Where to store backups so they survive what destroys your originals

A backup stored on the same device as your files, or in the same room, or even in the same building, is not really a backup — it just fails when your computer fails. The point of backing up is to keep a copy somewhere that a fire, theft, flood, or hardware failure cannot reach. That means at least one copy needs to live outside your home or office, on a different physical device, controlled by a different person or company.

The trade-off is straightforward: the safer your backup is from physical disaster, the less control you have over it, and the more you have to trust someone else with your files. This section walks through where backups actually survive, what each location costs you in control and money, and what can still go wrong.

Key Takeaways

  • At least one backup copy must be stored away from your home or office — in a different building, on a different device, or both — to survive fire, theft, or hardware failure.
  • External hard drives kept at a friend's house or in a safe deposit box are cheap and give you full control, but you have to remember to update them and retrieve them if you need the files.
  • Cloud storage services like Google Drive, OneDrive, or Backblaze keep your files on servers you do not own, which means the company can see your files, change their terms, or go out of business.
  • The safest setup uses more than one backup method — for example, an external drive at home plus cloud storage, or an external drive at a friend's house plus a second drive in a safe deposit box.
  • Encrypted backups protect your files if the device is stolen or accessed by someone else, but if you lose the password, the files are gone forever.

External hard drives kept somewhere else

An external hard drive is a portable device that plugs into your computer and stores files the same way your computer's internal drive does. You can buy one for $50 to $200 depending on size, copy your files to it once or on a schedule, then physically move it to another location. This is the cheapest way to keep a backup outside your home.

The most common setup is to keep an external drive at a trusted friend's or family member's house, or in a safe deposit box at a bank. You control the device completely — nobody else can see what is on it unless you give them the password — and you do not pay a monthly fee. The downside is that you have to remember to update it regularly, and if you need the files in an emergency, you have to go get the drive or ask someone to mail it to you, which takes time.

If you use an external drive, encrypt it before you move it anywhere. That way, if the drive is lost or stolen, the person who finds it cannot read your files without your password. On Windows, use BitLocker (built into Windows Pro and higher). On Mac, use FileVault (built into all recent versions). Both are free and take about an hour to set up the first time.

Cloud storage services and what you trade for convenience

Cloud storage means your files live on servers owned and operated by a company — Google, Microsoft, Apple, Backblaze, or others. You upload your files through an app or a website, and the company keeps them backed up on multiple servers in different locations. You can read them from anywhere you have internet, and the company handles all the physical storage and disaster recovery for you.

The trade-off is control and privacy. The company can see your files (unless you encrypt them before uploading, which most services do not make straightforward). The company can change its terms of service, raise prices, or shut down. If the company is hacked, your files might be exposed. If you stop paying, your files disappear after a grace period. And if the company decides your files violate their terms — for example, if you store something they consider illegal — they can delete them without asking you first.

Popular cloud services include Google Drive (15 GB free, $1.99 per month for 100 GB), OneDrive (5 GB free, $1.99 per month for 100 GB), and Backblaze ($7 per month for unlimited storage). iCloud is built into Apple devices but costs $0.99 per month for 50 GB. Each service has different privacy policies and different rules about what you can store, so read the terms before you upload sensitive files.

Combining methods for real protection

The safest backup strategy uses more than one method, because each method fails in different ways. For example: an external drive at home protects you from cloud service shutdown, but not from fire. A cloud service protects you from theft of your computer, but not from the company being hacked. An external drive at a friend's house protects you from both, but takes time to update and retrieve.

A realistic setup for most people is: one external drive at home that updates automatically every week, plus one cloud service that syncs your files as you work. That way you have a fast local backup if you accidentally delete something, and a remote backup if your house burns down. If you have files you cannot afford to lose — financial records, medical documents, irreplaceable photos — add a second external drive in a safe deposit box and update it every month or quarter.

The more copies you have, the more likely at least one survives. The more different locations and methods, the less likely a single disaster destroys all of them.

Encryption: protecting backups from people who find them

Encryption scrambles your files so that only someone with the correct password can read them. If you store a backup outside your home — at a friend's house, in a safe deposit box, or on a cloud service — encryption protects your files if the device is stolen, the cloud service is hacked, or the person storing it for you decides to look inside.

