Most memories live on a single disk.
Every common way to protect them has a catch.
The external drive
Sits next to the computer. A fire, a theft or ransomware takes both.
The cloud subscription
Costs every month, forever, and keeps your life on someone else’s servers.
“I’ll do it tomorrow”
A backup that needs your attention is a backup that doesn’t happen.
You keep their backup.
They keep yours.
The free space you already have becomes the currency. Like RAID spreads data over disks so one can fail, RAIN spreads your encrypted backup over independent computers, so one can disappear.
Your files are encrypted on your computer, then copied to two friends.
Install and run init
A guided setup: your 24 recovery words, a 25th only you know, and the folders to protect.
Invite a friend
Send one line over Signal. They paste it. No IP addresses, no port forwarding.
That’s it
Every change is backed up about 30 seconds after it happens, in the background, at low priority.
$ rainvault init ── Step 3 of 4: where your copies go ── 1 a friend sent me a pairing code 2 invite a friend: you get a code to send them 3 I don’t know anyone with RAIN Vault: trade space with strangers Choose 1, 2, 3 or 4: 2 Send this to your friend, over a channel you trust: rainvault join rv1:3xK9… ✔ paired with Anna · backing up ~/Documents, ~/Pictures
A handful of commands.
Most days, none at all.
After rainvault init everything runs by itself. These are the commands for the moments you want to look, add a friend or get something back.
# invite a second friend (do it once per friend) $ rainvault invite --host-quota 500GiB Send this to your friend, over a channel you trust. It works once, until 2026-11-02 18:40:00 UTC: rainvault join rv1:7pQ2… waiting for your friend to join (Ctrl+C to stop waiting; the code stays valid)… paired with mihai-laptop (12D3KooWMh…) How do you want to call this friend? [mihai-laptop]: Mihai ✔ saved as "Mihai" # a third friend in reserve: used only if a copy gets into trouble $ rainvault invite --standby # no friends with RAIN Vault? trade space with strangers $ rainvault join --space 500GiB # names are yours to choose $ rainvault peer rename mihai-laptop "Mihai" "mihai-laptop" is now called "Mihai"
You get as much space at each friend as you give them. Two friends keep two copies; a standby friend steps in by itself.
$ rainvault health OVERALL: OK — 2 of 2 required healthy copies · this node runs 0.5.0 PEERS Anna active OK · runs 0.5.0 contact 2m ago · complete backup 2m ago · full verification 3 days ago · restore drill passed 1 day ago · 61.4 GiB of 500.0 GiB space: promised space proven (500.0 GiB of 500.0 GiB proven) link: 31 ms round trip · down 6.2 MiB/s · up 2.4 MiB/s · full restore ≈ 2 h · on an SSD Mihai active OK · runs 0.5.0 Elena standby OK YOUR DISK /dev/nvme0n1 Good · 38°C · 380.2 GiB free of 476.9 GiB # a live window with progress and time left $ rainvault monitor # make sure alerts reach your phone (ntfy, Telegram, e-mail) $ rainvault alert test
The daemon checks every friend every day: reachable, up to date, every block still there, a real restore drill each week. The exit code (0/1/2) plugs into any monitoring.
$ rainvault source add ~/Pictures source /home/ana/Pictures added $ rainvault snapshots ID TIME (UTC) HOST FILES SIZE 311 2026-10-27 16:02:11 laptop 48211 61.3 GiB 312 2026-10-27 17:45:03 laptop 48230 61.4 GiB # one folder from yesterday, into an empty directory $ rainvault restore ~/restored --snapshot 311 --path ~/Documents/taxes # browse every snapshot as a read-only network drive $ rainvault mount
Every change becomes a versioned snapshot about 30 seconds after it happens. Old versions are thinned out by a retention policy; nothing you restore is ever written over your current files.
# once, right after setup $ rainvault kit # print it; keep it with your paper $ rainvault seed-phrase --check ✔ your 24 words and your 25th word are right: keep them apart and safe # on a new computer, after losing the old one $ rainvault recover --peer anna=12D3KooWAn… Type your 24 words, separated by spaces: ••••• ••••• … Your 25th word (hidden; press Enter if you never chose one): Recovered vault in ~/.local/share/rain_vault Node ID (unchanged): 12D3KooWQx… $ rainvault restore ~/restored # ransomware wiped your backup? bring back the state from Anna's trash $ rainvault rescue --peer Anna
Recovery needs only the 24 words, the 25th word and the name of one friend; the printed kit has the exact command ready.
# start in the background, now and at every boot $ rainvault service install service installed and started; its log: journalctl --user -u rainvault -f $ rainvault update --check RAIN Vault 0.6.0 is out (you run 0.5.0). It installs itself around 2026-11-03 03:20:47 UTC, or now with `rainvault update`. # the whole user guide is built in $ rainvault guide recovery
Updates install themselves within a week of a release, only when signed with our offline key, and roll back by themselves if the new version misbehaves.
Set up
- rainvault init
- guided setup: words, folders, friends, service
- rainvault source add|remove|list
- what to back up
- rainvault key protect
- encrypt this computer’s key with a passphrase
- rainvault guide [topic]
- the built-in user guide
Friends & space
- rainvault invite
- a one-line code for a friend; --standby, --host-quota
- rainvault join <code>
- pair using a friend’s code
- rainvault join --space 500GiB
- trade space with strangers; leave to stop
- rainvault peer list|rename|remove
- manage friends and storage targets
- rainvault peer add-storage
- Hetzner Storage Box, S3, WebDAV, a disk
Backups
- rainvault backup
- one backup now (the daemon does it on every change)
- rainvault snapshots
- every version kept
- rainvault restore <dir>
- into an empty directory; --snapshot, --path
- rainvault mount
- browse snapshots as a network drive
- rainvault gc
- apply retention, free space at friends
Checks
- rainvault health
- enough healthy copies? exit code 0/1/2/3
- rainvault monitor
- live window: copies, progress, disks
- rainvault verify
- spot-check that friends hold your data
- rainvault maintain
- verify, repair history, restore drill, now
- rainvault alert test
- send a test alert to every channel
Recovery & safety
- rainvault kit
- print the recovery kit
- rainvault seed-phrase --check
- type the words back once
- rainvault recover
- rebuild from the words on a new computer
- rainvault rescue --peer
- undo a mass deletion from a friend’s trash
Running
- rainvault service install
- start now and at every boot
- rainvault daemon
- run in this terminal instead
- rainvault status
- friends, usage and snapshots
- rainvault update [--check]
- install the newest version now
- rainvault rendezvous serve
- run your own discovery server
Nobody sees your files
but you.
Encryption isn’t a setting you turn on: it happens on your computer before a single byte leaves, every time. Your friends, our server and we ourselves hold only sealed blocks we cannot open, even if someone asked us to.
Encrypted on your machine
XChaCha20-Poly1305 with 256-bit keys before anything leaves. Friends store sealed blocks: no contents, no file names, no folder structure.
The key is yours alone
24 words on paper plus a 25th word that lives only in your head. Someone who finds the paper still can’t open anything.
Direct, no middleman
Computers find each other through a tiny rendezvous server, then connect directly with QUIC. Backup data never passes through it.
Public code, signed updates
The source code is public: anyone can audit the cryptography. Updates install themselves only when signed with a key kept offline, and roll back on their own if they misbehave.
Lose your computer.
Keep your files.
Your whole backup comes back on a new computer from two things only you have: 24 words on paper and a 25th word in your head. No account, no support ticket, not even us.
Printed once by rainvault kit, with the friends who hold your copies and the exact command to run on a new computer.
A word or phrase you choose at setup. It is never shown, printed or stored anywhere.
Someone who finds your paper still can’t open anything. Forget it, and nobody can recover the backup: keep it apart from the paper, in your head or a password manager.
Install RAIN Vault on the new computer.
Run the command from your kit: rainvault recover --peer anna=…
Type the 24 words, then the 25th. A typo is caught at once.
Your files, folders and settings come back. Friends recognise you; nothing is uploaded again.
$ rainvault recover --peer anna=12D3KooW… To bring your vault back you need the 24 words from your paper and your 25th word. Type your 24 words, separated by spaces: ••••• ••••• ••••• … word 7 is not one of the seed words. Check the spelling and the order on your paper, then type them again. Type your 24 words, separated by spaces: ••••• ••••• ••••• … Your 25th word (hidden; press Enter if you never chose one): Recovered vault in ~/.local/share/rain_vault Node ID (unchanged): 12D3KooW… $ rainvault restore ~/Documents
| If you lose… | What happens |
|---|---|
| The computer | Recover on a new one with the 24 words and the 25th word. |
| The paper | Print a new kit from your computer while you still have it; the 25th word protects the old paper. |
| The 25th word | Nobody can recover the backup. Check it once with rainvault seed-phrase --check; health reminds you until you do. |
| Everything to ransomware | Friends keep deleted data for 30 days; rainvault rescue brings it back. |
A backup that checks itself.
Copying is the easy part. RAIN Vault proves every day that your copies are whole, and repairs them when they’re not.
Kept with two different people at all times. When one gets into trouble, a third starts on its own.
Friends prove they still hold every block and all the space they promised, without sending the data back.
Ransomware can’t wipe your friends’ copies. Deleted data waits 30 days; rainvault rescue brings it back.
You get exactly what you give.
Between two friends, each can use at most the space the other offers, and that space is proven daily. No friends on RAIN Vault yet? Trade space with strangers on other networks, with a reputation earned by keeping others’ data well.
The best of the cloud and your own drive.
| RAIN Vault | Cloud subscription | External drive | |
|---|---|---|---|
| Cost | Free space you already have | Every month | Once |
| Copy in another home | Yes, with 2 people | Yes | No |
| Who holds the key | Only you | Depends on the provider | You |
| Checks itself it’s whole | Daily | Inside the provider | Only if you check |
| Survives ransomware | 30-day trash at friends | Depends on the provider | Only if unplugged |
One friend. A few minutes.
Install RAIN Vault, run rainvault init and follow the steps.
curl -fsSL https://github.com/andreiweb/rain_vault/releases/latest/download/install.sh | shrainvault initNo friend with spare space? RAIN Vault Cloud — managed encrypted storage — is coming. Your keys will still never leave your computer.