Chapter 3 · 3.9
End-to-end encryption: when to use it, and when not to
Your files are already well protected with WebOké: the connection is encrypted and so are the disks in the data centre. Still, for really sensitive folders, you can go one step further with end-to-end encryption. Then files are encrypted on your own device before they're sent to your Nextcloud. Only your devices hold the key. Not even WebOké can read those files.
When is it useful?
- For a small folder with highly sensitive material, such as scanned passports, medical records or password lists.
- If you want to be absolutely sure that no one but you can open the files, not even someone with access to the server.
When not to use it
End-to-end encryption has its limitations. So don't use it for your whole Nextcloud, and not for folders where you collaborate with others.
| What | In an encrypted folder |
|---|---|
| Editing files in your browser with Euro-Office | Not possible |
| Creating a public link and collaborating in the browser | Not possible or very limited |
| Searching content, previewing photos in the browser | Not possible |
| Turning on encryption | Only in the desktop app or the mobile app, not in the browser |
| Viewing files in the browser | Only if you turn this on first, see below |
| Losing your recovery phrase and no device left with the key | Files are permanently unreadable, even for WebOké |
How to turn it on
- Install the Nextcloud Files desktop app (Installing Nextcloud Files on Windows or Installing Nextcloud Files on Mac (File Provider)) or the Nextcloud app on your phone.
- Create a new, empty folder in your Nextcloud. Only an empty folder can be encrypted.
- In the app, select encryption for that folder. The first time, the app generates your keys and shows you a recovery phrase: a sequence of twelve words.
- Write down the recovery phrase and keep it somewhere safe, separate from your computer. Without that phrase, you won't be able to open your files on a new device.
- Then put your sensitive files in the folder.
If you want to use an encrypted folder on more than one device, read End-to-end encryption on multiple devices without locking yourself out first.
What you see in the browser
Under Settings, Security, you'll find the End-to-end Encryption section. As long as you haven't set it up in an app yet, it will say that it's turned off and that you set it up using the Nextcloud apps. The Enable E2EE navigation in browser button (1) lets you also open and view encrypted folders in the browser.
Please note: Don't click Reset end-to-end encryption if you already have encrypted folders. Doing so discards your keys, and those files can no longer be opened.