Varsto is an end-to-end encrypted sync and backup app that uses your own devices and storage services of your choice. A disk, a NAS share, an S3 bucket or any rclone remote; the app encrypts everything on your devices, keeps a signed record of where every block is, and lets devices that are never online at the same time stay in sync through that storage.
Download the alpha Quick start Source on GitHub
Files are cut into content-defined chunks, each encrypted with XChaCha20-Poly1305 under keys derived from your vault. Storage sees opaque objects and sizes, never names, hashes or content. How it all works.
Any directory this device can reach, any S3-compatible bucket (AWS, Scaleway, Hetzner, B2, R2, MinIO) with your own keys, or any rclone remote. Cold storages and archive classes are written but never read without your confirmation.
Each device keeps a signed, encrypted ledger and publishes it through the storage. Edits, deletions and conflicts resolve deterministically; concurrent edits keep both versions, deletions go to a trash.
The background service starts at login, watches folders and syncs within seconds, with no buttons to press; the interface opens in your browser (its own window on macOS), served only to this computer. Updates are checked automatically and offered when a newer version exists.
Placeholders until you fetch; a USB stick that carries only what the other device lacks; a friend's NAS that stores your copies without being able to open them; a folder shared with another user by its key. See Features, Use cases and Screenshots.
Every ledger batch is signed with Ed25519 and ML-DSA-65, and both must verify. A share token is sealed to the recipient's X25519 + ML-KEM-768 key, so it can travel over any channel. Old Ed25519-only batches stay valid through the algorithm identifier they carry.
An MCP server lets the AI assistant of your choice read, analyse and reorganise files in exactly the folders you grant, read-only unless you say otherwise. Varsto itself tracks when files were last used and suggests where idle data is cheapest to keep.
"Two cloud copies and one at home, verified within 30 days." Every device checks it from the ledger and warns, in the app and by notification, before it stops being true.
Your devices exchange encrypted blocks directly, torrent-style: on the LAN automatically, across the internet through NAT with hole punching, and through one of your own reachable devices when punching fails. No trackers, no vendor relay. Blocks are compressed before encryption, so every copy and transfer is small. From a home behind NAT, large files arrived from peers at 8 to 9 MB/s on a 100 Mbit/s line, up to 1.8 times as fast as from the bucket: Benchmarks.
A folder whose key exists only while you touch your FIDO2 security key. Cryptographic, not a dialog: no passphrase, vault key or stolen laptop opens it.
Plug a disk into the dock, add it to the pool, and it fills with what the pool lacks until its reserve. Eject when told, keep it anywhere; when it comes back it is recognised by its marker, checked and topped up. A file whose only copy is on a disk that is away says so: "attach disk data-01 (shelf)".
Administrators approve devices for named people, remove a person with every device of theirs in one step, set what members may do, and keep a signed, chained log of it. A root key on paper appoints administrators. A vault without an organization sees none of it. More.
varsto fsck --verify compares the ledger with what the storage actually holds and re-hashes every object. A device restored from an old backup is detected and fenced.
The iOS build on real devices is next. NAT traversal is built but tested on localhost and the maintainer's own networks only; a vault with every device behind NAT still has no path across the internet.
Varsto is written in Rust, with Swift and Kotlin shells and a plain web interface; the source and the storage format specification are public. Security review, platform work, network and storage testing, packaging and translations are all welcome: how to contribute.
Verify a download: the checksum list is signed with the Varsto release key (see "Verify your download" above): varsto verify-release <file> --github, or minisign and sha256sum -c SHA256SUMS --ignore-missing. varsto update checks the signature and the GitHub release by itself.