Most cloud services encrypt your files in transit (while they travel to the server) but not at rest (while they sit on the server), which means the company can still see them. If you want the company to be unable to see your files, you have to encrypt them yourself before uploading. Services like Tresorit and Sync.com do this automatically. Others like Google Drive and OneDrive do not, though you can encrypt files yourself using a tool like 7-Zip (Windows) or the built-in Archive Utility (Mac) before uploading.

The danger of encryption is that if you forget your password, your files are gone forever. There is no "forgot password" button for encrypted files — the encryption is designed so that even the company storing them cannot unlock them without the password. Write your password down, store it somewhere safe and separate from the backup itself, and tell a trusted person where to find it in case something happens to you.

How often to update your backups

How often you update a backup depends on how much new work you do and how much you can afford to lose. If you create or change files every day, a backup that is a week old means you could lose a week of work. If you mostly store old documents that do not change, a backup once a month is probably enough.

Cloud services that sync automatically (like Google Drive, OneDrive, or Dropbox) update your backup as you work, so you never lose more than a few minutes of work. The downside is that if you accidentally delete a file or get hit with ransomware, the deletion syncs to the cloud too, and you have to dig through the service's version history to recover it. Most services keep old versions for 30 days, but some charge extra for longer recovery windows.

External drives that you update manually let you control exactly what gets backed up and when, but it is straightforward to forget. If you use an external drive, set a calendar reminder to plug it in and run the backup once a week or once a month, depending on how much your files change.

What can still go wrong with backups

Even with a backup in place, several things can still destroy your files. If you encrypt a backup and lose the password, the files are unrecoverable. If you store a backup on a cloud service and the company goes out of business, you have a limited time to read your files before the servers shut down. If you store a backup on an external drive and the drive fails before you notice, you have lost that copy.

Ransomware — malicious software that encrypts your files and demands money to unlock them — can infect both your computer and your backups if they are connected to the same network or syncing in real time. If you use cloud sync, the ransomware spreads to the cloud too. This is why security experts recommend keeping at least one backup that is not connected to your computer most of the time — an external drive you plug in only to update it, or a cloud service that does not sync automatically.

The other common failure is straightforward forgetting that the backup exists. If you set up an external drive at a friend's house and never update it, or if you sign up for cloud storage and never actually upload anything, you have no backup at all. The best backup is one you set up once and then forget about because it runs automatically, or one you have a reminder to update on a regular schedule.

Frequently Asked Questions

Is cloud storage the same as a backup?

Not quite. Cloud storage syncs your files as you work, so it is always up to date, but if you accidentally delete a file or get ransomware, the deletion syncs to the cloud too. A true backup is a snapshot of your files at a specific moment in time, separate from your working copies. The safest setup uses both: cloud storage for convenience and quick recovery, plus a separate backup for protection against accidental deletion or malware.

What if I store an external drive at a friend's house and we lose touch?

You lose access to that backup. Before you give someone a drive to store, make sure you have another backup somewhere else, and consider setting a date to retrieve it or have them mail it back. You could also keep a second external drive at home or in a safe deposit box so you are not dependent on one person.

Can someone hack my cloud backup and steal my files?

Yes, if the cloud service is hacked or if someone guesses your password. Use a strong, unique password for your cloud service account — at least 12 characters with numbers, uppercase, lowercase, and symbols. If you want extra protection, enable two-factor authentication, which requires a code from your phone in addition to your password. For very sensitive files, encrypt them yourself before uploading so the company cannot see them even if they are hacked.

How long do cloud services keep deleted files?

Most services keep deleted files in a trash or recycle bin for 30 days. Google Drive keeps them for 25 days, OneDrive for 93 days, and Dropbox for 30 days (longer if you pay for extended version history). After that time, the files are permanently deleted. If you need to recover something older, you have to contact the company and ask if they can help, but there is no may provide.

Do I need to backup my backup?

If you have multiple backups using different methods — for example, an external drive plus cloud storage — you already have redundancy and do not need to backup your backups. If you have only one backup method, yes, you should have a second one. The goal is that no single failure, theft, or disaster can destroy all your copies.