Crypt Drive Sync

Sync your Obsidian vault across all your devices — Mac, Windows, Linux, iPhone, iPad, Android — through your own Google Drive, with end-to-end encryption. Google stores only encrypted files: no note names, no text.

The encryption format is rclone crypt, so your synced vault is also readable, checkable and restorable with plain rclone on any computer — no lock-in to this plugin.

Features

• Works inside Obsidian on every platform, including mobile. No server, no extra app.
• Encryption happens on your device before anything is sent. The password never leaves the device.
• Your own Google Cloud client: no shared app, no third party between you and Google.
• Guided setup with links for every step: create the client, sign in, choose a password, pick a folder.
• Safe by design:
  • a conflict keeps both versions;
  • deletions go to a dated trash folder in the cloud, never deleted for good;
  • the first sync only merges;
  • a sync that would delete many files stops and asks;
  • a wrong password stops sync instead of creating a second, unreadable copy.
• English and Russian interface (follows Obsidian's language).

Disclosures

• Network use. The plugin connects to Google only:

  • oauth2.googleapis.com — to sign in and refresh the sign-in;
  • www.googleapis.com — Google Drive API, to store and read your encrypted files.

  Signing in opens google.com/device in your browser, where you paste the code. There are no other servers, no analytics, no telemetry.

• Account required. You need a Google account (a free one works; storage counts toward your Google quota) and your own free Google Cloud OAuth client (created once in about five minutes; the plugin walks you through it).

• Access scope. The plugin requests drive.file: it can see only files it created itself. The rest of your Google Drive is invisible to it.

• Vault access. To sync, the plugin lists and reads every file in the vault (except dot-files such as .obsidian) and writes files it downloads. Nothing outside the vault is touched.

• Clipboard. The plugin only writes to the clipboard: the Google sign-in code, when you press “Copy code and open Google”. It never reads the clipboard.

Privacy policy: https://mooncodee.github.io/crypt-drive-sync/privacy.html

Release builds are produced by GitHub Actions from this repository and carry build provenance attestations: gh attestation verify main.js -R mooncodee/crypt-drive-sync.

How it works

1. Notes are encrypted on the device with a key derived from your password:
   • file contents with XSalsa20-Poly1305;
   • file and folder names with AES-EME;
   • the key comes from scrypt — exactly as rclone crypt does it.
2. Encrypted files go to a folder in your Google Drive (default crypt-drive-sync/).
3. Each device remembers what it last synced and compares three states — this device, the cloud, the last sync — to decide what to upload, download, or move to trash.

Your password and Google sign-in are kept in Obsidian's secret storage on each device, separately for each vault. They are never synced and never sent anywhere. The password cannot be recovered — without it the encrypted notes cannot be read.

Install

• Community plugins: Settings → Community plugins → Browse → search “Crypt Drive Sync”.
• Manual: copy main.js, manifest.json and styles.css from the latest release into <vault>/.obsidian/plugins/crypt-drive-sync/.

Set up

Enable the plugin — the setup wizard opens by itself. Allow about ten minutes the first time and two on each next device:

1. Google Cloud client. Google requires every app to have its own OAuth client, so you create one for yourself. It's free, takes about five minutes, and the wizard links each step:
   • create a project and enable the Google Drive API;
   • if Google shows “Get started”, fill it in first (app name, your email, External);
   • fill in Branding: any app name, your email, and homepage and privacy-policy links — any public pages work, e.g. the plugin's homepage and privacy policy;
   • on Audience, press Publish app — otherwise Google expires the sign-in every 7 days. Publishing doesn't make it public: only you know the client ID;
   • create a client of type TVs and Limited Input devices and copy its ID and secret.
2. Sign in — the code is copied for you and google.com/device opens in your browser; paste the code and press Allow.
3. Where to store — a folder in your Google Drive (default crypt-drive-sync) and the vault's name inside it (default: the vault's name).
4. Password — encrypts your notes; checked against the cloud right away. Then the first sync, which only merges.

On every other device: install the plugin and go through the same steps with the same client, password and folder name.

Sync then runs by itself:

• on startup;
• every 10 minutes;
• 30 seconds after an edit;
• when you return to the app (its window becomes visible again).

The ↻ ribbon button and the status bar item sync immediately.

Using it with rclone

If you already use an rclone crypt remote on Google Drive, the plugin can share it. Example config:

[drive]
type = drive
scope = drive.file
client_id = <your client id>
client_secret = <your client secret>

[crypt]
type = crypt
remote = drive:encrypted
password = <obscured>

Set up the plugin with:

• Where to store → Folder in Google Drive: encrypted;
• Encryption password: the same password as the crypt remote.

The vault then appears as crypt:<vault name>. Check it with:

rclone cryptcheck <local vault> crypt:<vault name>

Google's drive.file scope is per Google Cloud project, so the plugin can see a folder created by your rclone only if both use the same project: create the plugin's “TVs and Limited Input devices” client in your rclone's project.

Limitations

• Not real-time: sync runs on the triggers above (mobile apps are suspended in the background).
• Files over 50 MB are skipped by default: on mobile a file must fit in memory. The limit is configurable.
• A rename syncs as delete + create (the old name goes to the cloud trash).
• Obsidian's own settings folder (.obsidian) and other dot-files are not synced.

Removing the plugin

The password, the Google sign-in and the client secret live in Obsidian's secret storage, which uninstalling a plugin doesn't clear. First choose Advanced → Reset setup on this device, then uninstall. Revoke access at myaccount.google.com/permissions; delete the plugin's folder in Google Drive to remove the encrypted copy.

Build from source

npm install
npm test          # includes byte-for-byte compatibility tests against real rclone (run tests/make-fixtures.sh once)
npm run build

Optional, for private builds only: place google-client.json (the JSON downloaded for a “TVs and Limited Input devices” client) next to package.json to bake that client in, so the people you give the build to can skip step 1. It is never part of the repository, and public releases are built without it.

License

MIT