Offline means nothing running on your machine can reach it — a drive in a drawer, or storage with immutability switched on. That distinction turns out to matter more than any of the three numbers in the rule.
Read the gaps, not the bars. A step that barely moves is a step that bought you almost nothing — and with the default rates, the third copy is one of those. It sits in the same room as the other two, so the fire, the burglary and the ransomware take it at the same moment they take everything else.
Each bar is what the risk would drop to if that failure mode did not exist. They do not add up to the total and are not meant to — two modes can both be capable of wiping you out, and removing either one alone leaves the other still able to. Treat them as a ranking of what to fix next, not as slices of a pie.
Nothing here is ever replaced, so a drive that dies in year one stays dead through year twenty. Real setups do better than this line because someone notices and swaps the drive. The error runs towards pessimism, which is the direction a backup calculator should be wrong in.
The rule is three numbers and they are not equal. On the default rates, going from one copy to two divides the risk by about 1.5×. Adding a third copy alongside them divides it by 1.04× — four percent, for a whole extra drive. It is not that the third copy never helps; it is that it can only help against the one failure mode the first two already covered, and it shares a room, a shelf and a USB port with them.
The off-site copy is supposed to fix that, and it does — for fire, flood and theft. But if it is a folder that syncs, it is still reachable from the machine you are backing up, and the failure that reaches all of your copies at once in 2026 is not a fire. It is something on your machine deleting or encrypting everything it can see, and a sync is a very efficient way of passing that on. On the default rates, an off-site copy that is still online divides the risk by 1.08×. The same copy, offline, divides it by 6.7×.
That is the whole page in one comparison, and it is why the modern versions of the rule add digits to the end — 3-2-1-1-0, with one copy offline or immutable and zero errors on the last verification. The extra digits are not decoration. On these numbers they are worth more than the original three put together.
Start from one copy on one drive and read the multipliers off the panel above, on the default rates. Adding a second copy divides the chance of losing everything by about 1.5×. Adding a third beside it divides the remainder by 1.04× — the third copy shares every failure the first two share, so there is almost nothing left for it to catch.
Now leave the copies alone and move the restore slider from 99% to 90%. The risk roughly doubles. That single change outweighs the second copy, the second medium and the off-site copy combined, and it is the one thing the rule as usually stated never asks you to test.
Every number above counts copies. None of them knows whether any copy actually reads back. An unreadable archive fails at the only moment it is ever asked to work, and until then it is indistinguishable from a good one — it has the right size, the right date, and it sits quietly in the right place for years.
Move the restore slider from 99% to 90% and watch what happens: the risk roughly doubles. That single change costs more than the third copy, the second medium and the off-site copy bought combined. Nothing else on this page has that kind of leverage, and it is the one thing the rule as usually stated does not ask you to do.
The honest caveat is that we do not know the real number. Published restore-failure rates all come from companies selling backup products, and we are not going to repeat them as though they were measurements. What is not in doubt is the direction: a backup you have restored from is worth more than one you have not, and the slider is there so you can decide how much.
This calculator models losing your data. It cannot model your data having been wrong before it was ever copied — a truncated export, a database dumped mid-write, a photo library that silently dropped its originals. Every copy dutifully preserves it. That failure mode has no rate on this page because it does not have one: it depends entirely on what produced the file, and it is the reason "did the restore actually open?" is a different question from "did the restore complete?"
Barely, on the default rates. Going from one copy to two divides the risk by about 1.5×; adding a third alongside them divides it by 1.04× — four percent, for a whole extra drive. It can only help against the one failure the first two already covered, and it shares a room, a shelf and a USB port with them.
For fire, flood and theft, yes. For the failure that actually reaches all your copies at once in 2026 — something on your machine deleting or encrypting everything it can see — no, because a sync is a very efficient way of passing that on. That is why the modern rule adds digits: 3-2-1-1-0, with one copy offline or immutable.
The restore rate. Move it from 99% to 90% and the risk roughly doubles — more than the third copy, the second medium and the off-site copy bought put together. A copy you have never restored from is a copy you are assuming, and it is the one thing the rule as usually stated does not ask you to check.
Whether the data was right before it was copied. A truncated export or a database dumped mid-write is preserved faithfully by every copy, and that failure has no rate here because it does not have one. Three copies of a corrupt file is three copies of a corrupt file.
Distance protects you from fire and theft. Being unreachable protects you from everything running on your own machine, which is the failure that takes all your copies at the same instant. On the default rates, unplugging the off-site copy is worth more than the other four steps of the ladder combined.
It is the one people reach for, because another drive is easy to buy. But a third copy next to the first two only helps against a copy dying on its own, the mode two copies already handled: about four percent on the default rates.
It is the only input here with the power to make every other number irrelevant, and the only one with no public data behind it. Halving your confidence in restores costs more than the entire 3-2-1 layout buys.
Two failure modes can each be capable of wiping you out on their own. Removing either still leaves the other, so the “cost” of each overlaps and the four bars sum to more than the total. Rank them; do not slice them.
A drive that fails in year two is still failed in year twenty. Real setups notice and swap it, so real risk is lower than these figures: wrong in the direction a backup calculator should be wrong in, but wrong, and worth knowing at the twenty-year end of the chart.
A truncated export or a database dumped mid-write gets copied faithfully to all three places. No rate on this page sees that, which is why “did the restore open?” is a different question from “did the restore finish?”
This page has changed in 139 archived releases, but each of those was a site-wide pass, so none is attributable to this tool on its own and none is listed here. That is not a claim that the tool never changed — a release that reworked many pages at once may well have altered this one too. The changelog has them.