A rule of thumb with a simple shape
The 3-2-1 rule is a widely cited guideline for how many backup copies to keep and where to put them. It is easy to remember, which is much of its appeal:
- 3 copies of your data in total.
- 2 different kinds of storage.
- 1 copy kept offsite.
It is a rule of thumb, not a guarantee or a standard that makes you safe by itself. But as a quick check on a plan, it is hard to beat.
What the numbers mean
Three copies
The three copies include your original working data. So the rule asks for the live files plus two backups. The reasoning is about independent failure. If one copy has some chance of failing at a given moment, the chance that two or three separate copies fail together is typically much smaller, provided they do not share a cause. With only one backup, a single bad event during the time your original is also damaged can leave you with nothing.
Two kinds of storage
The second number asks that your copies not all sit on the same type of storage. The idea is to avoid a single shared weakness. If the original and the backup are on identical devices from the same batch, or both inside one machine, a common fault, an electrical surge, or the same software bug could damage both. In practice, “two media” is often satisfied by something like an internal drive plus an external drive, or a local drive plus online storage. Opinions differ on how strictly to read “media” in an age of solid-state drives and online services, so treat the underlying goal, not mixing up identical points of failure, as what matters.
One offsite
At least one copy should be in a different physical location, or otherwise out of reach of whatever hits the first location. Fire, flood, theft, or a power problem can take out a whole office or home, including a backup drive sitting beside the computer. Offsite can mean a drive stored at another site, or an online backup service. The more your online copy is cut off from your everyday account and device, the less likely a single mistake or break-in will touch it too.
An example
Here is a hypothetical freelancer with a laptop:
- Copy 1: the working files on the laptop.
- Copy 2: an automatic backup to an external drive at home. That is a second copy, on a second kind of storage.
- Copy 3: an automatic backup to an online storage service. That is a third copy, and it is offsite.
A small team might do something similar, with shared files on a network storage device in the office, a nightly copy to a second device, and another copy to an online service or to a drive taken home on rotation. Either way, the specific products matter less than whether the three pieces of the rule are covered.
Why syncing does not count
A common mistake is to count a synced folder as a backup copy. Sync mirrors changes and deletions, so it generally behaves like part of the same copy, not an independent one. The article on cloud sync goes through the details. A copy only counts toward the rule if it is retained independently and can be restored to an earlier state.
Common variations
People adapt the rule to different needs. You may see versions like 3-2-1-1-0, which add a copy that is offline or cannot be altered, and a target of zero errors found when verifying. These variations respond to threats such as malicious software that tries to erase backups it can reach. An offline copy, for example a drive that is disconnected when not in use, protects against that. Whether you need the extras depends on how much a loss would cost and how much effort you can sustain.
What the rule does not cover
The rule is about copies, so several important things sit outside it:
- Testing. Having three copies is no help if none restores properly. Restore testing is what turns a plan into confidence.
- Version history. The rule says nothing about how many past versions you keep. If a bad change is copied to all backups, you have three copies of the problem. Retaining older versions addresses this.
- Security. Each copy holds the same sensitive information, so protect each with access controls, and consider encrypting drives and online backups.
- Automation. Manual copying tends to lapse. A rule is only as good as the habit behind it.
- Scale. Large amounts of data, regulatory requirements, or demands for quick recovery may call for more elaborate arrangements than the rule describes.
Applying it without overthinking
Start where you are. Count your current copies honestly, including whether each is truly independent. Then close the biggest gap first: often that is simply adding an offsite copy. Set it to run automatically, check it occasionally, and revisit the plan when your data or your team grows.
The 3-2-1 rule will not eliminate risk, and no set of numbers can. What it does well is turn a vague wish to be backed up into three concrete questions you can answer in a minute.