Remote Storage Encryption Guide

Configure encryption for cloud storage remotes

What You'll Learn
  • Understanding remote encryption options
  • RClone-compatible encryption modes
  • Setting up encrypted remotes
  • Searching encrypted file names
  • Best practices for encrypted storage

Why Encrypt Remote Storage?

When you encrypt files with tools like RClone before uploading to cloud storage, the file names become gibberish. FileFortress can decrypt these names locally, letting you search your encrypted files by their real names.

Encryption Modes

RClone Standard

Full compatibility with rclone's standard encryption (EME mode). File names are encrypted using AES-SIV.

Best for: Users with existing rclone-encrypted storage

RClone Obfuscate

Compatible with rclone's obfuscation mode. File names are obfuscated but not fully encrypted.

Best for: Simpler setup, less secure

None

No file name encryption. File names are stored as-is.

Best for: Unencrypted cloud storage

Setting Up Encrypted Remotes

Adding with RClone Standard Encryption

# Add encrypted remote
filefortress remotes add my-encrypted-drive \
  --provider s3 \
  --encryption-type RCloneStandard \
  --encryption-password "your-rclone-password" \
  --encryption-salt "your-rclone-salt"

Finding Your RClone Credentials

Your rclone password and salt are in your rclone config file:

# View rclone config
rclone config show

# Look for these fields in your crypt remote:
# password = xxx (base64 encoded)
# password2 = xxx (salt, base64 encoded)
Important

The password in rclone config is base64 encoded. You must decode it before using it with FileFortress. Use echo "xxx" | base64 -d (Linux/Mac) or [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("xxx")) (PowerShell) to decode.

Searching Encrypted Files

Once configured, search works normally - FileFortress decrypts file names locally:

# Search by real file name (decrypted locally)
filefortress search "vacation photos" --remote my-encrypted-drive

# Filter by extension
filefortress search --filter "extension:mp4" --remote my-encrypted-drive
Zero-Knowledge

Decryption happens locally on your device. FileFortress servers never see your decrypted file names or encryption keys.

Downloading and Decrypting Files

Searching is only half the story - you can also pull an individual file back down with files download. For RClone Crypt remotes, FileFortress decrypts the contents locally as the file downloads, so what lands on your disk is the real, readable original:

# Download a file and decrypt its contents locally
filefortress files download my-encrypted-drive "Photos/2024/vacation.jpg"

Decryption uses the password you configured and happens entirely on your device. Remotes using FileFortress's own AES-256-CBC encryption can be browsed and searched today; downloading their decrypted contents is coming in a future release.

Related Articles