Copy across same-password crypts without reencrypting

Help and Support
1

What is the problem you are having with rclone?

I would like to transfer from one crypt to another, with the same passwords, without changing the files (nonce) or doing it outside of the remote. Not sure it is possible but I figured I'd ask in case I missed it.

Obviously I could just let it run but that rewrites the data due to the changing nonce. Or I could script it to determine the encrypted names and do it that way but I'd like to avoid it if possible.

Note: I asked a similar question three years ago so this is also asking if there has been any changes I may haven missed.

Is this possible?

Run the command 'rclone version' and share the full output of the command.

rclone v1.75.0
- os/version: darwin 15.6.1 (64 bit)
- os/kernel: 24.6.0 (arm64)
- os/type: darwin
- os/arch: arm64 (ARMv8 compatible)
- go/version: go1.26.5
- go/linking: dynamic
- go/tags: cmount

Which cloud storage system are you using? (eg Google Drive)

crypt, arbitrary backend behind crypt

The command you were trying to run (eg rclone copy /tmp remote:tmp)

Something like:

rclone copyto cryptA:myfile.ext cryptB:newfile.ext

Please run 'rclone config redacted' and share the full output. If you get command not found, please make sure to update rclone.

[cryptA]
type = crypt
remote = onedrive:
password = XXX <same as cryptB>
password2 = XXX <same as cryptB>
server_side_across_configs = true
filename_encoding = base32768


[cryptB]
type = crypt
remote = mys3:bucket
password = XXX <same as cryptA>
password2 = XXX <same as cryptA>
server_side_across_configs = true
filename_encoding = base32768

This is a general question. Not really applicable. Made up...

A log from the command that you were trying to run with the -vv flag

N/A -- Didn't actually run it
2

yeah if you go cryptA: to cryptB: rclone decrypts then reencrypts, so the nonce changes every time. when password + password2 + filename settings match on both sides, copy on the underlying remotes instead (the encrypted blobs) with --server-side-across-configs. that keeps the ciphertext as-is. theres also --crypt-server-side-across-configs for crypt-to-crypt when the configs match, but when that flakes i just use the underlying remotes. dont mix password2 or filename_encryption between them or you get unreadable files with basically no warning.