rclone crypt: a cloud backup the cloud can't read

your cloud provider is probably your biggest unpatched vulnerability

not because they got hacked. because they don't need to be. if you sync your documents folder to google drive, dropbox, or onedrive in plain form, the provider can read every file. so can anyone with legal access to their servers, any employee with the wrong kind of curiosity, and anyone who compromises your account credentials. the cloud isn't the backup problem. the cloud reading your backup is the problem.

rclone crypt fixes this by encrypting everything on your machine before it ever touches the internet. the provider ends up storing a pile of encrypted garbage that happens to be synced and redundant. you end up with offsite backups nobody but you can read. here's how it actually works and how to set it up.

step 1: add your cloud remote

rclone needs to know where your files are going first. this is just the normal connection to whatever cloud storage you already use.

rclone config

this launches an interactive setup. pick "new remote," name it something like gdrive, choose your provider, and follow the auth flow. this step alone does not encrypt anything, it just gives rclone a plain connection to your storage.

step 2: wrap it in a crypt remote

this is the actual privacy layer. instead of pointing your backups at the raw cloud remote, you create a second remote that sits on top of it and encrypts everything passing through.

run rclone config again, create a new remote, and choose type "crypt." when it asks which remote to encrypt, point it at the one you made in step 1, something like gdrive:encrypted-backup. you'll set a password and an optional salt phrase. write both down somewhere safe that isn't a sticky note on your monitor, because if you lose them, your backups become permanently unreadable, including to you.

you'll also get asked whether to encrypt file names or just file contents. encrypt both. leaving file names in plain text tells anyone browsing your cloud storage exactly what's in there even if they can't open it, which defeats half the point.

step 3: run the actual backup

rclone sync ~/Documents secret:

breaking this down: rclone sync mirrors the source into the destination, ~/Documents is the folder you're backing up, and secret: is the crypt remote you named in step 2. rclone encrypts the file names and contents locally, then uploads the encrypted blobs to your actual cloud storage behind the scenes.

sync is one directional and will delete files on the remote that no longer exist locally, so if you want a safer first run, use rclone copy instead until you trust your setup.

what the provider actually sees

log into your google drive or dropbox account after running this and look at the folder. you'll see a list of files with random-looking names, no readable extensions, no folder structure that matches your real documents, and no way to preview anything. that's the point. the provider is storing ciphertext. they can still see file sizes and upload timestamps, and they know rclone touched their service, but they have zero visibility into what you actually backed up.

a few things to actually check

test your restore before you need it. run a decrypt and compare a file against the original. a backup you've never restored from is a guess, not a backup.

keep your crypt password somewhere durable and offline, like a password manager with its own backup, or written down in a safe place. this is the single point of failure in the whole setup.

if you're on multiple machines, you can add the same crypt remote config to each one using the same password, giving you encrypted access from anywhere without ever decrypting on the provider's end.

the takeaway

offsite backups and privacy used to feel like a tradeoff. either you trust a provider with your data, or you skip the cloud and hope your local drive never dies. rclone crypt removes that tradeoff. the provider becomes dumb storage for encrypted blobs, and you keep the only key. set this up before your next backup cycle, not after someone gives you a reason to wish you had.