Kopia vs Restic
Kopia and Restic compared for encrypted, deduplicated backups: storage backends, encryption and compression, scheduling and maintenance, GUI vs CLI, multi-machine setups, ransomware protection and release status as of November 2026.
Quick Answer
Both are open-source Go tools that make encrypted, deduplicated, incremental snapshots to local disks, SFTP or object storage. Restic (BSD-2-Clause, v0.19.1 on 5 Jul 2026) is a single CLI binary that runs when you call it. It has no built-in scheduler or GUI, uses repository format v2 with compression by default, and pairs with rest-server for append-only remote repositories. Kopia (Apache-2.0, v0.23.1 on 16 Jun 2026) adds policies with built-in scheduling and retention, automatic quick and full maintenance, an official desktop and web GUI (KopiaUI), a multi-user repository server, Reed-Solomon error correction and S3 Object Lock support. Pick Restic for scripted server and VPS backups where a large community and a simple tool matter most. Pick Kopia if you want a GUI, policies and scheduling built in, or central backups for several machines.
Last updated November 2, 2026. Covers Kopia v0.23.1 (16 Jun 2026) and Restic v0.19.1 (5 Jul 2026) plus the 0.19.0 changes, using both projects' docs, release notes and GitHub data.
| Feature | Kopia | Restic |
|---|---|---|
| Licence | Apache-2.0 | BSD-2-Clause |
| Written In | Go | Go |
| Interfaces | CLI, KopiaUI desktop GUI, web UI and API in server mode | CLI only (JSON output for scripting) |
| Storage Backends | S3/S3-compatible, Azure Blob, B2, GCS, WebDAV, SFTP, local/network, Google Drive (experimental), Rclone (experimental), Kopia Repository Server | Local, SFTP, REST server, S3/S3-compatible (MinIO, Wasabi), OpenStack Swift, B2, Azure Blob, GCS, Rclone |
| Encryption | Always on; AES256-GCM by default or ChaCha20; no unencrypted repositories | Always on; AES-256-CTR with Poly1305-AES authentication, scrypt key derivation |
| Compression | Per policy: s2, pgzip, zstd and deflate variants, with file-size and extension filters | zstd (repository v2, default since 0.14); levels auto (default), max, plus fastest and better (0.19) |
| Built-in Scheduling | Yes, via snapshot policies (KopiaUI or server) | No (cron, systemd, Task Scheduler or resticprofile) |
| Retention / Pruning | Policy-based retention; snapshot GC during full maintenance | forget with keep-* policies, then prune (or forget --prune) |
| Repository Maintenance | Automatic: quick ~hourly, full every 24 h | Manual: prune and check run when you schedule them |
| Multi-Machine / Server Mode | Repository server with per-user snapshot/policy isolation | Shared repository or rest-server; no per-user isolation in restic itself |
| Ransomware Protection Options | S3 Object Lock (with retention extension), restricted B2 keys, repository server | rest-server --append-only mode |
| Mount Snapshots | Yes (mount snapshot as a local disk) | Yes via FUSE (Linux, macOS, FreeBSD) |
| Error Correction | Reed-Solomon | No (integrity verified with check) |
| Latest Release (Nov 2026) | v0.23.1 (16 Jun 2026) | v0.19.1 (5 Jul 2026) |
Kopia
An Apache-2.0, Go-based backup tool that takes encrypted, compressed, deduplicated snapshots to cloud, network or local storage, with a CLI, an official GUI (KopiaUI) and an optional repository server.
Pros
- Policies at global, host, user@host and path level control scheduling, retention, exclusions and compression, so a snapshot schedule needs no cron job
- Official GUI: KopiaUI desktop app for Windows, macOS and Linux, plus a web UI in server mode, using the same kopia binary as the CLI
- Automatic maintenance: quick maintenance about every hour and full maintenance (snapshot GC and compaction) every 24 hours, enabled by default
- Repository server proxies storage access for many machines: each user sees only their own snapshots and policies, and clients never hold the storage credentials
- S3 Object Lock support with optional retention renewal during full maintenance, plus S3 storage classes; Reed-Solomon error correction against bitrot
- Broad backends: S3 and compatibles, Azure Blob, Backblaze B2, Google Cloud Storage, WebDAV, SFTP, local/network, plus native Google Drive and Rclone (both experimental)
Cons
- Still pre-1.0, and v0.23.1 (June 2026) fixed a rare race condition that might lead to data loss, with an upgrade recommended
- A shared repository has one password and no access control unless you run the repository server
- Object Lock only works through the S3 backend; the native Backblaze B2 backend supports restricted keys but not object locks
- Smaller community than Restic (about 14.6k GitHub stars against roughly 37k)
- More moving parts (policies, maintenance ownership, server mode) to understand before you trust it
Best For
Desktop users and small teams who want a GUI, built-in scheduling and retention, or one repository server collecting backups from several machines, including Windows laptops.
