The key is to set things up once so as to hardly need to think about them again.
My iMac automatically backs up to a Time Capsule every hour. I hardly notice this happening (but I do know that it is happening).
Every ten days it reminds me to backup to an external HD that I keep hidden the rest of the time. When it does that I go get the HD, plug it in, and start the backup.
Finally, I have a contract with an online backup provider. This backup also happens automatically. I forget how often, but I get regular reports that it does.
All of these backups are encrypted. All of my computing devices need a password (or thumbprint, or face id) to log in.
I have only once needed to restore a whole machine from backup (which worked). I have more often had reason to go delving into the Time Machine backups to retrieve old versions of current files.
I have various other computing devices with their own backup provisions. In some cases that is none, by choice, because they are not places where "work" happens, i.e. places where I create things that I don't want to risk losing. My PC, for example, only exists to be able to run VR applications. Pretty much everything on my iPhone exists in the iCloud and therefore on my iMac also.
To address your criteria:
All backups are encrypted.
The only thing that requires an ongoing subscription is the online backup provider, for which I pay $60/year. My backup with them is currently just under 2TB.
I've never had a flood come into the house, but all my computer stuff is upstairs anyway. If my house burned down and all that is in it, I'd be reliant on the online provider to get stuff back.
As the Time Capsule is always on and always connected, I guess ransomware would get at that too, but the external drive and the online backups would presumably escape.
I don't have a solution to this. There are two passwords that I must not ever forget. One is the password to my iMac, and the other is the password to an encrypted file on the iMac (and backed up to a USB stick) containing all my other passwords. I use both of these daily, which keeps them in my memory, but I know that any password I don't use for a few months is likely to drop out. Writing them down is vulnerable to forgetting where I wrote them, and to the house burning down, and to theft.
The solution to forgetting passwords is to have multiple alternative passphrases that unlock the same critical thing.
I wrote down my master password in multiple public places. No one can connect them to me but I can retrieve them when I want. (If I was targeted by a sophisticated enough adversary they could've been tailing me when I went to write/hide them.)
Two distinct pieces of advice:
1) Buy a NAS (I use Synology, my understanding is that they're all somewhat comparable). Backup from your local devices to that is pretty trivial, and different for different OSs. I put "important" stuff on a shared folder that gets backed up to cloud (Syno supports many different destinations) weekly, and I back up everything to an external HDD every few weeks.
Hyperbackup (Synology's backup app) does client-side encryption using certificates or long-ish passphrases, so not accessible to the cloud host or anyone who steals my backup drive. Option to encrypt the NAS volumes so they require passphrase or cert on reboot, but I haven't bothered. It also does versioned file-level backups by default, so I can go back to older versions even if a corrupted/destroyed file has been backed up more recently.
I think that covers 1-4 of your criteria.
2) For #5, use a password manager. I use PasswordSafe, but there are a number of more modern ones that are probably more complete and just as crypotgraphically secure. 20-character truly random strings, different for each site/use/destination, with you only memorizing a single long passphrase. I actually have two safes - one that has my commonly-used PWs that I cloud-sync to all my devices, and one that I only sync at home and never gets to a 3p storage mechanism (except as part of an encrypted backup). So I guess that's two passphrases to memorize. I do also have a bank safe-deposit box for some documents, and keep a sealed envelope containing these and a few other passphrases written on it there, so my wife or heirs can get access if I'm incapacitated.
I'm currently using Duplicacy to automatically back up to the 1TB of OneDrive storage that comes along with my Microsoft 365 subscription, to my Google Drive, and to my NAS.
I just backup to an external drive once per week, rotating between two drives stored in different parts of the house (one in a box within a bug-out bag). Once per couple of months I rotate one of the drives off site. I've tested and documented the restore procedures, test the integrity of the backups as part of the automated process, which also reports on the health statistics of the drives.
I can afford to lose up to a week's worth of updates at any given time, and expect to at some point. For especially valuable things I sometimes do a midweek backup. The worst-case scenario would be having my house completely destroyed without any chance to even grab the bug-out bag, during the same period as the off-site drive failing without notice. This combination is possible, but seems unlikely.
You can keep copies of passwords in the same locations as you keep cash, important documents, and other valuables. Don't have just one copy, don't keep them in the same place. You can obscure passwords in many different ways: just look at how many documents, receipts, cards, and similar have meaningless identifiers on them.
Total cost: About $600 over the past fifteen years for drives, some hours to refine the backup configuration, about 5 minutes per week of attention, and occasional updates when I rearrange my home network significantly.
wrote a bit about how i do it here: https://w.hutson.gy/projects/home-backups-using-restic
I'm in the process of building my own backup solution.
What I have now are three encrypted external hard drives where I put all the passwords, writing, tax documents, photos, videos, and anything that I want to hold onto. Every three months or so, I will use rsync to update the backups and md5sum to check their integrity. I also have three pen drives that contain my passwords, gpg and ssh keys, and the most important documents. These I backup whenever there's been a few changes to these files and I keep one on my desk, one in my backback, and one in my car.
This setup gives me some reasonable protection from hardware failure. The pen drives also give me a little bit of safety from keeping some data offsite.
All of this is driven using LUKS encryption, rsync, and md5sum because I don't want to worry about tools/formats becoming abandonware and I also want to avoid coding custom solutions as much as possible.
Going forward, I want to:
The computer security expert Thomas Ptacek recommends against online backups.
I think main threat from uploading your backups in his opinion is government-level actors.
Apparently it is difficult to encrypt data such that the big governments cannot eventually break the encryption, and backup services are attractive targets for the big governments.
It's quite feasible to encrypt things with strong passphrases and key stretching that would likely take post-singularity tech to break (just use SRS to memorize the passphrases). You mostly risk it becoming slightly more likely that you'll be ordered to decrypt. If your personal systems that see the passphrases or decrypted data are compromised, then local backups are there too, so also having them in the cloud is not much worse.
I'm currently not happy with how I'm backing up my data. I feel like doing proper databackup is a bit like flossing every day. It's clearly the "right thing to do" but thinking of it feels like a shore that I don't want to deal with. Does anybody have a personal databackup strategy that they are happy with and would recommend?
Criteria I'm thinking about are: