I switched to this command-line backup tool because it encrypts everything by default

Data loss is one of those disasters that can torpedo a productive day, or an entire month, if things get really ugly. Whether it is ransomware, a dying hard drive, or a clumsy deletion, losing important files can stall your entire workflow.

I recently came across a backup tool that didn’t compromise on security or simplicity: Restic—a fast, efficient, and secure command-line backup tool.

If you need a beginner’s guide to the command prompt because the idea of using a CLI makes you nervous, I completely understand. A blinking cursor can be intimidating. But Restic is human-readable. After switching, I realized that typing a few words is often much faster than clicking through endless menus in a slow, overloaded app.

OS

Linux, Windows, macOS

Price model

Free

Restic is a modern backup program. It is free, open sources, and effortless to use. It is a command line utility that works seamlessly across platforms.

Restic encrypts your backups, giving you peace of mind

Trust no one, not even the server you pay for

A nice thing about Restic is that encryption isn’t treated like some optional checkbox you have to hunt for in the settings. It’s built in from the start. The tool assumes your backup destination might not be trustworthy, so it encrypts everything to keep your data confidential and tamper-proof. Even if you’re storing your snapshots on someone else’s hardware or a shared server, curious admins won’t be able to poke around in your files.

Under the hood, Restic uses AES-256 encryption in counter mode with Poly1305 authentication, and derives keys with scrypt, making brute-force attacks extremely impractical. What really stands out, though, is that encryption doesn’t stop at the file contents. Your metadata is shielded, too, including file names and directory layouts. So even if somebody manages to grab a copy of your backup repository, they won’t be able to tell what you backed up, much less peek inside.

Restic also offers deduplication in a thoughtful way. It uses content-defined chunking with variable-length segments, which often yields deduplication ratios of 60-80% for normal workloads. The net effect is that repeat backups become absurdly efficient; only the changed chunks get stored, so storage usage and backup times shrink dramatically.

Installing Restic

Go the easiest route and use a package manager

Restic ships as a single static binary with zero external dependencies, which is a fancy way of saying installation usually does not involve wrestling with strange setup scripts or missing libraries. On Linux distributions like Debian, Ubuntu, Arch, or Alpine, you can pull it straight from the official repositories using your package manager. On Debian-based systems, apt-get install restic does the job. Arch users can grab it with pacman -S restic.

Related

The Ultimate Guide to Pacman Commands on Arch Linux

Pacman is the default package manager on Arch-based distros. Here’s how you can use it to manage packages on your system like a pro.

You have several installation options on Windows. The simplest approach is to download the pre-compiled binary directly from Restic’s releases page on GitHub. Once you have it, just extract restic.exe somewhere convenient—you can just place it in C:\restic for easy access.

If you prefer using package managers, Restic is available through Scoop. If you haven’t set that up yet, you can check out how to install Scoop in Windows to get started, then simply run scoop install restic and through WinGet with winget install Restic.Restic. In my opinion, this is hands-down the best way to install apps on Windows because it handles dependencies and updates so cleanly. And if you are planning system-wide backups on Windows, you can install Restic with winget install --exact --id restic.restic --scope Machine so that it lands in Program Files instead of your user profile. This requires elevation, but it makes the tool available to every user on the machine.

To confirm everything worked, open Command Prompt or PowerShell and run:

restic version

If the version number prints, you are good—Restic is installed and accessible from your PATH.

Once installed, keeping Restic up to date is effortless. The tool includes a self-update command that automatically downloads the latest version from GitHub, verifies its GPG signature for authenticity, and replaces the existing binary. You are never more than a single command away from the latest features and security patches.

Setting up Restic

Prepare your repository for the data dump

Restic gives you plenty of flexibility when it comes to where your backups actually live. You can send them to a plain old folder on your machine, an external drive, another computer over SFTP (via SSH), an HTTP REST server, or to one of several cloud storage services, such as AWS S3, Backblaze B2, OpenStack Swift, Azure Blob Storage, or Google Cloud Storage.

For the sake of this walkthrough, though, we’ll keep things simple and create a local repository on your C: drive. In Restic-speak, a repository is where your backup snapshots are stored, and each backup operation creates a fresh snapshot.

