How StorageSync encryption works

StorageSync is zero-knowledge: encryption and decryption happen only on your devices. The service sees encrypted blobs, sizes and timestamps, and nothing it could use to read your files.

Your master key never leaves your devices unencrypted

When you create an account, your device generates a random master key. Your password is stretched with Argon2id to wrap that key; the server stores only the wrapped key and a verifier it cannot reverse. A separate recovery code wraps the same key, so you can get back in if you forget your password.

Files and names are encrypted separately

Every file gets its own random key. Contents are encrypted in chunks with AES-256-GCM, so large files stream and every chunk is authenticated. File and folder names are encrypted too, which means the server cannot see what you store or how you organize it.

Adding a device

A new device shows a code. You approve it from a device you already trust, which sends the master key over an X25519 key exchange that the server only relays. Signing in with Apple or Google proves who you are; it never gives anyone your keys.

Sharing

A share link carries its decryption key in the part of the URL after #, which browsers never send to servers. Add a password and an expiry, and revoke links at any time.

What we can see

• Your email address and the devices signed in to your account.
• How much encrypted data you store and when it changes.
• Nothing about the contents or names of your files.

Read the privacy policy for the full list.