Encrypted before it leaves
Files are split into chunks, compressed and encrypted on your computer. Many files are sealed together into packs, so nothing that leaves your machine reveals a file's name, path or contents.
Security model
Built so that nobody else can read your backups
Cloud backup asks you to trust a company. Tango Backup is designed so that you don't have to trust anyone: not your partners, not the network, and not us.
Zero-knowledge partners
Partners store packs of random-looking bytes with no headers or labels. They cannot tell photos from spreadsheets, or how many files you have.
You hold the only key
Every key comes from a 256-bit secret shown to you once as 24 words. It never leaves your computer and we never see it. There is no "forgot password" back door.
Trust, but verify
Every day your computer challenges each partner to prove it still holds your packs. Anything missing or altered is detected and copied again elsewhere.
The cryptography
Tango Backup uses only well-studied, standard building blocks, implemented with Go's standard and extended cryptography libraries. No home-made algorithms.
| Purpose | Primitive |
|---|---|
| Encrypting your data | XChaCha20-Poly1305 (authenticated encryption), a fresh key per pack |
| Deriving keys | HKDF-SHA256 from your 256-bit master seed |
| Optional local passphrase | Argon2id (256 MiB memory-hard) |
| Deduplication IDs | HMAC-SHA256 with a secret key, so identical data is stored once without revealing what it is |
| Identity and signatures | Ed25519 |
| Connections | TLS 1.3 over QUIC or TCP, mutually authenticated with pinned keys |
| Randomness | The operating system's cryptographic random generator only |
Even the way files are cut into chunks depends on your secret key. That stops an observer from recognising a well-known file just from the pattern of chunk sizes.
What others can and cannot see
No system leaks nothing. Here is exactly what each party can observe, so you can judge for yourself.
| Who | Can see | Can never see |
|---|---|---|
| Your partners | That you store data with them, how much in total, the size of each pack, when packs arrive, your IP address | File names, folders, contents, attributes, directory structure, how many files or versions you have |
| The relay | Which computers connect to which, when, traffic volume, IP addresses | Any file content, any pack content, pairing secrets |
| Our license server | For paid licenses only: license ID, device ID, device label, app version, OS | How much you back up, your files, your partners, your backup activity |
| Us, the makers | Nothing about your backups | Your files, your key, your recovery phrase |
Pack sizes are the one deliberate trade-off. They show roughly how much new data a backup run produced. We accept this because hiding it would mean wasting a lot of disk space on padding.
Your recovery phrase
When you set up Tango Backup it shows you 24 words, the standard BIP-39 format used by hardware wallets. Those words are your backup key. Tango asks you to confirm them before your first backup counts as protected, and offers a printable recovery kit.
- Lose your computer: type the 24 words into a new install and your partners recognise you automatically.
- Someone steals your computer: you can add a local passphrase so the stored key is useless without it.
- Lose both the computer and the words: nobody can decrypt your backups. Not your partners, and not us.
Integrity you can check
Every pack is authenticated, so any change to a single byte is detected on restore. Each day, partners answer one-time challenges computed over random parts of your packs and sign their answers. A wrong or missing answer triggers a full check and, if needed, a fresh copy on another partner. You can also run a full verification of any snapshot whenever you like.
Privacy beyond the data
- No account for the free tier. No email, no registration, no phoning home.
- Payments handled by Paddle, our merchant of record. We never see your card details, and a purchase is not linked to any computer until you activate it.
- Notifications leave file names out by default, because chat and email providers can read the messages.
- Secrets never go into logs. Keys, recovery phrases and access tokens are never written to log files.
- The local web interface listens only on your own computer by default and requires an access token.
Start protecting your files today
Free for up to 50 GB per computer. No account, no credit card, no cloud.