[Proton Drive] - Unable to Decrypt

Suspected Bug
1

What is the problem you are having with rclone?

Upon syncing files from my personal computer to the server, I can no longer open files from the webui because I get "Unfortunately, it appears that the file or some of its data cannot be decrypted."

Run the command 'rclone version' and share the full output of the command.

rclone version
rclone v1.75.0-beta.9992.b6ffdfa8e

  • os/version: arch (64 bit)
  • os/kernel: 7.1.5-arch1-2 (x86_64)
  • os/type: linux
  • os/arch: amd64
  • go/version: go1.26.5
  • go/linking: static
  • go/tags: none

Which cloud storage system are you using? (eg Google Drive)

ProtonDrive (Pro version)

The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone sync /mnt/archive/Public/protondrive/ proton: --copy-links  --create-empty-src-dirs --filter-from ~/.config/rclone/proton_filters.txt -Mvv

The rclone config contents with secrets removed.

[proton]
type = protondrive
username = REDACTED@protonmail.com
password = REDACTED
2fa = REDACTED
client_uid = REDACTED
client_access_token = REDACTED
client_refresh_token = REDACTED
client_salted_key_pass = REDACTED

A log from the command with the -vv flag

I have only tried to isolate the bug by deleting a single file from the remote, and trying to copying it from my local using the previous command. The copy run with no error.

...
2026/07/29 15:34:45 DEBUG : Learning/PlayMusic/Instruments/Batteria/notes_advanced.png: Need to transfer - File not found at Destination
...
2026/07/29 15:34:48 DEBUG : Learning/PlayMusic/Instruments/Batteria/notes_advanced.png: size = 134154 OK
2026/07/29 15:34:48 DEBUG : Learning/PlayMusic/Instruments/Batteria/notes_advanced.png: sha1 = 63640bb27e2802f5221f54dafbc4cf709c39da3c OK
2026/07/29 15:34:48 INFO  : Learning/PlayMusic/Instruments/Batteria/notes_advanced.png: Copied (new)

Apart from that, I got a ton of these kind of messages

2026/07/29 15:39:44 NOTICE: proton drive root link ID '': Get "https://drive-api.proton.me/drive/shares/SOME_HASH==/links/SOME_HASH==": context canceled, Attempt 1
2026/07/29 15:39:44 ERROR : proton drive root link ID '': Get "https://drive-api.proton.me/drive/shares/SOME_HASH==/links/SOME_HASH==": context canceled
2

Proton is basically hostile towards rclone.
Devs of them were here in the forum presenting their concerns and bad ideas.
They don't want third party software accessing their storage backend.
This company has done good marketing in the past and people think they are somewhat a good company, but they ain‘t. I just would get google drive and call it a day.
Gdrive works for me since three years without any intervention, without any changing cookies or other auth problems and they are not that pretentious.

3

yeah, that is true.

for a few years, i was a paid user.
this week, they sent to me a renewal notice.

i cancelled the account and when they asked why.
i wrote 'no support for rclone'

4

I agree to some extent with both of you, but at the moment it is impossible for me to switch.

6

Thanks for the excellent report @tigerjack - I've tracked this down and I beleive this is rclone's bug, introduced in the v1.75.0 betas after 2026-07-13 and included in v1.75.0. Sorry about that!

First the important bit: your data is safe. The file content is uploaded correctly and rclone can read everything back (which is why your sync shows the correct sha1) - it is only the Proton apps which refuse to open the files.

The background: Proton is migrating Drive to a new generation of OpenPGP encryption (their announcement) and rclone v1.75.0 added support for uploading in the new format, with spec guidance kindly provided by a Proton Drive developer in this thread. The file content encryption is correct. However two auxiliary pieces - the encrypted metadata (modification time etc) and the per-block signatures - are required by Proton's clients to stay in the old format. The OpenPGP library rclone uses silently upgrades those to the new format too, because the file's new-style key advertises support for it. The official apps then fail with "the file or some of its data cannot be decrypted", while rclone (whose library reads both formats) carries on happily.

What's affected: only files newly created on the remote with v1.75.0 or a beta from after 2026-07-13. Files uploaded with v1.74.4 or earlier are untouched, as are updates to such files.

I'm working on a fix now and will post a link to a beta in this thread when it is ready. Once you are on the fixed version, re-uploading the affected files (delete them on the remote and copy again, or use rclone copy --ignore-times - noting that re-uploads everything in the path) will make them readable in the web app again. If you need the web app in the meantime, v1.74.4 uploads in the old format.

The context canceled NOTICE/ERROR messages at the end of your log are unrelated by the way - that's just noise from connections being torn down as the sync finishes.

On the wider discussion above: Proton have actually been actively helpful recently - the new format support only exists because one of their Drive developers gave us detailed guidance on the forum - and this particular bug is entirely ours.

7

Thanks to you @ncw :slight_smile: I will wait for the fix. In the meantime (and I don't know if useful) my protondrive android app (updated to the 20th of July), differently from the browser, can successfully open such files.

As a side quest, would it be possible to check which files were actually uploaded with the old format? I guess I created many new files, and I am not sure how to find all of them.

8

@tigerjack I've got to the bottom of this - it is an rclone bug in v1.75.0 :frowning:

What happened: Proton is migrating Drive to a new generation of encryption and v1.75.0 started uploading new files in the new format, following guidance from Proton on how to do so. It turns out the Proton web app cannot yet decrypt one part of that format (the new-style "node key" attached to each file), so every file uploaded with v1.75.0, or a beta from after 2026-07-13, shows "cannot be decrypted" in the web app. As noted above the Android app can read these files - Proton's own clients are mid-migration and their support differs. Your data was never at risk: the files are intact and rclone reads them back perfectly; it is only the official apps that refuse.

The fix: rclone now creates files in exactly the same format as v1.74.4 did, which every Proton client reads. Fixed in this beta and this will be in v1.75.1 shortly. I have verified files uploaded with the fix open correctly in the web app. Please test it out.

v1.76.0-beta.10068.92f931519.fix-protondrive-unable-to-decrypt on branch fix-protondrive-unable-to-decrypt (uploaded in 15-30 mins)

Repairing affected files: unfortunately a file uploaded with v1.75.0 cannot be fixed in place - the problematic key is attached to the file for life, so re-uploading over the top is not enough. Once you are on the fixed version, delete the affected file from Proton Drive and copy it up again, e.g.

rclone delete proton:path/to/file.txt
rclone copy /local/path/file.txt proton:path/to/

If a whole directory was newly uploaded with v1.75.0 it is easiest to rclone purge it and copy it again. Affected files are easy to spot in the web app - they have the warning icon. Files uploaded with v1.74.4 or earlier, and files that already existed and were merely updated, are fine.

9

Thanks @ncw !!!
Well, from what I uderstood, more than an rclone bug, it seems that it is a bug coming from Proton itself, in the sense that they did not update the web app to the newest v6. Am I correct? In this case, once they update their web app, the new files will be readable again, right?
If this is the case, I guess in the meantime I can just live with it, and hope they will fix it soon.