Cloud Sync
Describes Hatoba 0.2.0.
Cloud Sync keeps the vault the same on several devices. It is optional and off until set up. Hatoba has no sync server: the data goes to a Worker and a D1 database in the user’s own Cloudflare account (or straight to D1), always encrypted on the device first, so the cloud holds ciphertext only. Setting up, deploying and upgrading the Worker is in Sync Worker: deploy, connect and upgrade.
Open it from the sidebar (Cloud Sync, under Vault). The sync button at the bottom of the sidebar shows the current state and opens the same page.
| English | 简体中文 | 日本語 |
|---|---|---|
| Cloud Sync | 云同步 | クラウド同期 |
| Vault | 保险库 | 保管庫 |
| Sync is off | 未开启云同步 | クラウド同期はオフ |
| Stored on this device only | 数据仅保存在本机 | このデバイスにのみ保存 |
| Synced | 已同步 | 同期済み |
| Syncing… | 正在同步… | 同期中… |
| Offline | 离线 | オフライン |
| Will retry automatically | 将自动重试 | 自動的に再試行します |
| Signed out | 认证失效 | 認証切れ |
| Enter your master password again | 请重新输入主密码 | マスターパスワードを再入力してください |
| Sync error | 同步出错 | 同期エラー |
| Worker update required | 需要更新 Worker | Worker の更新が必要 |
| Hatoba update required | 需要更新 Hatoba | Hatoba の更新が必要 |
| Resolved automatically, review pending | 已自动解决，等待查看 | 自動的に解決済み・確認待ち |
What syncs
- Synced (encrypted): hosts and saved passwords, groups, SSH keys with their passphrases, trusted host fingerprints, port forwards, terminal settings, AI providers with their API keys and models, the search provider, the default model, the judge of Auto mode, the custom instructions, the Terminal Screen default, AI conversations, skills (and the switch of the built-in skill), and MCP server definitions (with the Always ask setting).
- Not synced, kept on each device: language, theme, list density, host reachability, the Auto-Lock and other lock settings, the clipboard delay, the update-check switch, the AI permission mode, the saved AI approvals and the AI panel size, whether an MCP server is switched on for the device, and the MCP “Always allow” switches.
- A sync round runs after unlock, about 2 seconds after a local change, every 60 seconds, when the window regains focus, and on Sync Now. Local work never waits for it.
Set up on the first device
With sync off, the page is a three-step wizard (Method, Connect, Password). A vault must already exist locally.
| English | 简体中文 | 日本語 |
|---|---|---|
| Method | 接入方式 | 接続方法 |
| Connect | 连接 | 接続 |
| Password | 主密码 | パスワード |
| Deploy a Worker from Hatoba | 从 Hatoba 部署 Worker | Hatoba から Worker をデプロイ |
| Recommended | 推荐 | 推奨 |
| Connect a deployed Worker | 连接已部署的 Worker | デプロイ済みの Worker に接続 |
| Use an API Token | 直接填写 API Token | API トークンを直接入力 |
| How is my data encrypted? | 数据如何加密？ | データはどう暗号化される？ |
| Continue | 继续 | 続ける |
| Cancel | 取消 | キャンセル |
| Back | 返回 | 戻る |
- Method: Deploy a Worker from Hatoba (recommended; Hatoba creates the Worker and database with a Cloudflare API token), Connect a deployed Worker (the user deployed it with the Deploy to Cloudflare button or wrangler and enters its URL and Setup Token), or Use an API Token (direct D1 mode: no Worker, the app calls the D1 API; the token can usually edit every D1 database in the account). How is my data encrypted? explains the encryption.
- Connect: the details of the chosen method; see Sync Worker: deploy, connect and upgrade.
- Password: Enter Your Master Password (the existing one, not a new one), then Finish Setup. Hatoba uploads the vault (“Uploading N items…”) and the page switches to the status page.
| English | 简体中文 | 日本語 |
|---|---|---|
| Enter Your Master Password | 输入主密码 | マスターパスワードを入力 |
| Master Password | 主密码 | マスターパスワード |
| Finish Setup | 完成设置 | 設定を完了 |
| Cloud Sync is on | 云同步已开启 | クラウド同期をオンにしました |
Join a cloud vault
When the Worker or database chosen in step 2 already holds a vault, step 3 joins it instead of setting it up. This is how a device that already has its own vault (or synced before and was disconnected) gets the cloud vault: it does not need a fresh install.
- Step 3 is Enter the Cloud Vault’s Master Password: the master password of the vault in the cloud, not this device’s. Merge and Turn On Sync signs in and merges.
- This device’s hosts, keys and other items are added to the cloud vault, and the cloud’s items arrive on this device. The cloud’s settings are kept. If this device synced with that same vault before, matching items are reconciled instead of duplicated, and the newer edit wins.