Start by creating a folder to house the repository. Open Command Prompt or PowerShell as an administrator and run:

mkdir C:\backup-repo

Now we can initialize the repository. The Restic init command initializes the repository:

restic init --repo C:\backup-repo

You’ll be prompted for the repository password, then asked to confirm it. This password must be used to interact with the repository in the future.

It only takes a moment to create and initialize the repository, and once it’s done, you’re ready to start making snapshots.

Creating a backup

Your first snapshot

Creating a backup is very simple. We use the Restic backup command to tell it what to back up and specify which repository to send the backup to.

For this example, we’ll back up the Documents folder from a USB flash drive. Let’s say your USB drive is mounted as drive D: and contains a Documents folder. The command would be:

restic backup D:\Documents --repo C:\backup-repo

You’ll need to provide the repository’s password. While the backup is running, the names of the files being copied are displayed, along with statistics showing the total number of files to be copied, the number copied so far, and the percentage of the backup complete. The snapshots are encrypted using AES-256.

Because this is the first backup of this repository, all the backed-up files are new. Restic is fast—depending on your system, you might see impressive throughput rates.

Now, let’s say you drop a fresh file into that same Documents folder and run the exact same command again:

restic backup D:\Documents --repo C:\backup-repo

Restic scans the directory tree, spots the newcomer, and backs it up. Thanks to deduplication, that second snapshot finishes almost comically fast—often in a few seconds—even though it still checks the rest of the files for changes.

Simplifying password management

Teach your computer to remember the secret code

By now, you’re probably tired of entering the repository password repeatedly. Let’s address that before we continue. Create a text file containing just the repository password on a single line and save it as restic-password.txt in a secure location like C:\restic\restic-password.txt.

To make sure that no one else can see the password, set appropriate file permissions. Right-click the file, select Properties, go to the Security tab, and ensure only your user account has access.

Now you can pass this to the Restic command line using the --password-file option. From this point forward, all our commands will use this approach:

restic backup D:\Documents --repo C:\backup-repo --password-file C:\restic\restic-password.txt

Alternatively, you can set environment variables to avoid typing these parameters every time. In PowerShell, you can set them like this:

$env:RESTIC_REPOSITORY = "C:\backup-repo"
$env:RESTIC_PASSWORD_FILE = "C:\restic\restic-password.txt"

To make these permanent for your user account, you can edit environment variables in Windows via System Properties > Environment Variables. Once set, you can simply run:

restic backup D:\Documents

How to navigate and restore your data

Your data’s resurrection day

At this point, I’m sure you’re thinking, “Great, but how do I get my files back without a visual interface?” Well, it’s as easy as creating the backup.

You need to specify which snapshot you’ll restore. You can use a snapshot’s unique ID (which you can find by running restic snapshots --repo C:\backup-repo --password-file C:\restic\restic-password.txt), or use the latest label to get the newest snapshot in the repository.

You also need to provide a directory for the restored data to be copied to, using the --target option:

restic restore latest --target C:\restored-data --repo C:\backup-repo --password-file C:\restic\restic-password.txt

Restoring is as speedy as backing up. Checking in the target directory, you can see that the directory tree and files have been restored.

You can also restore specific subdirectories or use –include and –exclude flags to selectively restore files. For example, to restore only PDF files:

restic restore latest --include *.pdf --target C:\restored-data --repo C:\backup-repo --password-file C:\restic\restic-password.txt

When working with Restic on Windows, snapshots list directories Windows-style (e.g., D:\Documents), but when you need to specify paths for restoration or listing files within a snapshot, you actually need to use Unix-style paths. So D:\Documents becomes /D/Documents in restore and ls commands:

restic restore latest --include *.pdf --target C:\restored-data --repo C:\backup-repo --password-file C:\restic\restic-password.txt

Make backups, sleep easy

Restic has somehow turned backups from a tedious guilt-trip into something I actually trust to run in the background. With built-in encryption, broad cross-platform support, flexible storage targets, and some very clever deduplication under the hood, it feels both powerful and approachable. Whether you’re just safeguarding a few folders on a USB stick or coordinating backups across multiple machines, Restic scales without drama and adapts to whatever setup you throw at it.