Restic
A BSD-2-Clause, Go-based command-line backup program that stores encrypted, deduplicated, compressed snapshots in a repository on local disk, SFTP, a REST server or cloud object storage.
Pros
- One static binary with a small, stable command set (init, backup, snapshots, restore, forget, prune, check, mount), easy to script with cron or systemd
- Large, long-running community (about 37k GitHub stars) and extensive docs, so most problems are already solved somewhere
- Official binaries are built reproducibly and can update themselves with restic self-update
- Repository format v2 (restic 0.14+) with zstd compression is the default; 0.19 added the fastest and better compression levels
- Backends: local, SFTP, REST server, Amazon S3 and S3-compatibles, OpenStack Swift, Backblaze B2, Azure Blob, Google Cloud Storage, plus anything Rclone supports
- rest-server offers an append-only mode, htpasswd auth and TLS, so a compromised client cannot delete existing backups
Cons
- No built-in scheduling: the docs tell you to use cron, systemd or Task Scheduler, or the third-party resticprofile
- No official GUI; everything happens in the terminal
- Retention is a two-step job (forget, then prune, or forget --prune), and you schedule check yourself
- FUSE mount works only on Linux, macOS (FUSE-T or macFUSE) and FreeBSD, not Windows
- Sharing one repository between machines gives every client full read-write access unless you front it with rest-server
Best For
Linux servers, VPSes and homelabs where backups run from cron or systemd timers and you want a simple, well-understood CLI with a huge community behind it.
Two philosophies: a sharp CLI vs a backup system
Restic is deliberately a tool, not a service. The backup docs say so directly: restic has no built-in way of scheduling backups because it runs when executed rather than as a daemon. They point you to cron or systemd on Linux and BSD, Task Scheduler on Windows, or the third-party resticprofile, and they warn you to detect an already-running instance before starting another. Everything else follows the same pattern. You run backup, forget, prune and check yourself, usually from a script that also handles notifications. Many server admins see that as a feature: there is nothing resident, nothing to configure beyond environment variables, and every run is reproducible from a shell history. Kopia wraps the same core idea (content-addressed, encrypted, deduplicated snapshots) in more machinery. Policies can be set globally, per host, per user@host or per path, and they decide when snapshots run, what is excluded, how long snapshots are kept and how data is compressed. Repository maintenance is automatic: quick maintenance runs roughly every hour, and full maintenance, which garbage-collects unreachable content and compacts pack files, runs every 24 hours, both on by default. KopiaUI exposes all of this in a desktop app. The result is closer to a backup product you install than a command you script.
Storage backends, encryption and compression
On the storage side the two overlap heavily. Restic's documentation covers local directories, SFTP, its own REST server, Amazon S3 and S3-compatible services such as MinIO and Wasabi, OpenStack Swift, Backblaze B2, Azure Blob Storage and Google Cloud Storage. Anything else, Google Drive included, goes through the rclone backend. Kopia supports S3 and compatibles (with storage classes and object locking), Azure Blob, Backblaze B2, Google Cloud Storage, WebDAV, SFTP and local or network paths. It also has native Google Drive support and an Rclone mode, both marked experimental in its docs, and its own repository server. Both encrypt everything before it leaves the machine, and neither allows unencrypted repositories. Restic uses AES-256 in counter mode, authenticated with Poly1305-AES, with keys derived from your password by scrypt. Kopia defaults to AES256-GCM, offers ChaCha20 as an alternative, and encrypts a randomly generated primary key with your password. Restic added compression with repository format version 2 in 0.14. It is the default for new repositories, runs at level auto, and 0.19.0 (June 2026) added the fastest and better levels. Kopia sets compression per policy, choosing among s2, pgzip, zstd and deflate variants, with minimum and maximum file sizes and extension filters, and its docs publish a benchmark table so you can trade speed for ratio.