- From then on this device unlocks with the cloud vault’s master password, and the cloud vault’s recovery code replaces this device’s, which stops working. When the cloud held another vault, Unlock with Windows Hello is turned off; turn it on again in Settings → Security.
| English | 简体中文 | 日本語 |
|---|---|---|
| Connected · the cloud already holds a vault | 已连接 · 云端已有保险库 | 接続しました · クラウドに保管庫があります |
| Enter the Cloud Vault’s Master Password | 输入云端保险库的主密码 | クラウドの保管庫のマスターパスワードを入力 |
| Merge and Turn On Sync | 合并并开启同步 | 統合して同期をオン |
| Merging… | 正在合并… | 統合しています… |
Add another device
On a new device’s first launch choose Restore from Cloud: pick the method (Sync Worker or Direct D1), enter the Worker URL (or the account ID, token and database), use Test Connection, then enter the master password and Restore Vault. Data is downloaded and decrypted on the device. A device that already has its own vault joins from the Cloud Sync page instead (see “Join a cloud vault”).
| English | 简体中文 | 日本語 |
|---|---|---|
| Restore from Cloud | 从云端恢复 | クラウドから復元 |
| Method | 接入方式 | 接続方式 |
| Sync Worker | 同步 Worker | 同期 Worker |
| Direct D1 | D1 直连 | D1 直接接続 |
| Worker URL | Worker URL | Worker URL |
| Test Connection | 测试连接 | 接続テスト |
| Restore Vault | 恢复保险库 | 保管庫を復元 |
The status page
The header shows the state (“Synced”, “Syncing…”, “Offline”, “Signed out”, “Sync error”, or a paused state) with the last sync time and counts of hosts, keys and groups, and the Sync Now button.
| English | 简体中文 | 日本語 |
|---|---|---|
| Sync Now | 立即同步 | 今すぐ同期 |
| Connection | 连接 | 接続 |
| Endpoint | 端点 | エンドポイント |
| Database | 数据库 | データベース |
| Sync automatically | 自动同步 | 自動同期 |
| Devices | 设备 | デバイス |
| This PC | 本机 | このPC |
| Not seen in 14+ days | 超过 14 天未同步 | 14 日以上同期されていません |
| Remove | 移除 | 削除 |
- Connection lists the Method, Endpoint (the Worker URL) and Database, and the Sync automatically switch. With it off, sync runs only on Sync Now.
- Offline: the network or the service is unreachable. Local changes are kept and uploaded automatically later. See Troubleshooting: Cloud Sync and Cloudflare.
- Signed out: the session expired or was revoked. A master password field with Sign In Again appears on the page.
- A paused state (Worker update required or Hatoba update required) means the Worker and the app versions no longer match; see Sync Worker: deploy, connect and upgrade.
- A notice that a host or the settings are too large to sync means that item can’t upload until it is shortened; see Troubleshooting: Cloud Sync and Cloudflare.
- Devices lists the signed-in devices (This PC marks this one) with the platform and the last seen time. A device not seen for 14 days or more is flagged “Not seen in 14+ days”. Remove next to another device (then Remove Device) revokes its sign-in. It needs the master password again to sync, and no data is deleted.
| English | 简体中文 | 日本語 |
|---|---|---|
| Sign In Again | 重新登录 | 再ログイン |
| Remove Device | 移除设备 | デバイスを削除 |
Conflicts
When two devices edit the same item, Hatoba resolves it automatically: the newer edit wins; an edit beats a delete; for SSH keys the losing version is kept as a second key whose name carries a conflict-copy suffix. Sync does not stop. A banner on the status page says how many conflicts were resolved, with Review.
| English | 简体中文 | 日本語 |
|---|---|---|
| Review | 查看 | 確認 |
| Keep Current Result | 保留当前结果 | 現在の結果を維持 |
| Restore Other Version | 恢复另一版本 | もう一方を復元 |
| Cloud | 云端 | クラウド |
| No conflicts to review. | 没有需要查看的冲突。 | 確認が必要な競合はありません。 |
| Kept both versions; one is marked “(conflict copy)” | 已保留两个版本，其中一份标为“（冲突副本）” | 両方のバージョンを残し、片方に「（競合コピー）」を付けました |
The review page lists each item with This PC and Cloud versions. Keep Current Result accepts what Hatoba chose; Restore Other Version switches to the other side.
Security actions and disconnecting
At the bottom of the status page:
| English | 简体中文 | 日本語 |
|---|---|---|
| Always ask | 始终询问 | 常に確認 |
| Generate New Recovery Code | 生成新的恢复码 | 新しいリカバリーコードを作成 |
| Change Master Password | 更改主密码 | マスターパスワードを変更 |
| Disconnect… | 断开云同步… | クラウド同期を解除… |
| Disconnect Cloud Sync? | 断开云同步？ | クラウド同期を解除しますか？ |
| Disconnect | 断开 | 解除 |
- Generate New Recovery Code and Change Master Password work like their Settings → Security counterparts. After a password change, the other devices are signed out and must sign in with the new one.
- Disconnect… stops syncing on this device. Data stays on the device and nothing is deleted from the cloud. You can reconnect through the wizard later.