Why Long-Lived Wasabi Archives Need Client-Side Encryption
Wasabi sells one thing well: S3-compatible hot storage at a flat, predictable price with no egress fees. That economic profile shapes how people use it — and what the risks look like.
- 🔑 Server-side encryption, Wasabi's keys — objects are encrypted at rest, but decryption is transparent for any request with valid credentials. The encryption protects Wasabi's disks, not your account.
- 🗄️ Cheap storage accumulates everything — at a flat per-TB rate, nobody prunes. Wasabi buckets tend to hold years of backups, exports and media whose sensitivity nobody remembers.
- 🧾 Access keys spread across tools — Wasabi credentials get pasted into NAS backup apps, sync tools and scripts; any one of them leaking exposes every object the key can read.
- 🌍 S3-style misconfiguration applies here too — Wasabi buckets can be made public, and policy mistakes look exactly like the classic S3 leak stories.
- 🔒 Immutability protects against deletion, not reading — Wasabi's object lock stops ransomware from destroying backups, but it does nothing to stop anyone with access from reading them.
What OurClone's Encrypted Vault Actually Does
OurClone's Encrypted Remote puts a password-only layer between your files and Wasabi: what leaves your computer is already ciphertext.
- 🔐 Encrypted before upload — files are encrypted on your machine; Wasabi only ever stores ciphertext.
- 🕵️ Object names hidden too — file names and contents are both encrypted; bucket listings show only scrambled strings.
- 🔑 Your password is the only key — it never reaches Wasabi; a leaked access key can copy the vault but decrypt none of it.
- 🧰 Open format, not lock-in — built on rclone crypt, an open and documented standard.
- 📁 One prefix, not the whole bucket — other folders and the tools writing to them stay untouched.
- ⚙️ Behaves like a normal remote — transfer into it, sync it, mount it, or use it as a backup destination.
The Encrypted Remote is an OurClone Pro feature, and a vault always wraps a plain remote — nesting isn't supported.
How to Create an Encrypted Vault on Wasabi
A Wasabi access key pair is all you need to start.
- 🔐 Connect to Wasabi via Access Keys — Open OurClone and go to
Add. Select Wasabi, then enter your Access Key ID and Secret Access Key (created under Access Keys in the Wasabi console) plus your region endpoint, e.g.s3.wasabisys.com. Already connected for backups? Skip ahead. - 🧭 Open the Encryption Category — In the
Addpage, the Encryption section sits above the provider grid. Click the Encrypted Remote card (marked Pro). - 🛠️ Create the Vault — Name it (e.g.
wasabi-encrypted), pick your Wasabi remote as the base storage, then choose or create a folder inside a bucket — the vault must live in a folder, not the root, and only that prefix will hold encrypted objects. Set your password (plus an optional salt password for extra filename obfuscation) and click Create Encrypted Remote. - 📦 Move Files Into the Vault — Open
Migrate, choose a local folder (or another cloud) as the source and the vault as the destination, then run a copy, move, or sync. Files are encrypted on the fly as they upload. - 📊 Watch It in the Task Center — The
Tasktab shows live progress, speed and any failed files, and history survives app restarts.
Put the vault password in a password manager before the first big upload — losing it makes the archive permanently unreadable.
Check What Wasabi Actually Stores Now
Open the Wasabi console and browse the vault prefix: scrambled object names and contents that download as noise. If an access key leaks from a backup tool tomorrow, this is all it can fetch.
In OurClone, the vault carries a lock badge and the Manage page lists your real files, decrypted locally. You can also mount the vault as a local drive and browse it in Finder or File Explorer (requires macFUSE on macOS or WinFsp on Windows).
Frequently Asked Questions
Is the encrypted vault free?
No — it's an OurClone Pro feature. Connecting Wasabi, transfers and backups work on the free plan within its limits; see pricing.
What if I forget the vault password?
The data is permanently unreadable, by design. No reset, no backdoor — store it in a password manager.
What is the salt password?
An optional second password that strengthens file-name obfuscation. If set, both are required to read the vault — guard them equally.
How is this different from Wasabi's own encryption?
Wasabi encrypts at rest with keys it manages and decrypts transparently for any valid request — the security boundary is your access key. The vault's key exists only on your devices, so a leaked key or public bucket exposes ciphertext.
Does this work with object lock and versioning?
The vault writes ordinary objects, so bucket-level features like versioning and object lock keep applying — they protect the ciphertext against deletion while the encryption protects its contents against reading.
Can I open the vault from another computer?
Yes — install OurClone, connect the same Wasabi account, and add an Encrypted Remote pointing at the same folder with the same password (and salt, if set).