Turn on end-to-end encrypted sync between two devices

In this tutorial you create a Sternway account on a sync server from your computer, keep its recovery kit somewhere safe, sign in on a second device, and watch a change made on one device show up on the other. Your hosts, keys and passwords are encrypted on each device before they are sent, so the server stores only data it cannot read.

What you need

• The desktop app with at least one saved host, as in Connect to your first host on the desktop.
• A second device with Sternway: another computer, or an Android phone as in Connect to your first host on your phone.
• The address of a Sternway sync server, starting with https://. Sternway has no built-in server: it is one you or your organisation runs. Run your own sync server sets one up.

Note

The phone app only talks to a server over https://. The desktop app also accepts http://, but only for a server on the same computer.

1. Create the account on the first computer

1. Open Settings › Account & Sync. It says Not signed in.
2. Choose Create account.
3. Fill in:
   • Server URL: your server’s address, for example https://sternway.example.com.
   • Email and Name: your email address on that server, and the name teammates will see.
   • Password and Confirm password: at least 8 characters.
4. Choose Create account.

This password does two jobs. It signs you in, and it is the source of the key that encrypts your data on your devices. It never leaves the device: the server receives a key derived from it, not the password itself. That is also why the server cannot reset it for you.

The hosts you already had on this computer move into the account, and the first sync uploads them, encrypted.

2. Keep a recovery kit

If you forget the password, a recovery kit is the only way back to your data. Make one now.

1. In Settings › Account & Sync, open Recovery kit and choose Create recovery kit.
2. Sternway shows a recovery key, once. Choose Print, or Save as file… and keep the file somewhere offline, such as a USB stick or a password manager you trust.
3. Tick I’ve printed or saved my recovery kit and choose Done.

3. Sign in on the second device

On the second computer, or on the phone:

1. Open Settings › Account & Sync and choose Log in.
2. Type the same Server URL, Email and Password.
3. Choose Log in.

The first sync downloads your data: the phone shows Downloading your data…, then the number of items. Open Hosts: the hosts from the first computer are there, with their logins and keys.

If the second device already had hosts of its own, they are added to the account too; nothing on either device is replaced.

4. Watch a change travel

1. On the first computer, open a host’s editor and change its Label, for example to web-01 (prod). Choose Save.
2. Look at the second device. Within a few seconds the host has its new name.

While both apps are open and unlocked they keep a connection to the server, so changes arrive at once; otherwise each app syncs when it starts, after each change and every minute.

5. See your devices

On the computer, in Settings › Account & Sync, open Devices. Both devices are listed with the time each was last seen. Revoke signs a device out of the account, for example a laptop you lost; the hosts and keys already on it stay on it.

What you did

You created an account on a sync server, made a recovery kit, signed in on a second device, and saw an edit reach it. Each device encrypted its changes with your vault’s key before uploading them; the server stored them without being able to read them.

Next

• How sync and conflicts work: what happens when two devices edit the same host.
• How the end-to-end encryption works.
• Set up a team and share a vault.
• No server? Sync through a folder uses Dropbox, OneDrive, Syncthing or a network share instead, with no account.