Encrypted backup of the folders that matter, into the free storage you already have: the Google Drive that comes with Gmail, the OneDrive that comes with Microsoft 365, iCloud Drive, Dropbox, an external disk, a NAS. The provider only ever holds scrambled blobs. You hold the key, as 24 words and a QR code on a card.
Free, MIT licensed, no account, no server, no subscription. Same family as Tidy for Mac and Clip for Mac.
Download Stash for Mac 1.0.0 (DMG, 2 MB) · macOS 14 or later, Apple silicon and Intel
- Open the downloaded file and drag Stash for Mac into Applications.
- Open it from Applications. macOS will say it can't check the app for malicious software: click Done, then System Settings › Privacy & Security › Open Anyway. That happens once, because this is a free app without Apple's $99-a-year certificate.
- Click Make a Key, keep the card it shows you, add a folder and a destination, click Back Up Now.
Or build it yourself in a minute, no Xcode needed: git clone https://github.com/keithadler/stashmac && cd stashmac && ./build-app.sh --install --run
- Backs up the folders you choose to several places at once: your iCloud Drive folder and your Google Drive folder and an external disk, each a complete copy. An account can be lost, a disk can fail; two destinations survive either, and the app nags until you have two.
- On a schedule: every hour or once a day while the app is open, only to destinations that are reachable right now, uploading only what changed. Opens at login by default so the schedule runs.
- Checks itself: once a week it restores a random file to prove the whole path works, and tells you in plain words. A backup that has never been verified is a guess.
- Encrypted before it leaves the Mac, with a key that lives on a card you keep, never with the provider and never with anyone else.
- Restores a file, a folder, or everything from any snapshot to a place you choose, and shows what every snapshot is costing you so old ones can be thinned out.
Version 1.0.0. Key and recovery card, encrypted chunks and manifests, backup into any folder, a restore browser, verify, snapshot management with two retention policies, exclusions, schedules, a menu bar presence, notifications, help in two languages and tests three ways are all built. Google Drive and OneDrive over their own APIs (for Macs without the desktop apps) are the one roadmap item left.
Measured on an M-series MacBook, 250 files of 4 MB to a local folder: first backup 2.9 s, an unchanged second backup 0.6 s, verify 1.8 s, full restore 2.0 s, never more than 33 MB of memory.
- Upload anything the provider can read. Chunks are encrypted on the Mac and named by a keyed hash, so the provider cannot tell what a blob is, or whether two people stored the same file.
- Keep a copy of your key anywhere but this Mac's Keychain. The recovery card is the only backup of it, and the app says so before you can continue. Lose the card and the backup is unreadable, by anyone, including you.
- Restore a chunk that fails authentication. Damaged or tampered data is reported, never written.
- Open cloud placeholders while reading your folders (a file that only exists in iCloud is skipped and listed, not downloaded behind your back).
Stash for Mac makes a random 256-bit key. You keep it three ways, all on one printable card:
- 24 words (BIP-39 encoding, with a checksum word, so a typo is caught before restore starts)
- A QR code of the same key, scannable by a phone camera or by the app on a new Mac
- A fingerprint, eight characters, so two cards can be told apart
Everything else is derived from the key with HKDF: the chunk encryption key, the chunk naming key, the manifest key. There is no password, so there is nothing to guess.
Protects against a breached or subpoenaed cloud account, a curious provider, a lost laptop with the sync folder on it, and someone who has your Google or Microsoft password. Does not protect against malware running on the Mac while the app has the key in memory, a lost recovery card, or someone with account access deleting the ciphertext (point it at two destinations). The provider can see when you back up and roughly how much. Full text: docs/threat-model.md.
Standard primitives from Apple's frameworks only, no homemade parts: ChaChaPoly for chunks and the
manifest, HKDF-SHA256 for key derivation, HMAC-SHA256 for chunk names, SecRandom for the key.
Chunk format: STSH1 + 12-byte nonce + ciphertext + 16-byte tag. Test vectors in
Sources/StashMac/Tests.
Inside the destination folder: Stash for Mac/<key fingerprint>/chunks/<ab>/<64 hex> for the
encrypted 4 MB chunks, manifests/<timestamp>.stsm for each encrypted snapshot, and a README that
tells whoever finds the folder what it is and how to restore it. Identical content is stored once
per stash. A second backup uploads only chunks the destination doesn't already have.
stashmac key new | show | card card.pdf | restore "<24 words>" | restore --qr card.png | forget
stashmac add ~/Documents stashmac dest ~/Library/CloudStorage/GoogleDrive-you@gmail.com/My\ Drive
stashmac backup every folder to every destination; --json for scripts
stashmac snapshots stashmac restore latest ~/Desktop/Restored [--only photos/2024,taxes]
stashmac snapshots | forget <snapshot> | prune --thin stashmac exclude add "*.mov" --max-mb 2048
stashmac verify opens every chunk of the latest snapshot, restores one random file
stashmac status stashmac selftest
Exit codes: 0 fine, 1 something to look at (placeholders skipped, nothing to back up), 2 problem.
A snapshot is not a copy: pieces are stored once and shared, so what costs space is old versions of files that changed. Manage Snapshots in the window shows what deleting each one would free, and two policies run after every backup: keep the newest N, or thin out over time (everything for a week, daily for a month, weekly for a year, monthly after). Photos libraries, caches and temp files are skipped by default; Settings › Skip takes your own patterns and a size cap.
- Google Drive and OneDrive over their APIs with app-only scopes, for Macs without the desktop apps. The engine already talks to storage through a small protocol, so this is one new file.
- Content-defined chunking, so an edited large file re-uploads only the part that changed.
- Notarization once a Developer ID exists.
macOS 14 or later and the Command Line Tools. No Xcode, no dependencies.
./build-app.sh --install --run # universal build, installs, symlinks stashmac
stashmac selftest # the suites, no Xcode needed
swift test # same suites under XCTest where Xcode existsMIT. See LICENSE. Mac and macOS are trademarks of Apple Inc.; Google Drive, OneDrive, iCloud and Dropbox belong to their owners and are named only to identify those services.
Four more small apps built the same way: each does one thing, says exactly what it touches, and never phones home. Free, MIT licensed, no accounts. All five at keithadler.github.io.
- Ask for Mac: ask your files a question in your own words and get the answer with the file it came from, all on the Mac.
- Permissions for Mac: every permission on your Mac on one screen, in plain English, with what changed since last week.
- Clip for Mac: a clipboard that remembers, with a stack you paste through one item at a time, and that refuses to record passwords.
- Tidy for Mac: cleanup and speed for the whole family; nothing is deleted, only moved to the Trash with an undoable receipt.