NixSCP › Security
We sync your data. We cannot read it.
NixSCP Pro, free during the public beta, is end-to-end encrypted. Your sites, passwords and sessions are encrypted on your computer before they are uploaded, and only your computers can decrypt them.
How it works
- You choose a sync password in NixSCP. It is separate from your account password and it never leaves your computers, not even in hashed form.
- NixSCP derives a key from it with Argon2id (64 MiB of memory, 3 passes), a password-hashing function designed to make guessing attacks slow and expensive.
- Your settings are encrypted with AES-256-GCM using a random 256-bit data key. The data key itself is stored only in encrypted form, locked with your sync password (and, optionally, with your recovery key).
- Only the ciphertext is uploaded, over HTTPS, directly to Cloudflare R2 storage through short-lived signed links.
- Your other computers download and decrypt it with the same sync password. A wrong password simply fails to decrypt.
What we store, and what we cannot see
| Stored on our servers | Readable by us? |
|---|---|
| Your e-mail address | Yes, to sign you in and for support |
| Your account password | No, only a salted scrypt hash |
| Your NixSCP Pro status | Yes |
| Names of your signed-in computers | Yes, so you can sign them out |
| Encrypted snapshots, their size and time | Size and time only; contents are ciphertext |
| Your sync password, data key, sites, server passwords | Never received |
Protection beyond encryption
- Tamper detection. Every snapshot is authenticated, including its account, type and version. A server that tried to swap, replay or roll back your data would be detected and refused by NixSCP.
- No silent overwrites. Uploads carry a version tag: a computer that was offline cannot replace newer settings, and changes made on two computers at once are always shown to you to decide.
- History and backups. The last 30 versions are kept in the cloud, and NixSCP backs up your local settings before it applies settings from another computer.
- Separate passwords. A stolen or reset account password gives access to the website, not to your data.
- Signed-in computers under your control. Sign any computer out from your account page; it loses access immediately.
- Open source. The encryption code is part of the GPL-licensed NixSCP application, open for anyone to review.
Keep your recovery key. Because we never have your sync password, nobody, including NixSCP support, can recover your synced data without it or the recovery key NixSCP shows when you set up syncing. Your settings on your own computers are never affected.
What is synced, and what stays on each computer
Encrypted settings sync covers your sites and site folders, stored passwords, preferences, workspaces, bookmarks, custom commands, transfer presets and the sessions you had open. Window sizes, local histories and other details that only make sense on one computer stay where they are. Your files are never uploaded to us: file transfers always go directly between your computer and your own servers.
Security of your connections
Sync is optional; the free NixSCP application protects your connections on its own, the way WinSCP does:
- SSH host key verification. NixSCP checks the server's host key on every SFTP and SCP connection and warns you when it is unknown or has changed. Hosts you already trust can be imported from OpenSSH
known_hosts. - TLS certificate checks. FTPS and WebDAVS connections verify the server certificate against your system's trusted certificate authorities and ask you before accepting one that does not verify.
- Key-based sign-in. Use PuTTY
.ppk(v2 and v3) or OpenSSH keys and ssh-agent instead of passwords, and reach internal servers through SSH jump hosts. - Master password. Stored site passwords on your computer can be protected with a master password, as in WinSCP.
Infrastructure
Encrypted snapshots are stored in Cloudflare R2. The website and API run behind Cloudflare with HTTPS only. NixSCP Pro is free during the public beta, so no payment details are collected.
Found a security issue? Please write to hello@codewizdev.com.