Syncing across devices & backing up

This page covers how to keep your vault in sync across machines, how to create a portable encrypted backup, and why you need more than just your git remote to have a full backup.

Syncing your vault between devices

Relicario stores your vault in a git repo. Every item you add, edit, or delete is committed there. To push your latest changes to another machine (or pull a teammate's changes), run:

relicario sync

Under the hood, this does a git pull --rebase followed by a push to your configured git remote. Your vault is a normal git repository, so you add its remote yourself the usual way — for example, from inside the vault directory, git remote add origin <your-server-url> (a self-hosted Gitea/GitHub repo, or any git host you control). Once a remote is configured, any machine that has the vault cloned and a copy of your reference image can relicario sync and stay up to date.

Check what's in your vault at a glance:

relicario status

This prints a summary: how many items and attachments you have, and the timestamp of the last commit.

Why your git remote alone is NOT a full backup

Here is the catch: your reference image — the photo that carries your second factor — is gitignored. It never gets committed to your git repo, by design. If someone stole your git remote, they still could not decrypt anything without that image.

But that also means: if you back up only your git remote and lose your reference image, you cannot unlock your vault. The two factors travel separately by design.

A complete backup has two parts:

Your git remote (all the encrypted vault data).
A safe copy of your reference image (the second factor).

Creating a portable encrypted backup

For the safest kind of backup — one you can carry on a USB drive or store in a separate location — use relicario backup export. This packs your entire vault into a single encrypted .relbak file. You set a separate backup passphrase that is independent of your vault passphrase, so the .relbak file can be kept and shared separately without revealing your vault credentials.

Export a backup:

relicario backup export vault-backup.relbak

You will be prompted to set a backup passphrase. This is not the same as your vault passphrase — choose something strong and store it safely.

Include your reference image in the backup (making it fully self-contained):

relicario backup export vault-backup.relbak --include-image

With --include-image, the .relbak file contains everything needed to restore and unlock the vault. If your reference image lives somewhere other than the default reference.jpg in the vault directory, point to it explicitly:

relicario backup export vault-backup.relbak --include-image --image /path/to/your/reference.jpg

Skip the git history (smaller file, useful for quick snapshot backups):

relicario backup export vault-backup.relbak --no-history

Restore from a backup:

relicario backup restore vault-backup.relbak

Or restore into a specific directory:

relicario backup restore vault-backup.relbak /path/to/new-vault/

The target directory must not already contain a .relicario/ folder — Relicario will stop and tell you if it does.

Importing from LastPass

If you are migrating from LastPass, Relicario can import your data directly from a LastPass CSV export. Unlock your vault first, then run:

relicario import lastpass lastpass-export.csv

Each row in the CSV becomes a new item. If a row cannot be parsed, it is skipped and the reason is printed to the terminal — the rest of the import continues. Title collisions are kept as separate items (no automatic deduplication).

Backup checklist

Before you feel safe, make sure you have all four of these:

Your git remote is reachable and has your latest sync (relicario sync before stepping away from a machine).
A safe copy of your reference image stored somewhere independent of the vault — a USB drive, an encrypted cloud folder, or a printed recovery QR (see Recovery).
Optionally, a .relbak file with --include-image stored somewhere offsite. This is the most convenient full restore path — one file, one backup passphrase.
Your vault passphrase memorized. There is no reset and no backdoor.

For the full picture on what happens if you lose a factor, and how to generate a recovery QR for your reference image, see Recovery.

Next: The browser extension

4.6 KiB Raw Blame History