Many machines, one repository
Both tools deduplicate across everything in a repository, so backing up several similar machines to one repository saves real space. The difference is trust. Kopia's features page warns that a repository has one password and no access control, so anyone you share it with can read everything. Its answer is the repository server. Kopia proxies access to the underlying storage, clients authenticate with a username and password instead of storage credentials, and each user sees only their own snapshot and policy manifests. The docs are careful to say that only manifests are access-controlled, not content, though content IDs are salted hashes that cannot be guessed without the original data. The server also exposes an API and web UI for triggering snapshots and checking client status. Restic itself has no per-user isolation. Every client that knows the repository password and storage credentials has full read-write access. The usual pattern is rest-server, which adds htpasswd authentication, TLS and an append-only mode, so clients can add snapshots but not delete or overwrite existing data. That is an effective ransomware boundary, but pruning then has to happen from a trusted machine with direct access. For one or two Linux boxes either approach is fine. For a fleet of laptops run by non-admins, Kopia's server model is the more complete solution.
Immutability, integrity and recovery
Ransomware protection works differently in each. Kopia supports S3 Object Lock: once enabled (and the bucket has to be created with Object Lock on), stored files cannot be deleted before their retention date, even with valid credentials. Kopia can extend retention during full maintenance, but only if full maintenance runs at least as often as the lock period. The docs flag two caveats. Object Lock works only through the S3 backend, so Backblaze users must use B2's S3 API rather than Kopia's native B2 backend. And once enabled on a bucket, Object Lock cannot be turned off. Restic's equivalent is architectural rather than storage-level: point clients at rest-server --append-only and keep prune credentials off those hosts. For integrity, Kopia adds Reed-Solomon error correction to guard against bitflips and bitrot, and stores index and metadata redundantly so it can often recover from partial loss. Its docs are clear that it cannot recover a corrupted data file, which is why they recommend regular consistency checks. Restic relies on restic check, which 0.19.0 can now limit to snapshots selected by filters. For restores, both let you restore a full snapshot or individual files, or mount snapshots as a filesystem. Restic's FUSE mount runs on Linux, macOS and FreeBSD only. Restic's Windows story includes VSS snapshots via --use-fs-snapshot.
Maturity, releases and choosing safely
Restic has the longer track record and the bigger community, with about 37k GitHub stars against Kopia's 14.6k. Releases come a few times a year: 0.18.0 in March 2025, 0.18.1 in September 2025, then 0.19.0 on 9 June 2026 and 0.19.1 on 5 July 2026. 0.19.0 was largely a correctness release, covering exit codes, Windows ACL restores, duplicate index entries and more aggressive pruning of small pack files, and it raised the build requirement to Go 1.25. Official binaries are reproducible and self-updating. Kopia releases more often (0.22.0 to 0.22.3 in November and December 2025, 0.23.0 on 12 May 2026, 0.23.1 on 16 June 2026) and is still versioned below 1.0. The 0.23.1 notes describe it as a bugfix for a rare race condition that might lead to data loss and recommend upgrading, which is exactly the kind of note to read before you adopt a backup tool. It is also a sign that the issue was found and fixed openly. Practical advice for either tool: pin and monitor versions, run scheduled integrity checks (check for Restic, verification and maintenance for Kopia), and do a full test restore to a scratch machine at least once before relying on a repository. Both are free, so the real cost is your storage bill plus the time you spend on operations, and that time is where they differ most.
Verdict
Choose Restic for servers, VPSes and anything you already automate with cron or systemd. It is a single, reproducibly built binary with a small command set, compression on by default since repository v2, a long track record and the bigger community. Run it against rest-server in append-only mode and a compromised host cannot delete the backups it has already made. The price is that scheduling, pruning and checks are your job: plan a systemd timer or resticprofile, run forget --prune on a schedule, and run check regularly. Choose Kopia if you want those jobs handled for you, or if people other than you will run the backups. Policies schedule snapshots and apply retention, maintenance runs automatically, KopiaUI gives non-terminal users a real GUI on Windows, macOS and Linux, and the repository server lets several machines back up to one repository without sharing storage credentials or seeing each other's snapshots. If you need Object Lock immutability on S3-compatible storage, Kopia supports it directly. Whichever you choose, keep it on the latest patch release, which for Kopia means v0.23.1 or newer because of the data-loss race it fixed. And test a restore before you trust either.