rclone crypt: Client-Side Encryption on Top of WebDAV

When you upload through the LifetimeCloud web app, your browser encrypts every file with your key before it ever leaves your device. WebDAV works differently: it's a generic file-transfer protocol, not a page running your vault's encryption code, so files pushed through it — from rclone, Finder, or Explorer — arrive as plain bytes. If you want client-side encryption on that path too, rclone's crypt backend gets you there.

Why WebDAV uploads aren't encrypted the same way

The in-browser upload flow works because JavaScript in your session derives your AES-256 key and encrypts the file before the upload request is even made — the server only ever receives ciphertext. WebDAV is a different door into the same vault: rclone, Cyberduck, or Finder's "Connect to Server" speak the WebDAV protocol directly to /dav/<username>/, authenticated with your WebDAV token, with no browser and no encryption step in between. That's a deliberate trade-off — it's what makes mounting a real filesystem possible at all — but it means encryption on that path is entirely up to the client.

rclone's crypt remote is built exactly for this: it sits in front of another remote and encrypts file contents and (optionally) filenames before anything is sent onward.

Setting it up

Start from a working WebDAV remote — if you haven't set one up yet, see our WebDAV & rclone mounting guide first. Assume it's named lifetime.

rclone config
# n) New remote
# name: lifetime-crypt
# storage: crypt
# remote: lifetime:Encrypted
# filename_encryption: standard
# directory_name_encryption: true
# password: <set a strong password — rclone will offer to generate one>
# password2 (salt): <optional, adds a second secret>

Two things worth noting in that config:

• remote: lifetime:Encrypted — point crypt at a named folder inside your vault, not the bare lifetime: root. The vault's WebDAV layer supports one level of folders, so keeping encrypted content in its own top-level folder (here, Encrypted) keeps it cleanly separated from anything you upload through the browser.
• The crypt password is separate from everything else. It's not your LifetimeCloud account password and not your WebDAV token — it's a local rclone secret. Store it somewhere durable; LifetimeCloud has no copy of it and can't recover files encrypted with it if it's lost.

Using the encrypted remote

Once configured, use lifetime-crypt: instead of lifetime: for anything you want encrypted before it leaves your machine:

# Copy a folder in encrypted
rclone copy ~/Documents lifetime-crypt:Documents

# Or mount it directly
mkdir -p ~/lifetime-encrypted
rclone mount lifetime-crypt: ~/lifetime-encrypted --vfs-cache-mode full --daemon

Inside the vault itself, these arrive as opaque, obfuscated filenames and unreadable content — exactly as intended. The LifetimeCloud server (and its WebDAV layer) never sees the plaintext.

The trade-offs

For everyday files you browse, preview, and share from the web app, the normal browser-encrypted upload path already covers you — that's what it's designed for. Reach for an rclone crypt remote when you're pushing large batches or backups through WebDAV specifically and want the same guarantee on that path, e.g. as part of a 3-2-1 backup routine.