How to Encrypt Files in Amazon S3 Before Upload (Client-Side, End-to-End)

Why S3's Own Encryption Isn't the Whole Story

Amazon S3 applies server-side encryption to every new object by default. It sounds like the problem is solved — but look at how S3 data actually leaks, and server-side encryption almost never features in the story.

• 🔑 AWS holds the keys — with SSE-S3 (the default) and even SSE-KMS, decryption happens transparently on AWS's side for any principal with access. Encryption at rest protects disks, not access paths.
• 🌍 Misconfigured buckets are the real breach story — years of headline S3 leaks trace back to public buckets and over-broad policies. When access is wrong, server-side encryption hands out plaintext to whoever asks.
• 🧾 IAM sprawl is hard to audit — roles, bucket policies, ACLs and access points interact in ways that are easy to get subtly wrong, especially across accounts and teams.
• 🛠️ Client-side encryption exists, but for developers — AWS's encryption SDKs solve this properly, if you're writing code. For files you just want to store, that's a steep price.
• 📄 Buckets accumulate sensitive exports — database dumps, logs, invoices, customer files. Exactly the material you don't want one policy typo away from public.

What OurClone's Encrypted Vault Actually Does

OurClone's Encrypted Remote gives you client-side encryption on S3 without touching an SDK. It wraps your bucket in a password-only layer: what leaves your computer is already ciphertext.

• 🔐 Encrypted before upload — files are encrypted on your machine; S3 only ever stores ciphertext, regardless of bucket policy.
• 🕵️ Object keys hidden too — file names and contents are both encrypted; a bucket listing shows only scrambled strings.
• 🔑 Your password is the only key — it never enters AWS; no IAM principal, however privileged, can decrypt the vault.
• 🧰 Open format, not lock-in — built on rclone crypt, an open and documented standard.
• 📁 One prefix, not the whole bucket — the vault lives under a folder/prefix you pick; other objects and workloads in the bucket stay untouched.
• ⚙️ Behaves like a normal remote — transfer into it, sync it, mount it, or use it as a backup destination.

The Encrypted Remote is an OurClone Pro feature, and a vault always wraps a plain remote — nesting vaults isn't supported.

How to Create an Encrypted Vault on Amazon S3

You'll need an access key pair; everything else happens inside OurClone.

• 🔐 Connect to Amazon S3 via Access Keys — Open OurClone and go to Add. Select Amazon S3, then enter your Access Key ID and Secret Access Key (created in the AWS IAM console) plus your region. Already connected for backups? Skip ahead.
• 🧭 Open the Encryption Category — In the Add page, the Encryption section sits above the provider grid. Click the Encrypted Remote card (marked Pro).



• 🛠️ Create the Vault — Name it (e.g. s3-encrypted), pick your S3 remote as the base storage, then choose or create a folder inside a bucket — the vault must live in a folder, not the root, and only that prefix will hold encrypted objects. Set your password (plus an optional salt password for extra filename obfuscation) and click Create Encrypted Remote.



• 📦 Move Files Into the Vault — Open Migrate, choose a local folder (or another cloud) as the source and the vault as the destination, then run a copy, move, or sync. Objects are encrypted on the fly as they upload.



• 📊 Watch It in the Task Center — The Task tab shows live progress, speed and any failed files, and history survives app restarts.

Before uploading anything that matters: store the vault password in a password manager. Losing it means the data is gone for good — for you and everyone else.

Check What's Actually in the Bucket Now

Open the S3 console (or any S3 browser) and list the vault prefix: scrambled object keys, no previews, downloads that open as binary noise. If that prefix were ever exposed by a bad policy, this is all anyone would get.

In OurClone, the vault carries a lock badge and the Manage page shows your real file names, decrypted locally. You can also mount the vault as a local drive and browse it in Finder or File Explorer (requires macFUSE on macOS or WinFsp on Windows).

Frequently Asked Questions

Is the encrypted vault free?

No — it's an OurClone Pro feature. Connecting S3, transfers and backups work on the free plan within its limits; see pricing.

How is this different from SSE-S3 or SSE-KMS?

Server-side encryption decrypts transparently for anyone AWS's access control lets in — the security boundary is still IAM. The vault's key lives only on your devices, so access mistakes expose ciphertext, not data.

What if I forget the vault password?

The data is permanently unreadable, by design. No reset, no backdoor — store it in a password manager.

What is the salt password?

An optional second password that strengthens file-name obfuscation. If set, both are required to read the vault — guard them equally.

Can other workloads keep using the bucket?

Yes. The vault claims one prefix. Applications, static assets and pipelines using other prefixes are unaffected.

Does this work with S3-compatible services too?

Yes — the same vault works on any S3-compatible remote you connect in OurClone: Backblaze B2, Cloudflare R2, Wasabi, MinIO, DigitalOcean Spaces and others.