Sync and backup are different tools
A sync service keeps a folder identical across your devices and a server. That is genuinely useful and it protects you against exactly one failure: the device dying. It does not protect you against anything you or your software does to the files, because propagating your changes is the entire function.
| What happens | Sync alone | Real backup |
|---|---|---|
| Laptop is stolen | Fine. Files are on the server. | Fine |
| You delete a folder by mistake | Deleted everywhere within seconds | Recoverable |
| You overwrite a document with a worse version | The worse version is now the only one, on every device | Previous versions retained |
| Ransomware encrypts your files | The encrypted versions sync up and replace the good ones | Restore from before the incident |
| A file corrupts silently and you notice months later | The corruption was mirrored | Depends on retention, but there is at least a chance |
| Your account is compromised or closed | You may lose access to everything at once | An offline copy is unaffected |
Most consumer sync services have partial mitigations — a trash folder for a limited window, and file version history for a limited number of revisions or days. Those are worth knowing about and worth checking the actual retention period of, because the numbers are shorter than people assume and the clock starts when the damage happens, not when you notice it. Ransomware that sat quiet for a month before triggering can be outside the window by the time anyone realizes.
The practical rule: if the only copy of your photos is a folder that synchronizes, you have redundancy against hardware failure and nothing else.
The 3-2-1 rule, and what each number defends against
This comes from professional practice and it survives because each digit maps to a different class of disaster.
| Rule | Meaning | The failure it covers |
|---|---|---|
| 3 copies | The working copy plus two backups | Any single copy failing, including the backup itself. Backup drives fail at ordinary rates. |
| 2 media types | Not two folders on the same drive, and ideally not two drives bought the same day from the same batch | A failure mode that takes out a whole category — a controller fault, a bad batch, a filesystem bug, a service outage |
| 1 offsite | Cloud, or a drive at a relative house or an office | Fire, flood, burglary, and every other event that removes the whole building. This is the one people skip. |
A common and perfectly adequate household version: the files live on your computer, an external drive at home holds a scheduled backup, and a cloud service holds a copy offsite. Three copies, two media types, one offsite, and nobody had to think about it after the first afternoon.
A version that is not adequate, and is extremely common: files on the laptop, and a copy on an external drive that lives in the same bag as the laptop. That is two copies, one medium, zero offsite, and a single stolen bag takes all of it.
Deciding what to back up
Everything is the wrong answer, because it makes the job large enough that people stop doing it. Sort your data by whether it can be recreated.
| Category | Examples | How hard you protect it |
|---|---|---|
| Irreplaceable | Photos and video of people, original writing, scans of documents, project files, anything with a signature on it | Full 3-2-1. This is the entire point of the exercise. |
| Expensive to recreate | Tax records, financial statements, a large curated music library, work in progress | 3-2-1 if convenient; two copies minimum, one offsite |
| Replaceable with effort | Installed applications, game libraries, downloaded media you could download again | Do not back it up. Back up the license keys and account details instead. |
| Genuinely disposable | Caches, temporary files, old installers | Nothing |
Photos deserve a specific note because they are the category people mourn. The volume is deceptive — a modern phone produces several gigabytes a month without anyone noticing — and a library that fit on a small drive five years ago no longer does. Check what yours actually occupies before choosing a plan size or a drive; the data size converter is useful here because storage marketed in gigabytes and reported by your operating system in gibibytes differ by about seven percent, which is enough to matter when you are choosing a tier.
Cloud, local, or both
| Consideration | Cloud service | External drive |
|---|---|---|
| Offsite by default | Yes | No, unless you physically move it |
| Automatic | Yes, once configured | Only if you leave it connected, which weakens ransomware protection |
| Ongoing cost | A subscription, indefinitely | A one-time purchase, replaced every few years |
| Restoring a large amount | Limited by your download speed. A full library can take days. | Fast, limited by the cable |
| Ransomware exposure | Depends on versioning and retention. An always-connected sync folder is exposed. | A drive that is unplugged between backups is genuinely out of reach |
| Failure mode | Account lockout, billing lapse, service change | Drive failure, theft, house fire, being dropped |
The two protect against different things, which is why the standard advice is both rather than either. Prices, free tiers and included storage change constantly and vary by region and by what else you subscribe to, so compare current terms directly rather than trusting any figure you read in an article — including this one, which deliberately quotes none. If you already pay for several services, a subscription tracker will often show that storage is already bundled into something you have.
