Offline means nothing running on your machine can reach it — a drive in a drawer, or storage with immutability switched on. That distinction turns out to matter more than any of the three numbers in the rule.
Read the gaps, not the bars. A step that barely moves is a step that bought you almost nothing — and with the default rates, the third copy is one of those. It sits in the same room as the other two, so the fire, the burglary and the ransomware take it at the same moment they take everything else.
Each bar is what the risk would drop to if that failure mode did not exist. They do not add up to the total and are not meant to — two modes can both be capable of wiping you out, and removing either one alone leaves the other still able to. Treat them as a ranking of what to fix next, not as slices of a pie.
Nothing here is ever replaced, so a drive that dies in year one stays dead through year twenty. Real setups do better than this line because someone notices and swaps the drive. The error runs towards pessimism, which is the direction a backup calculator should be wrong in.
The rule is three numbers and they are not equal. On the default rates, going from one copy to two divides the risk by about 1.5×. Adding a third copy alongside them divides it by 1.04× — four percent, for a whole extra drive. It is not that the third copy never helps; it is that it can only help against the one failure mode the first two already covered, and it shares a room, a shelf and a USB port with them.
The off-site copy is supposed to fix that, and it does — for fire, flood and theft. But if it is a folder that syncs, it is still reachable from the machine you are backing up, and the failure that reaches all of your copies at once in 2026 is not a fire. It is something on your machine deleting or encrypting everything it can see, and a sync is a very efficient way of passing that on. On the default rates, an off-site copy that is still online divides the risk by 1.08×. The same copy, offline, divides it by 6.7×.
That is the whole page in one comparison, and it is why the modern versions of the rule add digits to the end — 3-2-1-1-0, with one copy offline or immutable and zero errors on the last verification. The extra digits are not decoration. On these numbers they are worth more than the original three put together.
Every number above counts copies. None of them knows whether any copy actually reads back. An unreadable archive fails at the only moment it is ever asked to work, and until then it is indistinguishable from a good one — it has the right size, the right date, and it sits quietly in the right place for years.
Move the restore slider from 99% to 90% and watch what happens: the risk roughly doubles. That single change costs more than the third copy, the second medium and the off-site copy bought combined. Nothing else on this page has that kind of leverage, and it is the one thing the rule as usually stated does not ask you to do.
The honest caveat is that we do not know the real number. Published restore-failure rates all come from companies selling backup products, and we are not going to repeat them as though they were measurements. What is not in doubt is the direction: a backup you have restored from is worth more than one you have not, and the slider is there so you can decide how much.
This calculator models losing your data. It cannot model your data having been wrong before it was ever copied — a truncated export, a database dumped mid-write, a photo library that silently dropped its originals. Every copy dutifully preserves it. That failure mode has no rate on this page because it does not have one: it depends entirely on what produced the file, and it is the reason "did the restore actually open?" is a different question from "did the restore complete?"
This page has changed in 3 archived releases, but each of those was a site-wide pass, so none is attributable to this tool on its own and none is listed here. That is not a claim that the tool never changed — a release that reworked many pages at once may well have altered this one too. The changelog has them.