MongoDB backups, every document counted
backupd runs mongodump on your schedule, adds the oplog when it can, and restores each backup into a sandbox to count every collection’s documents against the dump.
Restore test
events-2026-10-16-0300.archive.zst.age- 4 of 4
- 11,108,878
- 2m 15s
- mongodb 7.0
- Fetch the backup
- Decrypt
- Restore
- Count documents
- Clean up
| Collection | Backed up | Restored | Result |
|---|---|---|---|
events.pageviews | 9,812,440 | 9,812,440 | match |
events.sessions | 1,204,118 | 1,204,118 | match |
events.signups | 88,301 | 88,301 | match |
events.experiments | 4,019 | 4,019 | match |
- 4.2+
- MongoDB 4.2 and later.
- Oplog
- Replica sets get the oplog for a consistent copy.
- Exact counts
- Documents counted in every collection.
- Atlas ready
- Atlas and self-managed, over TLS.
How a backup runs
- Dump with mongodumpmongodump writes one archive of your databases, with --oplog when it backs up a whole replica set.
- Compress and encrypt on the wayThe dump is compressed with zstd and encrypted with age as it streams to storage in 64 MiB parts. Nothing is written to a disk on the way.
- Check the file we storedThe stored file is read back, decrypted and decompressed, and both checksums are compared before the backup counts as good.
Backup
events-2026-10-16-0300.archive.zst.age- Dump
- Compress
- Encrypt
- Upload
- Check
The restore test
On your plan’s cadence, the backup is restored under a temporary prefix on a sandbox MongoDB server, without touching yours.
Every collection’s documents are counted and compared with the counts mongodump reported while it dumped. If one is short, you get an alert and the backup’s page names it. Then the copy is dropped.
What backupd needs
- A mongodb:// or mongodb+srv:// connection string. Put a database in the path to back up only that database; leave it out to back up every non-system database.
- TLS is required: tls=true, or an +srv address.
- Every host, including each SRV target, must resolve to a public address. Authentication is SCRAM-SHA-1 or SCRAM-SHA-256.
- A user with the backup role, and the restore role if you restore from backupd.
Add database
backupd connects over TLS. Use a read-only user.
Connection string
mongodb+srv://backup:••••@cluster0.example.mongodb.net
Schedule
Daily at 03:00
Keep backups
30 days
Restore it yourself
Every backup is encrypted with age to your key as well as ours. Download it, and open it with free tools on your own machine:
# Decrypt, decompress and restore
$ age -d -i backupd.agekey app.archive.zst.age | zstd -d \
| mongorestore --archive --uri "$TARGET_URI"
# A full replica-set backup, replaying its oplog
$ age -d -i backupd.agekey app.archive.zst.age | zstd -d \
| mongorestore --archive --oplogReplay --uri "$TARGET_URI"Not yet
- The oplog is only included for full-instance dumps of a replica set. A single-database connection string, or a sharded cluster through mongos, is dumped without it.
- The admin, config and local databases are never restored or tested.
- Point-in-time recovery and incremental backups are not available yet; every backup is a full copy.
- Private networks, VPC peering and SSH tunnels are not supported yet.
Questions
Yes. Use the mongodb+srv:// string Atlas gives you, and make sure Atlas’s network access list lets backupd connect.
When the connection string points at a whole replica set, mongodump runs with --oplog, so the copy is consistent to one moment. Restore it with --oplogReplay.
We restore the archive under a temporary prefix on our sandbox server, count the documents in every collection with countDocuments, compare them with what mongodump reported, then drop the copy.
Back up MongoDB tonight
Paste a connection string, pick a schedule and add your key. Starter is free for 14 days.