Restic vs BorgBackup vs rclone for encrypted incremental backups on low‑bandwidth VPS

By Kevin Marcondes · Published on Oct 28, 2026 · 9 min read

This technical comparison of Restic, BorgBackup and rclone focuses on encrypted incremental backups for VPS instances with limited bandwidth. You’ll learn how each tool handles deduplication, compression, client-side encryption, resume after unstable links, and retention policies, plus practical recommendations to reduce bytes sent, shorten backup windows and keep restores reliable.

Scenario: backups on VPS with limited bandwidth and I/O

On low-cost VPS instances, outbound bandwidth, CPU and disk I/O are often the bottlenecks. Daily backups can compete with your application and degrade service. The goal is to minimize bytes transferred, favor reliable resume on flaky connections and avoid redundant work via deduplication and compression.

Automatic retention, integrity checks and support for remote storages also matter. If you use an S3-compatible object store, lifecycle policies help control costs. For attached disks, efficient use of repository space is essential to keep backup windows short.

• Reduce bytes transferred with deduplication and/or compression
• Resume uploads after interruptions without reprocessing everything
• Apply retention policies that don’t flood your bandwidth
• Verify integrity without scanning everything every day
• Schedule windows outside peak time and throttle upload rate

How each tool approaches the problem

Restic is a snapshot-based backup tool with variable-block deduplication and authenticated encryption by default. It’s designed for remote repositories, including S3-compatible backends, and operates with immutable snapshots and flexible retention commands.

BorgBackup is also snapshot-oriented with strong deduplication and configurable compression. It tends to be efficient for many small files and has mature verification and recovery features, working robustly over local storage or SSH.

rclone is a sync/copy tool that supports a wide range of backends. With the crypt remote it provides client-side encryption. It’s not a snapshot system by default, but you can build backup-dir strategies and use backend versioning to retain history.

Transfers on slow links: resume, parallelism and bandwidth limits

On unstable or low-bandwidth links, job predictability matters. All three tools allow rate limits and concurrency tuning to avoid saturating the VPS or the network.

Restic tolerates interruptions, reuses chunks already uploaded and only transfers new data. On flaky connections it restarts from small units, reducing wasted work. Parallelism settings help balance CPU and I/O.

BorgBackup also handles drops well and performs aggressive deduplication; compression reduces bytes sent, which helps when CPU is available but bandwidth is scarce. Rate and concurrency controls prevent spikes that compete with the application.

rclone excels at bandwidth control, queuing and retries. You can tune transfers, checkers and bwlimit windows. It resumes multipart uploads on backends that support them, but without content deduplication, changed files tend to be reuploaded in full.

• Set upload limits to keep application latency stable
• Prefer moderate parallelism: too many connections can increase losses
• Schedule nighttime windows and pauses between jobs to ease I/O

Reducing data: deduplication and compression

Restic relies mainly on variable-block deduplication across snapshots. For datasets where only small portions of files change, bandwidth savings are significant even without aggressive compression.

BorgBackup combines deduplication with selectable compression (for example, fast algorithms or stronger compression). On a VPS with spare CPU and a slow link, compressing before sending can substantially shrink the backup window.

rclone doesn’t deduplicate content by default. You can use backend versioning and dated folders to emulate snapshots, but modified files will usually trigger full reuploads. For large binaries that change as a whole, this increases bandwidth usage.

• Many small files with localized changes: Restic/Borg benefit most
• Borg compression reduces bytes for text, logs and dumps with low entropy
• For large binaries that are replaced in full, rclone usually transfers everything

Encryption and snapshot integrity

Restic encrypts everything client-side and authenticates data and metadata by default. That makes it simple to use with S3-compatible stores without exposing filenames or contents to the provider.

BorgBackup provides client-side encryption modes with authentication. You can choose keys stored in the repository or only locally, trading convenience for security. Regular verification detects corruption early.

rclone offers encryption through the crypt remote. Retention and verification rely on the backend or on your folder-based strategy. It’s important to document names and locations to enable fast restores under pressure.

• Store passwords/keys off the VPS and test restores regularly
• Avoid sharing the same key across environments without planning
• Document restore paths and verification scripts

Running in production: retention, checks and consistency

Retention policies matter more than they look. Restic and BorgBackup provide commands to keep hourly/daily/weekly/monthly windows, with pruning that frees space while preserving recent points. Schedule prune to avoid competing with application I/O.

rclone relies on backend policies (e.g. S3 lifecycle) or folder-based history. That simplifies tooling but moves retention discipline outside the client tool.