Two configuration details are worth the ten minutes. Turn on versioning and set the retention as long as the service allows, because that window is your only defense against damage you did not notice immediately. And unplug the external drive between backups if you can bear the inconvenience, because an always-mounted drive is a drive that ransomware can encrypt.
Testing, which is the part nobody does
A backup nobody has ever restored from is not a backup. It is a folder you believe in. The number of people who discover at the worst possible moment that their scheduled job had been failing silently for eight months, or that the drive is fine but the backup software is unlicensed and will not restore, or that the encrypted archive needs a passphrase written on a laptop that no longer exists, is not small.
The test is not elaborate. Once or twice a year, pick a file at random — a photo from four years ago, a document from last spring — restore it to a different location, and open it. That is the whole exercise, and it verifies the media, the software, the credentials and your own understanding of the process at the same time. Put it on a calendar next to the smoke detector batteries.
While you are there, check three things: that the backup ran recently and did not simply report success on an empty set, that the newest files you care about are actually included, and that you know where the passwords and keys are. A restore you cannot authenticate is not a restore.
A setup you can do this weekend
Turn on your phone photo backup to a cloud service and let the first upload run overnight on Wi-Fi. Buy an external drive at least twice the size of what you are protecting, and configure the backup tool built into your operating system to run to it on a schedule — both Windows and macOS include one and neither costs anything. Gather your important documents into one place first, so that both jobs have a single target rather than seven scattered folders. Write down where the backups are, what account they use, and how you would get into them, and store that somewhere that is not solely on the machine being backed up. Then restore one file to prove it works.
If you are about to do something drastic to a computer — a reinstall, a drive replacement, handing it to someone — the backup goes first and gets verified first. Resetting Windows covers the specific list of things that get missed in that situation, several of which do not live in Documents.
Set it up once, then diary two things: a restore test at some fixed point each year, and a look at the retention settings whenever a service changes its terms. Everything else on this page is a one-time afternoon, and those two diary entries are what keep it true five years from now.
Questions people ask
Is cloud sync the same as a backup?
No, and the difference is the one that costs people their photos. Sync mirrors your folder across devices and a server, so it protects against a device failing and nothing else. If you delete a folder, overwrite a document, or your files get encrypted by ransomware, sync copies that change everywhere within seconds. Real backup keeps earlier versions you can return to. Most sync services do offer a trash window and some version history, which helps, but the retention periods are shorter than people assume and the clock starts at the moment of damage rather than the moment you notice it.
What is the 3-2-1 backup rule?
Three copies of anything you care about, on two different kinds of media, with one of them stored somewhere else. Each number covers a different disaster: three copies because backup drives fail too, two media types because a single category of failure can take out everything of that kind at once, and one offsite because fire, flood and burglary do not care how many drives were in the room. A workable household version is the files on your computer, an external drive at home, and a cloud service — and the offsite copy is the one people skip.
Cloud backup or an external drive?
Both, because they fail differently. Cloud is offsite by default and runs automatically, but it is an ongoing subscription and restoring a large photo library is limited by your download speed, which can mean days. An external drive is a one-time purchase and restores at cable speed, but it sits in the same building as the computer and is only offsite if you physically move it. One advantage of a drive that people overlook: a drive unplugged between backups is genuinely unreachable by ransomware, which an always-connected sync folder is not.
How do I know my backup actually works?
Restore something from it. Once or twice a year, pick a file at random — an old photo, a document from last year — restore it to a different folder and open it. That single test verifies the media, the software, your credentials and your own understanding of the process at once, and it is the only thing that distinguishes a backup from a folder you have faith in. Silent failures are the norm rather than the exception: jobs that have not run in months while still reporting success, drives that mount but hold nothing recent, archives whose passphrase nobody can find.
Does backup protect me from ransomware?
It can, if it is set up with that in mind. Ransomware encrypts everything it can reach, and an always-connected external drive or a live sync folder is something it can reach. What survives is a copy that is offline, or a service with versioning and a retention window long enough that you can go back past the infection. Set retention as long as the service allows, keep at least one copy physically disconnected between backups, and be aware that some ransomware sits dormant for weeks specifically so that the clean versions age out before anyone notices.