Work out backup encryption time instantly with clear inputs, formula shown and shareable results.
With AES-NI, encryption throughput reaches several gigabytes per second per core, so it is rarely the bottleneck in a backup pipeline — disk or network usually is. Without hardware acceleration, software AES runs at a fraction of that speed and becomes the limiting stage, which is when ChaCha20-Poly1305 becomes the better choice. Parallel streams help until memory bandwidth saturates, modelled here at 16 streams.
Encryption time
effective throughput = base x cipher factor x min(streams, 16); time = data bytes / effective throughput
Compress first. Encrypted data is indistinguishable from random and will not compress at all, so reversing the order can multiply storage cost.
Decryption is comparable in cost to encryption for AES-GCM, so plan the same overhead on restore — which matters because restore time is what your recovery objective is measured against.