A web hosting account with PHP 7.4+ — almost any shared hosting plan (cPanel hosts like Web Hosting Canada, Bluehost, HostGator, etc.). No database, no subdomain, no special configuration.
Unzip the download and open backup/backup.php in any text editor. Near the top:
const PIN = 'CHANGE-ME-to-a-long-random-phrase';
Replace the text between the quotes. At least 10 characters (the server refuses shorter). A phrase beats symbols on a strange keyboard: plum-radio-november-42. Don't reuse a password from anywhere else.
const EMAIL_TO = '';
Put your email between the quotes and every successful backup emails you a private download link. Leave it empty to skip — the app's Restore from Server button works either way and is the more reliable route (hosting emails sometimes land in spam).
Using cPanel's File Manager (or FTP), upload the whole backup folder into your site's public folder (usually public_html). That's the installation. On first run the script creates a packs/ storage folder beside itself and locks it against direct web access — nobody can browse your backups, even knowing the address.
https://yourdomain.com/backup/backup.php
Use https:// — nearly all hosts include free SSL, and without it your PIN travels unencrypted. To confirm it's alive, paste the URL into a browser. You should see:
{"ok":false,"error":"Unknown action"}
That error is good news — the script is running and waiting for the app. If you see raw PHP code instead, the file isn't executing: check it ends in .php (not .php.txt).
Uploads travel in small chunks, so large libraries and flaky wifi are fine. To pull the library down elsewhere: Restore from Server, same URL and PIN.
Backups are versioned. Each is stored with a date-time filename; the server keeps your 10 most recent and quietly prunes older ones (KEEP_PACKS in the config). Files are ordinary. Your packs sit in packs/ — grab them anytime via cPanel or FTP; they're standard ZIPs with a .pack extension. Public computers stay clean. The app never writes your PIN or library to disk; close the tab and nothing remains. Size limit: 2 GB per pack out of the box (MAX_BYTES).
"Wrong PIN" but you're sure: PINs are case-sensitive and spaces count; the server also pauses a couple of seconds before answering a wrong PIN — that's a security feature. "Server not configured": you uploaded without changing the PIN, or it's under 10 characters. 500 error after adding .htaccess: your host runs PHP under FPM where php_value isn't allowed — delete those lines from the .htaccess and set the same values in cPanel's MultiPHP INI Editor. Backup fails at the very end but the file exists: a rare lost-confirmation hiccup; the backup landed — check before re-uploading. Email never arrives: check spam; the Restore button doesn't depend on email at all.
The worst realistic outcome of a leaked PIN is small: someone could upload junk into your packs/ folder or download your backups. The script cannot read your email, touch your databases, or affect anything else on your account — it only works inside its own folder. Use HTTPS, pick a real PIN, and if you ever suspect it's been seen, edit the file and re-upload: the change is instant.