SSH credentials and backups with Zync Vault

Setting up a second computer often starts with a familiar question: where did I save that server’s key? The host address is in one place, the private key is somewhere else, and a working connection on the old laptop does not explain which pieces the new one needs.

Zync separates this into two jobs. Vault organizes credentials on your device. Sync & Backup optionally carries selected encrypted data through your own Google Drive. You can use the first without the second.

Start with a local vault

The Vault stores SSH passwords and imported private keys encrypted on your computer. A saved host points to a credential, so you can reuse one credential across the hosts that actually share it instead of maintaining separate copies.

For example, you could name an existing key Staging SSH key and assign it to two staging hosts. That organizes access already granted by your servers; it does not create accounts or install public keys on them.

To get started:

1. Open Vaults in the sidebar and create a strong passphrase.
2. Save the vault recovery key somewhere safe, separate from the computer you are protecting.
3. Add a password or private key, then select that credential in a host’s authentication settings.
4. Connect explicitly and unlock when prompted.

You do not have to import your keys. Zync also supports SSH key files kept at their existing paths. Choose the approach that fits your workflow. The Vault guide and connection settings explain both options.

Remembering a device is a convenience choice

Remember on this device stores unlock material in the operating system credential store. That can reduce repeated prompts on a personal laptop, but someone using your unlocked operating-system session may also be able to use remembered credentials.

The Vault’s Lock action clears the in-memory unlock; it does not remove the remembered-device entry. Use Forget device when you want to remove that remembered access, and protect the operating-system account itself.

Add Google Drive only when you need it

You do not need a Google account to use the local Vault. When you want an encrypted copy of supported data outside the device, open Sync & Backup and connect Google Drive.

This is Google Drive storage, not a Google Cloud project. Google Drive is the currently supported sync provider. Zync requests access to its hidden app-data area and your account email, rather than general access to your Drive documents.

After connecting, set up sync encryption. You can reuse the local vault passphrase text or choose a separate Google Sync passphrase. Either way, the Drive collection has its own encryption key. Save its provider recovery key too.

Connecting Drive does not upload your workspace. Choose the data you want and run an upload explicitly. Upload and restore are manual actions today; there is no background auto-sync scheduler.

Know what travels between devices

Sync is not a complete copy of your computer. These are the supported categories and their important boundaries:

Data	What to expect
Vault credentials	Supported credential records can be uploaded and restored. AI provider API keys remain local.
Hosts	Connection details, tags, folder references and credential references. This does not back up the complete folder structure or empty folders. Host records exclude plaintext passwords and local private-key paths.
Tunnels	Saved port-forwarding definitions, not running connections.
Snippets	Global and host-scoped commands.
Settings	Selected preferences, including fonts and supported theme selection. Custom keyboard shortcuts are not synced.

Imported custom themes do not travel through settings sync. Export and import their theme JSON separately. AI provider API keys are also excluded from full-vault backup exports, not just individual credential sync.

If a host uses a key file on your old computer, restoring the host will not copy that file. Arrange the key securely on the new device and select its local path, or intentionally use a vault-backed credential. A restored host entry is not proof that authentication is ready.

Set up a second device

Start with one non-critical connection so you can check the whole process before relying on it.

1. On the original device, upload the hosts and their supported vault credentials in Sync & Backup. Upload tunnels or snippets too if you want them on the new device. Check each upload result.
2. On the new device, create or unlock its Local Vault if you intend to restore credentials.
3. Connect the same Google account in Sync & Backup and unlock the existing collection using its Google Sync passphrase or provider recovery flow.
4. In Sync & Backup → Connections, open Options for Hosts & related data. Include the referenced credentials and any available tunnels or host snippets you need.
5. Select Restore, review the preview and any reported conflicts, then confirm the data you intend to apply.
6. Open a restored host and connect explicitly. Unlock the Local Vault if prompted, verify the server identity through your usual trusted process, and test access.

Connection restore pulls the credentials referenced by the restored hosts when that option is selected. To restore the wider credential library, use Vault credentials → Restore. Normal credential restore imports records into the current Local Vault.

Upload again after important changes, and test a restore before retiring the original device. See Sync & Backup for the restore controls.

Browse remote hosts before restoring

You can see which hosts are available in Drive without restoring the entire collection. Connect Google Drive, unlock its encryption, then refresh All Hosts. Remote entries appear alongside local hosts.

Listing a remote host does not save it on this device or connect to its server. Choose Keep on this device when you want a local copy of one host, or Keep and open to keep it and open its session. Its referenced credential must also be available locally or restored through the connection flow before authentication can succeed.

This lets you inspect the remote list first and bring across only the hosts you need.

Keep the two recovery paths separate

The Local Vault protects this device’s credentials. The Google Sync collection protects the encrypted data in Drive. They have separate keys and separate recovery paths, even when you chose the same passphrase text for both.

If you need to unlock	Keep this recovery material
Local Vault	Its vault passphrase or vault recovery key.
Google Sync collection	Its Google Sync passphrase or provider recovery key.

Signing into Google does not replace the sync passphrase. A provider recovery key cannot unlock the Local Vault. Do not assume that changing the local vault passphrase changes the existing Drive collection’s passphrase.

If both unlock methods for a vault or collection are lost, Zync cannot decrypt that data for you. Store recovery material somewhere you can reach without first unlocking the thing it is meant to recover.

What the encryption does and does not promise

The Local Vault uses Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption. Sync records are encrypted in the app before upload to Google Drive; Zync does not maintain a hosted copy of your collection.

Encryption at rest does not protect secrets from someone already controlling your unlocked device. Remembered unlock material, operating-system security and recovery-key handling still matter. The security guide explains the boundaries.

Also, changing a saved credential in the Vault does not rotate a password or authorized key on a server. Make the corresponding server-side change through your normal administration process.

When something is missing

No hosts appear in the remote list or restore preview

Check these in order:

1. Confirm that both devices are connected to the same Google account.
2. In Sync & Backup, unlock the existing Google encryption collection. Signing into Google alone cannot read its encrypted records.
3. On the original device, confirm that hosts were uploaded successfully. Uploading only credentials does not create remote host entries.
4. Refresh All Hosts, or run Connections → Restore again to load a fresh preview. Clear any host search or filters that hide the entries you expect.

If the app reports that files were found but could not be decrypted, follow the reported encryption error. A new collection key created after a reset cannot decrypt an older collection, even if you reuse the same passphrase text. Recover access to the original collection with its unlock material or a device that still has the key.

The host appears but cannot authenticate

Review the host’s authentication settings. For a vault-backed host, unlock the Local Vault and restore its referenced credential using the connection restore options. For a key-file host, configure the key’s path on this computer. The host list alone does not supply either secret.

Restore is unavailable

Check the status message in Sync & Backup: Google Drive must be connected, sync encryption must be configured and unlocked, and the relevant data category must be enabled. Restoring credentials also requires an unlocked Local Vault.

Start with a named credential and one host. Once you can restore and connect from another device, expand the backup to the other supported data you actually need.