architecture that survives common failures
A single archive on the VPS is not a backup strategy. A disk failure, provider outage, accidental account deletion, compromised credentials, or ransomware can remove both the live data and the copy. Build the system in layers, with each copy serving a different recovery need.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Layer | Purpose | Failure it addresses | What to keep |
|---|---|---|---|
| Application export | Creates a consistent, portable representation of databases and other stateful services | Corrupt or incomplete restores caused by copying files while an application is writing | Database dumps, application exports, configuration, and encryption material needed to interpret them |
| Local or attached repository | Fast restores while the VPS and network path are available | Accidental file deletion and routine operational mistakes | Restic snapshots or Borg archives on storage that is not the same filesystem as the live data when possible |
| Geographically separate repository | Independent recovery if the host, account, or facility is unavailable | Provider outage, host destruction, site incident, and accidental deletion of the local copy | A second encrypted repository reached through a separate location or object-storage destination |
| Offline rotated drive | Removes a copy from network access entirely | Ransomware and an attacker who has obtained online repository credentials | An encrypted, labeled external hard drive or SSD stored safely and checked on a rotation schedule |
| Recovery documentation | Turns stored bytes into a usable recovery process | Lost passwords, missing keys, or uncertainty during an outage | Repository locations, tool versions, passwords, key exports, and tested restore commands kept separately from the VPS |
A local repository is convenient, but it shares a failure domain with the host if it is on the same disk or even the same provider. An off-site repository is slower to reach but protects against site-level loss. An external drive is useful only if it is encrypted, labeled, stored securely, and periodically connected and verified.
Restic or Borg: which fits your archive?
Both tools run on the VPS, perform content-defined chunking and deduplication, and encrypt data on the client before it reaches the repository. Unchanged chunks are reused, so later snapshots normally transfer only changed content. The choice is mainly about repository workflow and the restore interface.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Axis | Restic | Borg |
|---|---|---|
| Repository model | A repository directory containing encrypted data, metadata, and keys; usable locally or remotely | A self-contained repository of encrypted objects and archives; usable locally or over SSH |
| Space efficiency | Content-defined chunking and deduplication; later snapshots reuse existing data | Content-defined chunking and deduplication; unchanged chunks are reused |
| Encryption | Client-side encryption with authenticated repository contents | Client-side encryption with authenticated integrity; export the key and protect it separately |
| Compression | Supported in current documentation; select settings according to CPU and transfer limits | Offers compression choices, including fast and higher-ratio modes such as zstd |
| Restore ergonomics | List snapshots and restore selected paths; supported workflows can mount a repository | Extract an archive or mount it as a user-space filesystem |
| Main operational risk | An attacker who can reach the storage location may delete repository data | An attacker who can reach the remote server may delete archives or make them unavailable |
When Restic is the better fit
Choose Restic when you want one command-line workflow that can target local paths, SSH-accessible storage, and object-storage-style destinations. Its repository is encrypted before upload, and snapshot-oriented commands make it straightforward to list points in time and restore individual paths. Keep the repository password in a protected file or secret store rather than in shell history.
When Borg is the better fit
Choose Borg when SSH-hosted repositories and archive-oriented operations suit your environment. Borg’s documentation describes the division clearly: the server performs low-level repository operations while the client handles deduplication, encryption, compression, archives, backups, and restores. A Borg archive is the result of one backup operation, so each archive represents a recoverable point in time rather than a merely compressed folder.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not treat either tool as deletion protection
Restic’s threat model and Borg’s FAQ distinguish confidentiality from availability. Encryption prevents a storage operator or thief from reading the contents without the password or key; it does not prevent a person with write access from deleting the repository. Restrict destination credentials, use append-only or immutable capabilities where the destination supports them, and maintain an independent copy.
Prepare the VPS before the first snapshot
- Inventory what must be recoverable. List operating-system configuration, service definitions, application code, uploads, media, TLS material, firewall rules, scheduled jobs, and every database. Record paths and ownership, not just filenames.
- Separate live data from backup storage. A repository on the same filesystem as the data protects against accidental deletion but not a failed disk. Prefer a separate attached volume or a remote destination for the second copy.
- Install and pin a known tool version. Install Restic or Borg from your distribution or the project’s verified release channel, then record the output of
restic versionorborg --versionin your recovery notes. Keep the client version available when rebuilding the host. - Create a restricted backup identity. Run scheduled jobs with only the read access they need to collect data and write access they need to the repository. Do not reuse the VPS login password for a repository.
- Protect the secret material. Store the Restic repository password, Borg key export, destination credentials, and recovery notes outside the VPS. A password kept only in
/etcdisappears with the machine. - Check capacity before scheduling. Leave room for repository indexes, temporary files, compaction, and the next snapshot. Borg explicitly warns that normal operations need free space in both the destination filesystem and its cache.
