Encrypted · Anonymous · Forever

The backup
that doesn’t
know your name.

Restic-encrypted on your device, routed through Tor, settled in Monero. Your client certificate is your only identity — and we never know what it stands for.

Download client Read the protocol

Encrypted on your device

Files are encrypted before they leave you. We hold ciphertext only — we couldn’t read it for you if we tried.

Routed via Tor

Three-hop onion transport. We never learn your IP, you never learn ours.

Paid in Monero

Subaddress per client. No card. No exchange step. The chain forgets who paid.

Zero PII collected

No name, no email, no IP, no device, no analytics. Logs hold 8 chars of cert hash.

How it works

Generate a certificate

The client mints an X.509 cert on first run. That file is your account — mTLS only, no password, no recovery. Back it up somewhere safe.

Top up in Monero

Send Monero to the printed subaddress. Pay-as-you-go — balance burns down by the second, no plan, no subscription, no lock-in.

Back up & forget

Schedule privatearchive backup. Encrypted blobs flow over Tor. Where the ciphertext rests doesn’t matter — only your key opens it.

Pick a binary.

Static, reproducible, open-source. SHA256 sums published. Audit the source — it’s all there.

macOSarm64 · Apple Silicon macOSamd64 · Intel Linuxamd64 · .tar.gz Linuxarm64 · .tar.gz Windowsamd64 · .zip Windowsarm64 · .zip FreeBSDamd64 · .tar.gz FreeBSDarm64 · .tar.gz OpenBSDamd64 · .tar.gz OpenBSDarm64 · .tar.gz Sourceaudit the encryption yourself VerifySHA256SUMS

Install & keep up to date

Every channel below installs the same reproducible, signed binaries. Verify direct downloads against SHA256SUMS; the apt and dnf repositories are GPG repo-signed with fingerprint 4792 23EA 8405 287A 11FB B12E 02A7 7A1E EDD0 F111.

Any platform — one line

curl -fsSL https://privatearchive.xyz/install.sh | bash

Or download a tarball for macOS, Linux, Windows, FreeBSD or OpenBSD (amd64 + arm64) — and the source — from the latest release.

Debian / Ubuntu — apt

curl -fsSL https://privatearchive.xyz/apt/release-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/privatearchive.gpg
echo "deb [signed-by=/usr/share/keyrings/privatearchive.gpg] https://privatearchive.xyz/apt stable main" | sudo tee /etc/apt/sources.list.d/privatearchive.list
sudo apt update && sudo apt install privatebackup

Fedora / RHEL — dnf

sudo curl -fsSL https://privatearchive.xyz/dnf/privatearchive.repo -o /etc/yum.repos.d/privatearchive.repo
sudo dnf install privatebackup

Arch — bootstrap script

curl -fsSL https://privatearchive.xyz/install.sh | bash

macOS — Homebrew

brew install https://privatearchive.xyz/brew/privatebackup.rb

Windows — Scoop

scoop install https://privatearchive.xyz/scoop/privatebackup.json

Docker — maximum anonymity (over Tor)

Pull and run the all-in-one client from our self-hosted registry, reachable only as a Tor v3 onion service — no account, no third-party registry, and no IP logged on either side.

1. Install Tor (gives you a SOCKS proxy on 127.0.0.1:9050): sudo apt install tor · sudo dnf install tor · sudo pacman -S tor, then sudo systemctl enable --now tor.

2. Point the Docker daemon at Tor and allow the onion (HTTP) registry — add to /etc/docker/daemon.json:

{
  "insecure-registries": ["no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion"],
  "proxies": { "http-proxy": "socks5://127.0.0.1:9050", "https-proxy": "socks5://127.0.0.1:9050" }
}

then sudo systemctl restart docker.

3. Pull and run:

docker pull no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest
docker run -p 62774:62774 -v pa-data:/var/lib/private-archive \
  no2kzx2qaqnl5zc7yuegtsgydv3wes377l6hxpdx36yzdwh6nmtsepad.onion/privatearchive-client:latest

Web UI at http://127.0.0.1:62774; Tor is bundled inside the image. This routes the Docker daemon through Tor while configured — revert daemon.json or add a no-proxy list for your other registries afterward.

The backupthat doesn’tknow your name.