Sync keeps your vault on all your devices. Everything is encrypted on the device before it's uploaded; the server stores only ciphertext and the revision numbers it needs to keep devices in step. MorphGate works fully without sync, and sync only adds to it.
Choose a server
MorphGate syncs through any server that speaks the open vault-sync/v1 protocol:
- morphgate.com, the hosted service. It starts with a free 7-day trial, then needs a plan. See Plans and billing.
- Your own server, such as the free reference server. See Run your own sync server.
The app treats both the same way. A server only ever stores what your device encrypted.
Turn sync on
Do this on the device whose vault you want to keep.
- Open Sync at the bottom of the sidebar (it reads Sync off).
- Under Sync server, keep morphgate.com, or choose Your own server and enter its address. Check shows the server's name and version and whether it accepts new accounts.
- Enter your Email and your master password.
- Choose Enable sync.
- If the server confirms email addresses, it mails you a six-digit code. Enter it and choose Enable sync again. The code works for 15 minutes; send a new code if it expired.
Your master password becomes the sync account's password. It isn't sent: the app sends a key derived from it, and the server stores a slow hash of that. MorphGate creates the account and uploads your vault, encrypted.
For an address on a plain http:// server other than your own computer, MorphGate warns that tokens would cross the network unencrypted. Use https://.
Add another device
A second device joins your sync account from a fresh install:
- On the first-run screen, choose Already use MorphGate sync? Sign in.
- Pick the same server, and enter your email and master password (and a code, if two-step verification is on).
- Choose Sign in. Your hosts and keys download encrypted and are decrypted on this device.
A device that already has a vault of its own can't merge it into an existing sync account. If you try Enable sync with an address that already has an account, MorphGate says so. Decide which vault to keep. On the other device, export anything you need (see Export your data), reset MorphGate by deleting vault.sqlite3 (see Install and update), and sign in.
What syncs
- Hosts, groups, identities, SSH keys, snippets, tunnels, VPN profiles and imported terminal schemes.
- Attachments and session logs, on servers that store files.
- The shared vaults of the teams you belong to.
What doesn't sync: host keys you trusted (each device pins them itself, see SSH keys and host keys), and this device's settings: auto-lock, keychain unlock, the app theme, the terminal font and cursor, and folded groups.
When it syncs
Changes sync within seconds, and MorphGate checks for changes every minute while the vault is unlocked. Sync now in the Sync panel syncs at once. The bottom of the sidebar shows the state: Synced and how long ago, Syncing…, Sync problem or Sign in to sync. The Sync panel shows the server, the account, the last sync and the last error.
MorphGate works offline. Changes you make without a connection are kept and sent the next time a sync succeeds.
Conflicts
If two devices change the same item before they sync, the server keeps the change that reached it first. The other device's version isn't thrown away: it is kept as a separate item with (conflict) after its name, for example a host labelled db (conflict). Compare the two, keep the one you want, and delete the other.
If both devices made the same change, there's no conflict copy.
Deleting
Deleting an item on one device deletes it on the others at their next sync. The server keeps a marker for each deletion for at least 90 days. A device that has been away longer than that downloads the whole vault again when it comes back, which happens by itself.
Limits
- An item can be up to 64 KiB once encrypted. Hosts, keys and snippets are far smaller. Larger things, such as attachments and session logs, are stored as separate files.
- morphgate.com holds up to 10,000 items per vault, and a storage limit for attachments and session logs per account and per team.
- Servers tell the app their own limits.
When a plan ends
On morphgate.com, every device can always read your vault and download from the server, with or without a plan. Sending changes needs a running trial or a plan. If a payment fails, sync keeps working for 14 days while you sort it out. After that, or after the trial, the Sync panel says why changes don't sync. See Plans and billing.
Turning sync off
In the Sync panel, choose Disconnect this device, then Really disconnect?. This device stops syncing. Your personal vault stays on it, and other devices keep syncing. Copies of team vaults are removed from this device, because they belong to the team on the server.
To move to another server, disconnect, then turn sync on again with the new server's address. Your personal vault uploads there in full. Your other devices then join the new server from a fresh start; see Run your own sync server, under moving between servers.
More: Devices, signing in and signing out and What the server can and cannot see.