Export databases and stateful applications first
File-level archiving alone is not a reliable database backup. A database may have pages in memory or uncommitted transactions while the archive reads its files. Run the database’s native dump or backup operation, verify that it completed, and include the resulting files in the next snapshot.
PostgreSQL
A cluster-wide logical export can be written to a protected backup directory with a command such as:
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
sudo -u postgres pg_dumpall --clean --if-exists > /var/backups/postgresql/all.sqlFor large clusters, use a dump format and parallel restore plan appropriate to your environment, but keep the same rule: finish the export before the archive starts. Restrict the dump to the database administrator and remove obsolete dumps after a successful repository run.
MySQL or MariaDB
For transactional tables, a consistent logical export can use:
mysqldump --single-transaction --routines --events --all-databases > /var/backups/mysql/all.sqlSupply credentials through the database client’s protected mechanism, not on a command line visible to other users. Include stored procedures, events, users, and grants when they are part of the service you need to rebuild.
SQLite and application-managed data
Use the application’s documented export or SQLite’s online-backup mechanism rather than copying a live database file during writes. Export queues, attachments, search indexes, and other generated state only if they are expensive or impossible to recreate; otherwise document how to regenerate them and exclude them to save space.
Set restrictive permissions on dump files, check their size and exit status, and perform a trial import into a disposable instance. A dump that exists but cannot be parsed is not a recovery point.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Create encrypted repositories
Initialize a local Restic repository
Create a directory on separate storage, make it accessible only to the backup account, and initialize it:
install -d -m 700 /srv/restic-repo
restic -r /srv/restic-repo initProvide the password interactively during initialization, then place it in a root-readable file such as /etc/restic/password with mode 600. A basic snapshot and verification sequence is:
export RESTIC_REPOSITORY=/srv/restic-repo
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic backup /etc /home /var/backups
restic snapshots
restic checkUse a separate repository for the off-site copy unless you have a deliberate replication design. Running the same backup job against both destinations makes it clear which destination succeeded.
Initialize a local Borg repository
Initialize Borg with authenticated encryption:
install -d -m 700 /srv/borg-repo
borg init --encryption=repokey-blake2 /srv/borg-repoCreate an archive containing the application exports and required system paths:
borg create --stats --compression zstd,3 /srv/borg-repo::{now} /etc /home /var/backupsExport the repository key immediately and store it away from the VPS:
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
borg key export /srv/borg-repo > borg-repository-key.txtKeep the export confidential. Anyone with the repository, key, and passphrase may be able to read the archive.
Use an off-site or object-storage destination
Restic and Borg can write to remote repositories, including SSH-accessible storage; Restic also supports object-storage-style destinations through its documented backends. Initialize the remote repository from the VPS, confirm that a snapshot appears there, and record the exact endpoint, repository path, and tool version. Treat object storage as a category, not as automatic immutability: configure retention or object-lock features separately when the service offers them.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Schedule snapshots and retention
Automate the sequence: export databases, run the archive, verify the repository, and only then prune old snapshots. Prevent overlapping jobs with a lock and send failures to a location you will actually monitor.
A Restic maintenance sequence can look like this:
flock -n /run/vps-backup.lock sh -c '
set -eu
export RESTIC_REPOSITORY=/srv/restic-repo
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic backup /etc /home /var/backups
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
restic check
'The equivalent Borg sequence is:
flock -n /run/vps-backup.lock sh -c '
set -eu
borg create --stats --compression zstd,3 /srv/borg-repo::{now} /etc /home /var/backups
borg prune --list --keep-daily=7 --keep-weekly=4 --keep-monthly=12 /srv/borg-repo
borg compact /srv/borg-repo
borg check /srv/borg-repo
'Schedule these commands with a system timer or cron under the restricted account or a tightly controlled root job. Run database exports before the archive, not in a separate job whose timing can race the snapshot.
Choose retention from recovery needs
Retention should reflect how far back an error might be discovered and how much data can change between snapshots. An illustrative policy is frequent recent points, seven daily points, four weekly points, and twelve monthly points; it is not a universal requirement. Increase the recent window for active projects and keep milestone copies before major upgrades. Estimate repository growth from the amount of data changed between snapshots, then add room for indexes, temporary files, compaction, and a failed run.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Never prune every destination at the same time without confirming that another verified copy exists. A retention command that succeeds can still remove the only usable recovery point.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reduce ransomware and credential damage
- Use separate credentials. The VPS should not hold unrestricted credentials for every copy. Give an off-site target only the permissions required for the backup operation.
- Prefer append-only or immutable behavior. Where supported, configure the destination so a compromised backup process can add data but cannot rewrite or delete earlier archives. Borg can be served in append-only mode; object-storage retention controls can provide a similar property.