For consistency of open or active data, volume-level snapshots are ideal. Taking an LVM snapshot before backup ensures coherency for databases and live files, avoiding partial copies.

• Schedule periodic repository checks to detect corruption
• Run prune/forget outside peak hours
• Use volume snapshots for databases and running VMs

Quick comparison table

Side-by-side summary of the most relevant criteria for slow links and VPS environments. Use as a checklist when choosing a tool and policy for your context.

Which to choose on a low‑bandwidth VPS: practical scenarios

There’s no universal winner. Below are common scenarios and choices that tend to balance bandwidth, CPU and operational simplicity on VPS.

• Web apps with many small files and localized changes: Restic or BorgBackup. Restic simplifies S3; Borg wins where compression helps a lot.
• Daily database dumps and large text logs: BorgBackup with fast compression reduces bytes. Restic also works well if the dump changes little day to day.
• Large binaries replaced by a full new version (e.g. VM images): rclone with backend versioning and careful scheduling can be simpler.
• Environments already using S3-compatible storage and requiring transparent encryption: Restic fits directly, with retention and verification inside the repository.
• When fine-grained control of bandwidth and windows is the priority: rclone is strong for movement, but pair it with a clear snapshot strategy.

Best practices to save bandwidth and avoid surprises

Small adjustments often have a large impact on transferred volume and restore reliability. Treat backups as a repeatable, verifiable pipeline.

• Exclude caches, node_modules, rebuildable vendor folders and temporary artifacts
• Make the first backup during a long window; subsequent backups will be smaller
• Throttle upload rate and limit parallelism to protect the application
• Schedule prune/forget separately from the main backup job
• Automate restore tests on samples of critical files
• Use volume snapshots to ensure consistency for open data

Related resources and next steps

If your backup involves active volumes, consider taking volume snapshots before sending. This improves consistency and reduces verification failures. For S3-compatible storage, scripts and lifecycle policies speed up retention and alerts.

For predictable scheduling, systemd timers can replace cron with centralized execution logs and clearer status, making troubleshooting easier.

• Learn how to automate volume snapshots and send them with Restic to S3: LVM snapshots + Restic to S3 (Debian)
• Patterns and policies for incremental encrypted backups on S3: Encrypted Incremental S3 Backups for Linux VPS
• Replace cron with reliable timers: Migrate cron to systemd timers
• Harden the server before automating backups: VPS Linux security checklist

Frequently asked questions

Do Restic or BorgBackup save more bandwidth on a slow VPS?

It depends on your data. Both perform block-level deduplication, which cuts bytes a lot when only parts of files change. Borg can also compress, which helps for text and dumps. If CPU is available and the link is the bottleneck, Borg often sends fewer bytes thanks to compression.

Is rclone suitable for incremental backups with history?

rclone is great for sync and bandwidth control, but it has no native snapshots. You can create dated folders and use backend versioning, or combine rclone with processes that produce snapshots. Plan retention and restores from the start.

Which is simplest for S3-compatible storage with end-to-end encryption?

Restic. It encrypts client-side by default and works directly with S3-compatible backends. You can configure the repository, define retention and schedule checks without extra server-side components.

How do I avoid data corruption if the connection drops during backup?

Use tools that retry and upload small units (Restic/Borg) and throttle the rate to reduce losses. Schedule periodic repository checks and, when possible, take a volume snapshot before backup to ensure file consistency.

When is rclone the best choice?

When you need fine-grained bandwidth control, broad backend support and a simple copy or mirror strategy. For many large files replaced in full, rclone can be more straightforward than setting up a deduplicated repository.

Can I combine the tools?

Yes. A common pattern is to use Restic or Borg for snapshot repositories and employ rclone for additional replication or moving data between storages. Document the restore flow so you don’t waste time during incidents.

See also

• ZFS vs LVM+LUKS on VPS for Databases — snapshots, performance and post-failure recovery
• Practical comparison — Nginx Unit vs PHP‑FPM vs RoadRunner for PHP monoliths in containers — latency, throughput & memory
• ZFS vs Btrfs for Snapshots, Replication and Incremental Retention on VPS with Docker — Practical Pros and Cons
• Flyway vs Liquibase vs Sqitch: database versioning for PHP/Laravel projects