End-to-end encryption on multiple devices without locking yourself out

With end-to-end encryption you encrypt a folder on your own devices (End-to-end encryption: when to use it, and when not to). Only you hold the key. That's the whole idea, but it also means that if you lose the key, no one can help you, not even WebOké. If you use the encrypted folder on more than one device, follow this approach.

The recovery phrase is everything

When you set up end-to-end encryption on your first device, you get a recovery phrase of twelve words. You use that phrase to bring your key onto any new device.

• Write it down on paper and keep it with your important documents, or store it in your password manager.
• Don't store it in an ordinary file in your Nextcloud, and don't keep it only on the device itself.
• Check that you've copied the words down correctly, including the order.

Approach for a second device

1. Make sure your first device is working properly and that the encrypted folder is complete there.
2. Install the Nextcloud Files desktop app or the mobile Nextcloud app on your second device, and log in with your usual account.
3. Open the encrypted folder. The app sees that encryption already exists for your account and asks for your recovery phrase.
4. Type in the twelve words. The app retrieves your key and the folder can now be read here too.
5. Check on the second device that you can open a few files before you change anything on the first device.

Replacing a device

• Set up your new device first and check that the encrypted folder works. Only then wipe the old device.
• Do you only have one device and are you replacing it? Then make sure you have the recovery phrase to hand before you wipe the old one.
• Afterwards, remove the old device under Devices & sessions (Viewing, revoking, or remotely wiping devices and sessions).

Things you should never do

• Don't click Reset end-to-end encryption under Settings, Security while there are still files in your encrypted folders. Doing so throws away your keys.
• Don't put files you can't afford to lose into an encrypted folder until you've written down the recovery phrase.
• Don't share your account with someone else just to get access to the encrypted folder. Each person should have their own account.

Extra peace of mind: a second copy

If the files are truly irreplaceable, also keep a copy outside Nextcloud, for example on an encrypted USB stick in a safe. That way you're never dependent on a single key.

Tip: Not sure whether you really need end-to-end encryption? For most people, the standard security of your WebOké Nextcloud (encrypted connection, encrypted storage, two-factor authentication) is more than enough. Use end-to-end encryption only for a small folder containing your most sensitive material.