Backup basics Preview

sqz backup keeps encrypted, deduplicated, versioned backups of your folders in a repository: a folder on another drive, a NAS, or an S3-compatible bucket. Each run stores only what changed, and any snapshot can be restored.

Archive or backup?#

1. Create a repository#

sqz backup init D:\backups\laptop

SQZ asks for a password and then shows a recovery key once. Write the recovery key down and keep it somewhere other than the computer you are backing up. Either the password or the recovery key unlocks the repository; without both, the data cannot be recovered by anyone.

The repository can be a folder or s3://bucket/prefix. See S3-compatible storage.

2. Back up#

sqz backup run D:\backups\laptop C:\Users\me\Documents

Each run makes a new snapshot of the folder. Data the repository already has is not stored again. Files are cut into pieces of about 1 MiB at points chosen by their content (with boundaries specific to each repository), compressed, encrypted and packed.

A file whose size and modification time (and on Unix, change time) match the last snapshot is not read again, unless it was written within 3 seconds of that snapshot's start. --read-all reads everything anyway. --timings shows where the time went.

A snapshot appears only after all of its data is safely on disk, so an interrupted backup never harms earlier snapshots. Files that cannot be read are skipped, counted in the snapshot and reported.

On Windows you can back up from a shadow copy so open files are consistent. See Windows backups.

3. List snapshots#

sqz backup list D:\backups\laptop

Shows snapshots oldest first, with which ones are protected, the latest verified one, and the last restore drill.

4. Restore#

sqz backup restore D:\backups\laptop latest C:\restore
sqz backup restore D:\backups\laptop 12 C:\restore --file docs/report.txt
sqz backup restore D:\backups\laptop 3f9a C:\restore --file Photos/2026

The snapshot is latest, a number from list, or the start of a snapshot ID. --file takes a file or a whole folder and can be repeated; restored folders get their recorded times and permissions. Restores follow the same safe rules as archives: into a folder, never overwriting, every file verified. Restoring one small file reads only the folders on its path and that file's pieces, so it stays fast however big the repository is.

5. Check#

sqz backup check D:\backups\laptop
sqz backup check D:\backups\laptop --read-data

A plain check reads the index and snapshots and makes sure everything they need exists. --read-data also decrypts and verifies every piece of data, and records the newest snapshot as the latest verified one on this computer, which retention then always keeps. Any modified or missing object is reported by name.

Passwords#

sqz backup add-password D:\backups\laptop
sqz backup add-password D:\backups\laptop --recovery

add-password adds another password, for example for a second person. --recovery unlocks with the recovery key instead of a password, which is how you set a new password after forgetting the old one. Removing passwords is not built yet.

For scheduled backups, SQZ reads these environment variables when they are set:

Environment variables can be read by other programs running as the same user. A program that runs sqz backup for you, such as the desktop app, can pass the secrets on standard input instead with --password-stdin, one per line: the password (or the recovery key with --recovery), then the new password for add-password. init reads only the new password.

Output for programs: --json#

sqz backup list D:\backups\laptop --json

--json on init, run and list prints one JSON object on standard output: the recovery key for init, the new snapshot and its counts for run, and every snapshot with its verified and drill state for list. Times are Unix seconds. The messages meant for people go to standard error, so a script can read standard output as it is. The desktop app uses this.

Exit codes for run#

Speed and memory#

Measured on 4 cores and 16 GB with 20,004 files (1.2 GB), one run each, so treat these as orders of magnitude:

Memory stayed at about 69 MB throughout. The index costs roughly 100 bytes per stored piece, about 100 MB per TB of unique data, plus about 150 bytes per file while scanning. Encryption costs about 2 seconds per GB on one core; disk writes take most of the time. Repositories in the hundreds of GB, network drives and Windows have not been measured yet.

Next#

• Keep the backups you want and reclaim space
• Keep a second copy, rehearse restores, use a bucket
• What the encryption protects against