Safeguard
Developer Tools•

How do you verify a PostgreSQL base backup with pg_verifybackup?

pg_verifybackup checks a base backup against its manifest: files, sizes, checksums and WAL. What it proves, what it misses, and why to test restores.

Safeguard Security Team
3 min read

Run pg_verifybackup against the backup directory. It compares the backup with the manifest the server wrote at backup time, checking files, sizes, checksums and the WAL needed for recovery. A pass is useful evidence, but the PostgreSQL docs still recommend test restores.

What it checks

The PostgreSQL documentation describes four stages:

  1. The manifest exists, is well formed, matches the backup's system identifier and passes its own checksum.
  2. Files present on disk match what the server meant to send, with extra and missing files reported.
  3. Each file's checksum matches the manifest.
  4. The WAL records needed for recovery are present and parseable.

What it does not check

  • It cannot cover everything a running server checks when it uses the backup.
  • It cannot detect logically wrong WAL records that have valid checksums.
  • It ignores some files that legitimately change during a backup, such as recovery signal files.
  • It does not verify WAL files that are not needed for recovery.
  • WAL checks are version specific, so use the verify tool matching the backup version.
  • Tar format backups do not support WAL verification yet, so you need the no parse WAL option.

The documentation says to still do test restores and data verification. Treat this as a fast first gate, not the final proof.

Steps

pg_verifybackup /backups/base-2026-10-19
pg_verifybackup -F t --no-parse-wal /backups/base-tar
  1. Take base backups with the tool that writes a manifest.
  2. Run the verify command right after each backup in the same job, and fail the job on any error.
  3. Run it again on the copy in long term storage, to catch damage in transit or at rest.
  4. Use the skip checksums option for a quick presence and size check only when time is tight. It is much faster but weaker.
  5. Keep the output with your backup records.
  6. On a schedule, restore a recent backup into a scratch server and run application level checks.

Useful options

OptionPurpose
Format optionSay whether the backup is plain or tar
No parse WALSkip WAL parsing, needed for tar
Skip checksumsFaster, checks presence and size only
Exit on errorStop at first problem
Wal directoryFind WAL stored outside the backup

Availability

The tool ships with PostgreSQL versions that support backup manifests. Check your own server version's documentation for the exact options before scripting it.

Safeguard offers compliance and evidence automation, which can store dated proof that verification ran, alongside dependency scanning. Try the free scan.

Quick check

Does a passing verify mean I can restore?

It means the backup matches its manifest and has the WAL needed. It does not prove the data is right for your application, so keep restore tests.

Does it work on SQL dumps?

No. It is for base backups with a manifest, not for dump files.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.