- Keep an offline rotation. Connect an encrypted external hard drive or SSD, run a complete backup, verify it, unmount it cleanly, disconnect it, and store it away from the server. Rotate more than one drive if the archive is important.
- Separate secrets from data. Keep repository passwords, Borg key exports, destination credentials, and recovery instructions in a password manager plus an offline emergency copy. Do not put them in the same VPS account or directory as the repository.
- Monitor failures. A silent authentication error or full destination can leave yesterday’s snapshot as the newest usable copy. Capture exit codes and alert on missed runs, failed checks, and unusual repository growth.
Verify that an archive can actually be restored
A successful upload proves only that bytes reached a destination. Verification must cover repository integrity, readable files, and application behavior.
- List snapshots or archives. For Restic, run
restic snapshots. For Borg, runborg list /srv/borg-repo. Confirm that the expected dates, host, and source paths are present. - Run an integrity check. Use
restic checkorborg check. A full Borg data verification can useborg check --verify-data /srv/borg-repo; schedule intensive checks when their I/O load is acceptable. - Restore representative files elsewhere. Restic can restore the newest snapshot with
restic restore latest --target /restore-test. Borg can extract an archive withborg extract /srv/borg-repo::ARCHIVE-NAMEafter selecting the archive shown byborg list. Use a separate directory or replacement host, never the live data path. - Check metadata. Confirm ownership, permissions, symbolic links, extended attributes, service configuration, and secrets are usable by the intended service account.
- Restore a database dump. Import it into a disposable PostgreSQL or MySQL/MariaDB instance and run application-level checks: log in, read recent records, upload a file, and exercise the critical workflow.
- Record the result. Write down the date, repository used, tool version, commands, and any exclusions discovered. Repeat after major OS, database, or backup-tool changes.
Recover after a VPS failure
If the original VPS is still reachable
Restore only the missing paths into a staging directory, compare them with the live filesystem, and move them into place during a maintenance window. For a database, restore the dump into the database server rather than copying raw database files over a running instance.
If the provider or disk is gone
- Provision a replacement VPS with a supported Linux release and apply security updates.
- Install the recorded Restic or Borg version and recreate the service accounts, mount points, and permissions.
- Retrieve the repository password, Borg key export, and recovery notes from their separate storage.
- Connect to the geographically separate repository or mount the rotated drive. List snapshots before restoring.
- Restore system configuration and application data into staging, then restore database dumps into freshly initialized database instances.
- Reinstall packages and recreate service definitions, firewall rules, scheduled jobs, and TLS configuration. Do not blindly overwrite new host-specific files.
- Start services in dependency order and test application behavior, background jobs, uploads, and database writes.
- Only after validation, change DNS or other traffic controls to the replacement host. Take a new backup immediately once the recovered service is operating.
Common design mistakes and their fixes
| Mistake | Why it fails | Fix |
|---|---|---|
| Keeping the only repository on the VPS disk | A disk failure or host deletion removes live data and backup together | Add a separate off-site repository and, when warranted, an offline drive |
| Archiving live database files without a dump | The copy may contain an inconsistent transaction state | Run and verify a native database export before the snapshot |
| Assuming encryption prevents ransomware | Encryption protects secrecy, not deletion or denial of access | Use restricted, append-only or immutable destinations and an offline copy |
| Pruning before confirming replication | The newest local points may be removed while the remote job has failed | Check the remote snapshot and repository health before pruning |
| Filling the destination | Indexes, temporary files, compaction, or the next snapshot can fail | Measure growth, retain free space, and alert on capacity |
| Never testing a restore | Passwords, keys, permissions, exclusions, or dumps may be unusable | Restore files and a database on a separate directory or host on a regular schedule |
| Storing keys beside the repository | An attacker who gains the VPS receives both ciphertext and the means to decrypt it | Keep passwords and key exports in separate protected storage with an offline fallback |
A practical operating checklist
- Application and database exports finish successfully before every archive.
- At least one repository is outside the VPS failure domain.
- An encrypted external hard drive or SSD is rotated offline when the data warrants it.
- Repository passwords and Borg key exports are stored separately from the server.
- Retention reflects the period in which an unnoticed mistake could be discovered.
- Destination credentials cannot delete every copy.
- Free space covers indexes, temporary files, compaction, and a new snapshot.
- Automated jobs report failures and prevent overlapping runs.
- Integrity checks run on schedule.
- A representative file restore and a disposable database restore have both succeeded.
- Recovery notes include repository location, tool version, credentials location, and exact restore commands.
Canonical’s Ubuntu Server guidance calls keeping important backup media off-site good practice for disaster recovery. Combined with encrypted deduplicated snapshots, restricted destination access, and practiced restores, that layered approach gives a personal VPS archive a realistic path from a failed server to a working service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
