Sync and teams
Your devices and your team share a vault through xqsyncd, a server you run. It stores ciphertext it cannot read or change. Connections of every protocol sync the same way, and plugins can sync files of their own.
How it works
| Step | What happens |
|---|---|
| 1. Run the server | xqsyncd on Windows or Linux, or the container image. It prints a connect link with its fingerprint |
| 2. First device | Paste the link in Settings → Sync. The application checks the fingerprint itself. Choose a sync password of 12+ characters |
| 3. Further devices | Sign in with the sync password. Devices already signed in announce the new one |
| 4. Daily use | Changes travel encrypted and signed. Offline edits merge field by field |
Sync is off until you turn it on and requires a master password of at least 12 characters.
Devices
Every device lists the others and can remove one, which replaces the account keys so the removed device can read nothing written afterwards. Not mine, remove it also replaces the sync password in the same step, so whoever typed it cannot sign a device in again.
Conflicts and guarded changes
- Edits to different fields merge. The same credential edited on two devices becomes a conflict you resolve; until then the sync indicator is red and says why.
- A change from another device that would weaken this one waits for this device's master password: disabling plugin signature checks, loosening the lockout, replacing or deleting a known host key, a peer identity or a key.
Trash and Shred now
A deleted item stays in the trash for the retention window, 30 days by default, and can be restored. Then it is purged from the server, and within one and a half windows more the keys that covered it are destroyed on every device. Shred now does all of it at once.
Teams
Roles
| Role | Use connections | Add, change, move |
|---|---|---|
| Admin | Yes | Yes, and manages the team |
| Editor | Yes | Yes |
| Viewer | Yes | No |
Inviting
The invitee sends their contact code, xqs-member:name#fp=…. The application compares it with the key the server reports for that account; a mismatch leaves nothing to invite. The invitee sees your fingerprint and accepts; nothing reaches their tree before that.
Credentials stay personal
A team shares connections, not secrets. Each member links their own key or password. If a member changes a shared connection's address, every other member's link is suspended until they confirm, so no password follows a connection to a host its owner did not choose. Removing a member moves the team to new keys.
The server
| Package | Platform |
|---|---|
xqsyncd-1.5.0-windows-amd64.zip | Windows x86-64 |
xqsyncd-1.5.0-linux-amd64.tar.gz | Linux x86-64 |
xqsyncd-1.5.0-linux-arm64.tar.gz | Linux ARM64 |
ghcr.io/teoritty/xqsyncd | Container, linux/amd64 and linux/arm64 |
docker run -d --name xqsyncd --restart unless-stopped -p 8443:8443 -v xqsyncd-data:/data \ ghcr.io/teoritty/xqsyncd:1 serve --dir /data --addr :8443 --init --host sync.example.org
Tags: 1.5.0 pins this release, 1.5 follows patches, 1 follows minors, latest follows everything.
Running it as a service, in Docker, and backing it up: Sync Server guide. Protocol design: ADR-023.