Way to decrypt on a untrusted device

Support
1

Hello, I really enjoyed my first steps lately with SyncThing and am now dwelling into my main use case.

I trust my device A (Windows), but like most, I don’t trust my device B (Android) since it’s far easier to stole it. I set up an encrypted synch from A to B and it works well.

Seldomly, I have a critical need to access some of these files on B without while A is not accessible. I was wondering if there were any way to explore and decrypt temporarily and partially directly on B by using the key I know.

I understand that if I set up a C device I would be able to decrypt on the fly. But I don’t have C device on this use case. But is it possible to make SyncThing think that B is also C, for instance by installing SynchThing twice on the same device? Or is there any kind of explorer Android app that is able to decrypt an encrypted SyncThing folder, given the right key of course?

2

Hmm,

If you have a Samsung Android phone there is an option called secure folder that has its own passcode separate from the passcode that unlocks your phone. You can install the software in there and only you would be able to access it. Someone who stole your phone and had your primary access code to the phone will still not have access to your data.

If you do not have a Samsung phone there are other apps that can also create a secure folder for software that you want to protect from prying eyes on your phone.

As far as an untrusted server decrypting and accessing the data from an encrypted server as far as I know it is not possible. The trusted server will encrypt the data before sending it to the untrusted server and the untrusted server will not have a key to decrypt it.

I looked around for any third party tools that could decrypt the data if it had the decryption keys and found nothing.

The only option that I can think of would be to use encryption software to encrypt your files on each of the servers such as using Cryptomator. Then you would give the theoretical untrusted server the information needed to become my trusted server. At that point all of the data will be decrypted by the synch software but that person will still need the code to decrypt the files that have been synchronized. If a whole bunch of people at location B have access to the directory that has been synchronized they still won’t have access to the data unless they also individually have the decryption code for the files that were encrypted with cryptomator.

3

Thanks for the reply!

I understand the protected folder solution, but I am not sure it is available on my custom ROM, nor that it prevents the system from writing the decrypted content on the phone’s memory (I would prefer it stays in RAM).

I indeed considered Cryptomator, which is a paid solution and not as cool as Syncthing.

I am currently considering vibe coding a simple Android app that runs the “syncthing decrypt” command. I do a have a POC that works, but it’s a bit long to decrypt let’s say 1500 files before exploring the folders that hold them. I wish there was a way to decrypt the file tree only, exploring it then run the command a second time to decrypt only the chosen file. I am not sure the command allows that.

4

Hi,

Cryptomator creates what they call a vault and you have to put files in the vault for them to be encrypted. I have and use another software program that encrypts them individually without putting them in of dedicated vault.

You use whatever file folder structure you wish and put the encrypted files in whichever folders you wish you can even mix them with an encrypted files.

Anyone with a copy of the software and the password can decrypt any files that they need to..

The encrypted files can be located in any folder on the drive they do not have to be grouped into one subfolder.

I do Cloud to Cloud backup for my data and I use this software to copy the data from my day-to-day document folder on Cloud Drive to an encrypted folder on my backup cloud drive B.

It sucks that the mobile product is so expensive. The prices got raised by a wide margin in 2026.

Last fall they had a sale and we’re offering the client for I think under $20 but that’s long since gone now.

I primarily use the desktop version which is free.

The other app is called rclone.

  1. Create a remote to your cloud drive.
  2. Create a remote of type crypt pointing or referring to the first remote.
  3. Mount the crypt remote and any files that you copy into that mount point will be encrypted and the files will be encrypted individually not in a group. I would suggest not scrambling the file names or directly names but to have it put a dot bin on the end of the file otherwise you won’t know what you’re looking at without looking at the mount point for the decrypted files. You can do it that way or you can do it the same way they do it in the other app Cryptomator. Works similar to Cryptomator in that regard.

This way in this configuration you have no untrusted servers. It’ll be relying on the rclone file encryption.

Anyone who mounts the cloud drive with the crypt remote will see all of the files on the drive those that are encrypted and those that are not.

I can assist with rclone if you need any help getting started.

The best parts are that it works on Windows Mac and Linux and it’s only a single executable file on Windows and on Linux I recommend using the automatic installation script located on there Download page. Most distros install an outdated version that can’t be upgraded.

If the person that you want to give access to is on Windows for example all you have to do is send them a zip file with the single executable a config file and a batch file that they can run.

There is a free mobile app actually two of them that offer different features that include rclone and be capable of decrypting files on cloud drives and it is free.

5

Due to virtual memory, there’s no guarantee that the decrypted content stays in RAM (some, or all, of it may be stored in local storage at any time – even when the phone is powered down).

Android 5.0 and up support either full-disk or file-based encryption, so unless it and lock screen security have been disabled, or there’s a special need, another layer of encryption may not be necessary.

6

Honestly, this feels like a simple distinction. If you’re going to decrypt files on the device, it’s not untrusted. It becomes a trusted device at that point, or you shouldn’t be decrypting files on it.

7

That’s a great remark!

I’m not receptive to the binary view of the issue like calmh’s one. I understand that decrypting one file compromise it, from a theoretical point of view, as well as a practical one as pointed out by gadget. But as far as I know, all the other files are still encrypted. In my use case, it’s better to access and compromise a specific file than 1) having all unencrypted files or all of them encrypted with absolutely no access.

Of course I trust my device which has storage encryption enabled by default. But the reason I’m considering this setup is that I frequently visit a country where phone stealing is as frequent as identity theft. One may find a way or force me to unlock my phone (so to decrypt the memory), but might not be able to go through the second layer I’m trying to build, because it requires time, specific knowledge of the app, the mean to launch it, the folder ID, the key etc.

It’s just a way to filter “dumb” aggressors and a little project of me to discover vibe coding and the fundamentals of Syncthing. :wink: