Borg2 Is in Beta: Deduplicating Backups with Authenticated Encryption

You've probably got backups scattered across external drives, cloud storage, and maybe a NAS that you keep meaning to properly configure. The problem is that traditional backup tools either eat up massive amounts of space by storing duplicate data, or they sacrifice security for convenience. BorgBackup has been solving this problem for years, and now Borg2 is in beta testing with some significant updates to how it handles deduplication and encryption.

What It Does

BorgBackup is a deduplicating backup program that optionally supports compression and authenticated encryption. The core idea is straightforward: instead of storing complete copies of your files every time you run a backup, Borg splits files into variable-length chunks and only stores chunks it hasn't seen before. This means your daily backups only consume space for the actual changes you've made, not entire file copies.

The deduplication works across your entire repository, regardless of where the data came from. Chunks from different machines, previous backups, or even different files within the same backup are all considered when checking for duplicates. A chunk is considered duplicate if its id_hash value matches an existing one, using cryptographically strong hash or MAC functions like HMAC-SHA256 or keyed Blake3. The system doesn't care if you've renamed files, moved directories around, or if timestamps have changed—it'll still recognize and deduplicate the underlying data.

For encryption, Borg2 uses 256-bit authenticated encryption with AES-OCB or chacha20-poly1305, which ensures your data stays confidential, intact, and authentic even when stored on systems you don't fully trust. If you only need integrity verification without confidentiality, there are authenticated-only modes using SHA256 or Blake3.

Why It's Cool

• Deduplication that survives real-world chaos. Most deduplication systems fall apart when you rename files or move directories. Borg2 doesn't care about file names, complete file changes, or absolute chunk positions. If you shift data around inside a file or move it between machines sharing the same repo, the deduplication still works. This is particularly useful for virtual machine images or raw disk backups where small changes happen frequently.

• Multiple chunking algorithms for different threat models. Borg2 supports fastcdc (the default), buzhash64, buzhash, and several AES-based keyed chunkers like toeplitz-aes and rabin-aes. Those keyed options make chunk-boundary fingerprinting attacks significantly harder, which matters if you're backing up to untrusted storage and worried about someone analyzing your chunk patterns.

• Performance where it counts. The computationally expensive parts—chunking, compression, encryption—are implemented in C and Cython, with SIMD optimizations (NEON, AVX2, AVX-512) selected per platform. There's also local caching and quick detection of unmodified files, so you're not wasting time reprocessing data that hasn't changed.

• Flexible compression options. You can choose between lz4 for speed, zstd for a balance, zlib for moderate compression, or lzma when you really need to squeeze every byte. Each has different tradeoffs between speed and compression ratio, so you can tune it based on your specific needs.

• Obfuscation capabilities. If you're paranoid about fingerprinting attacks (and maybe you should be), Borg2 can optionally obfuscate file and chunk sizes to make traffic analysis more difficult.

• Off-site backup support. Borg can store data on remote hosts using various protocols, including REST over HTTP. This means you're not limited to local storage—you can push backups to remote servers while maintaining client-side encryption.

How to Try It

First, a critical warning from the README: Do not use Borg2 for your production backups. It's in beta testing and might get major breaking changes between beta releases. There's no upgrade path from one beta to the next, so you'll have to delete and recreate repositories. Set it up alongside your existing production backups for testing purposes.

To get started, head to the BorgBackup repository and check out the installation manual. You can find it at docs/installation.rst if you've already downloaded Borg, or online at the BorgBackup documentation site.

Once installed, you'll want to initialize a repository, create your first backup, and verify that deduplication is working as expected. The beta is specifically looking for testing feedback, so if you encounter issues or have suggestions, the project maintainers want to hear about it.

Final Thoughts

Borg2 is clearly aimed at people who take backups seriously but don't want to babysit them. If you're managing backups for multiple machines, dealing with large files that change incrementally, or storing data on systems you don't fully control, the combination of deduplication and authenticated encryption is genuinely useful. The beta status means you shouldn't trust it with data you can't afford to lose, but that's exactly why testing it now matters—the more people who kick the tires and report problems, the sooner it'll be ready for prime time. If you've been looking for a backup tool that respects both your storage budget and your security requirements, Borg2 is worth watching.

Follow @githubprojects for more developer tools and open source projects.