Private Archive Get the client →

v0.1 · open beta

Backups that forget you
the moment you stop paying.

Restic-encrypted archives, routed over Tor, settled in Monero. Your client certificate is your account — no email, no name, no recoverable identity.

Download client See how it works

Open-source clients· Audited encryption (Restic)· No tracking on this page

Designed so trust isn’t the security boundary.

⌘

Client-side encryption

Restic encrypts every byte on your machine before it leaves. We hold ciphertext only — the keys never touch our infrastructure.

~

Tor-only transport

The client and server speak through hidden services. Your IP, our IP, both irrelevant.

◈

Monero billing

Subaddress per client. No card on file, no billing address — nothing about your wallet ties to anything we hold.

⎔

mTLS identity

Your client certificate is your account. Lose it and we cannot help you. Keep it and nobody can.

≣

Ciphertext-only storage

Where we put the bytes doesn’t matter — we couldn’t read them anyway. Our infrastructure is a sealed envelope, nothing more.

∅

Zero PII

No name, no email, no phone, no IP, no fingerprint. We log the first 8 chars of your cert hash.

Three steps. No accounts.

  1. 01

    Install & init

    Run the installer. The client generates an X.509 certificate locally. That file is now your sole credential.

  2. 02

    Fund a balance

    The client prints a Monero subaddress. Send XMR. The credit drops in once the chain confirms.

  3. 03

    Back up & forget

    privatearchive backup ~. Schedule it. Your data is encrypted, then on its way through Tor before you finish reading this paragraph.

Pay only for the bytes you keep.

Pay-as-you-go

Monero top up · burn down

  • Top up a balance in XMR
  • It burns down by the second
  • Refill when you need to
  • No subscription, no commit

Balance burns down by the second. No subscription. No minimum. No card.

Download the client.

static binaries · reproducible builds · SHA256 sums published

Direct builds — verify each against the published SHA256SUMS:

macOSarm64 · Apple Silicon macOSamd64 · Intel Linuxamd64 · .tar.gz Linuxarm64 · .tar.gz Windowsamd64 · .zip Windowsarm64 · .zip FreeBSDamd64 · .tar.gz FreeBSDarm64 · .tar.gz OpenBSDamd64 · .tar.gz OpenBSDarm64 · .tar.gz Source archiveverify the encryption yourself ChecksumsSHA256SUMS

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.