Sync
Sync your vault across devices — QubKey account, selective sync, and conflicts.
QubKey sync exchanges vault changes across your devices via QubKey cloud. The vault stays encrypted: the service never sees plaintext secrets.
Setup: Settings → Sync. The vault must be open and unlocked, with a signed-in QubKey account.
Self-hosting the sync service will soon be available for download — until then, use QubKey cloud (or a manual copy of the .rkvey file).
Same vault file on every device
Important
Each vault file has its own cloud history. Two different .rkvey files do not share the same entries, even with the same QubKey account. To see the same data everywhere, use the same vault file (or a copy) on each device.
Enable and use sync
Choose QubKey cloud
Select Use cloud (QubKey). Self-hosting will soon be offered as a download; until it ships, cloud is the recommended path.
QubKey account
Sign in to your QubKey account if needed — sign-up or sign-in, then device registration.
Enable
Click Enable sync. Status becomes Enabled / Connected.
Sync now
Use Sync now for an immediate exchange. A message shows the result (operations received / sent, or “nothing new”). Last sync appears in the status banner.
Auto-sync on open
Auto-sync on open runs a background sync after open or unlock. Turn it off to sync only with the manual button.
Disable
Disable sync asks for confirmation. Server settings are kept; sync stops until you enable it again.
Account and devices
Service architecture
Cloud sync architecture
Encrypted vault data travels over HTTPS; the service stores opaque encrypted operations
Desktop app
- Encrypts snapshots locally
- Signs updates
- Master password never leaves the device
Reverse proxy (HTTPS)
- HTTPS termination
- Forwards traffic to the sync service
- Technical access logs
Sync service (Rust · Docker)
- Runs in a Docker image (isolation)
- Accounts, sessions, and devices
- Does not decrypt vault contents
PostgreSQL
- Accounts (email)
- Encrypted sync operations
- Encrypted share envelopes
Self-hosting will soon be available for download. On QubKey cloud, the service already runs in Docker for isolation, behind a reverse proxy, with PostgreSQL.
QubKey cloud is organized as follows:
- Desktop app — encrypts snapshots locally, signs operations, keeps the master password on the device.
- HTTPS reverse proxy — securely exposes the API and forwards to the service.
- Sync service written in Rust, running in a Docker image for isolation — QubKey account auth, sessions, devices, storage of operations without decrypting them.
- PostgreSQL — accounts (email), linked vault state, encrypted payloads.
Coming soon
Self-hosting the service (ready-to-install package) will soon be available for download. Docker already isolates QubKey cloud — it is not yet a public self-hosted offering.
Selective sync
Selective sync limits what goes to the cloud: filters by folder, tag, or exclusion of specific entries. The rest of the vault stays local.
Use cases: skip a work/personal folder, exclude sensitive entries, or limit a secondary device.
In Settings → Sync → Selective sync: add a filter, enable/disable it, or remove it. “No filters” means the whole eligible vault can sync.
Conflict resolution
A conflict appears when the same entry diverged locally and remotely (long offline edits on two devices).
Open Conflict resolution: compare local / remote, then Keep local, Keep remote, or Merge when offered.
Tip
Best practice: sync regularly and avoid long offline edits on two devices at once.
What the service can see
The service can see your QubKey account email, the list of devices, the technical id of the synced vault, and metadata (timestamps, counters). It cannot read entry titles or contents.
Details across surfaces (sync, links, user-to-user): What the servers can see.
Troubleshooting
Vault locked
Unlock the vault before configuring or syncing.
Missing account
Sign in to a QubKey account for cloud sync.
Account or network
Check your internet connection and that your QubKey account is signed in on this device.
Disconnected
Check the network, then try Sync now again.
Incompatible formats
All devices must use the same vault format generation. After an upgrade, open and sync each device.
Alternative
Sync is optional. You can also copy the .rkvey file manually. See Local-first.