Choose secure passphrase

How-To
1

Hello! I’m new to duplicati, seems like a great tool so far. I installed it as a docker-image.

Now I want to configure my first backup, but I was wondering how to choose a secure passphrase. I want to upload my backup to a cloud-provider, so of course I want it to be secure even if someone hacks into the provider (or the provider is curious himself :wink: ). In that case the bad guy could download the backup-files and would have unlimited access in time, being able to run all kind of attacks (like brute force).

I found some advises using passphrase with a length of 12-15 chars. This feels like it is too short, but thats not based on any facts, so my feeling might be wrong. I would feel more like using a key with 256 or 512 chars, but I’m not sure if this is increasing the security that much. And then you could (should?) as well use GPG-Encryption with keys I guess. And of course this leads to the problem how to securly store this key. I could not find any specific instructions in the documentation how to choose the passphrase, I apologise if I have overlooked this.

2

If you use the standard encryption settings (not GPG), you will be encrypting with 256 bit password derived keys. To get the maximal encryption strength from a key, you need at least 256 bits in the key.

Roughly, you have 6 bits per character if you use special characters as well. However, you need to ensure that the data is truly random, otherwise you loose some strength.

If you have 45 random characters, you should have maximum entropy.