neulab/tldr huggingface dataset:
If a path remote:path/to/dir is specified, rclone stores encrypted files in path/to/dir on the remote.  With file name encryption, files saved to secret:subdir/subfile are stored in the unencrypted path path/to/dir but the subdir/subpath element is encrypted.
The path you specify does not have to exist, rclone will create it when needed.
If you intend to use the wrapped remote both directly for keeping unencrypted content, as well as through a crypt remote for encrypted content, it is recommended to point the crypt remote to a separate directory within the wrapped remote.  If you use a bucket based storage system (e.g.  Swift, S3, Google Compute Storage, B2, Hubic) it is generally advisable to wrap the crypt remote around a specific bucket (s3:bucket).  If wrapping around the entire root of the storage (s3:), and use the optional file name encryption, rclone will encrypt the bucket name.
Changing password Should the password, or the configuration file containing a lightly obscured form of the password, be compromised, you need to re-encrypt your data with a new password.  Since rclone uses secret-key encryption, where the encryption key is generated directly from the password kept on the client, it is not possible to change the password/key of already encrypted content.  Just changing the password configured for an existing crypt remote means you will no longer able to decrypt any of the previously encrypted content.  The only possibility is to re-upload everything via a crypt remote configured with your new password.
Depending on the size of your data, your bandwith, storage quota etc, there are different approaches you can take: - If you have everything in a different location, for example on your local system, you could remove all of the prior encrypted files, change the password for your configured crypt remote (or delete and re-create the crypt configuration), and then re-upload everything from the alternative location.  - If you have enough space on the storage system you can create a new crypt remote pointing to a separate directory on the same backend, and then use rclone to copy everything from the original crypt remote to the new, effectively decrypting everything on the fly using the old password and re-encrypting using the new password.  When done, delete the original crypt remote directory and finally the rclone crypt configuration with the old password.  All data will be streamed from the storage system and back, so you will get half the bandwith and be charged twice if you have upload and download quota on the storage system.
Note: A security problem related to the random password generator was fixed in rclone version 1.53.3 (released 2020-11-19).  Passwords generated by rclone config in version 1.49.0 (released 2019-08-26) to 1.53.2 (released 2020-10-26) are not considered secure and should be changed.  If you made up your own password, or used rclone version older than 1.49.0 or newer than 1.53.2 to generate it, you are not affected by this issue.  See issue #4783 (https://github.com/rclone/rclone/issues/4783) for more details, and a tool you can use to check if you are affected.
Example Create the following file structure using "standard" file name encryption.
plaintext/ ├── file0.txt ├── file1.txt └── subdir ├── file2.txt ├── file3.txt └── subsubdir └── file4.txt
Copy these to the remote, and list them
$ rclone -q copy plaintext secret: $ rclone -q ls secret: 7 file1.txt 6 file0.txt 8 subdir/file2.txt 10 subdir/subsubdir/file4.txt 9 subdir/file3.txt
The crypt remote looks like
$ rclone -q ls remote:path 55 hagjclgavj2mbiqm6u6cnjjqcg 54 v05749mltvv1tf4onltun46gls 57 86vhrsv86mpbtd3a0akjuqslj8/dlj7fkq4kdq72emafg7a7s41uo 58 86vhrsv86mpbtd3a0akjuqslj8/7uu829995du6o42n32otfhjqp4/b9pausrfansjth5ob3jkdqd4lc 56 86vhrsv86mpbtd3a0akjuqslj8/8njh1sk437gttmep3p70g81aps
The directory structure is preserved
$ rclone -q ls secret:subdir 8 file2.txt 9 file3.txt 10 subsubdir/file4.txt
Without file name encryption .bin extensions are added to underlying names.  This prevents the cloud provider attempting to interpret file content.
$ rclone -q ls remote:path 54 file0.txt.bin 57 subdir/file3.txt.bin 56 subdir/file2.txt.bin 58 subdir/subsubdir/file4.txt.bin 55 file1.txt.bin
File name encryption modes Off
• doesn't hide file names or directory structure
• allows for longer file names (~246 characters)
• can use sub paths and copy single files
• file names encrypted
• file names can't be as long (~143 characters)
• directory structure visible
• identical files names will have identical uploaded names
• can use shortcuts to shorten the directory recursion
This is a simple "rotate" of the filename, with each file having a rot distance based on the filename.  Rclone stores the distance at the beginning of the filename.  A file called "hello" may become "53.jgnnq".
Obfuscation is not a strong encryption of filenames, but hinders automated scanning tools picking up on filename patterns.  It is an intermediate between "off" and "standard" which allows for longer path segment names.
There is a possibility with some unicode based filenames that the obfuscation is weak and may map lower case characters to upper case equivalents.
Obfuscation cannot be relied upon for strong protection.
• file names very lightly obfuscated
• file names can be longer than standard encryption
Cloud storage systems have limits on file name length and total path length which rclone is more likely to breach using "Standard" file name encryption.  Where file names are less thn 156 characters in length issues should not be encountered, irrespective of cloud storage provider.
An alternative, future rclone file name encryption mode may tolerate backend provider path length limits.
Directory name encryption Crypt offers the option of encrypting dir names or leaving them intact. There are two options:
Encrypts the whole file path including directory names Example: 1/12/123.txt is encrypted to p0e52nreeaj0a5ea7s64m4j72s/l42g6771hnv3an9cgc8cr2n1ng/qgm4avr35m5loi1th53ato71v0
Only encrypts file names, skips directory names Example: 1/12/123.txt is encrypted to 1/12/qgm4avr35m5loi1th53ato71v0
Modified time and hashes Crypt stores modification times using the underlying remote so support depends on that.
Hashes are not stored for crypt.  However the data integrity is protected by an extremely strong crypto authenticator.
Use the rclone cryptcheck command to check the integrity of a crypted remote instead of rclone check which can't check the checksums properly.
Standard options Here are the standard options specific to crypt (Encrypt/Decrypt a remote).
--crypt-remote Remote to encrypt/decrypt.
• Env Var: RCLONE_CRYPT_REMOTE
--crypt-filename-encryption How to encrypt the filenames.
• Config: filename_encryption
• Env Var: RCLONE_CRYPT_FILENAME_ENCRYPTION
• Default: "standard"
• "standard"
• Encrypt the filenames.
• See the docs for the details.
• "obfuscate"
• Very simple filename obfuscation.
• "off"
• Don't encrypt the file names.
• Adds a ".bin" extension only.
--crypt-directory-name-encryption Option to either encrypt directory names or leave them intact.
NB If filename_encryption is "off" then this option will do nothing.
• Config: directory_name_encryption
• Env Var: RCLONE_CRYPT_DIRECTORY_NAME_ENCRYPTION
• Encrypt directory names.
• Don't encrypt directory names, leave them intact.
--crypt-password Password or pass phrase for encryption.
• Config: password
• Env Var: RCLONE_CRYPT_PASSWORD
--crypt-password2 Password or pass phrase for salt.
Optional but recommended.  Should be different to the previous password.
• Config: password2
• Env Var: RCLONE_CRYPT_PASSWORD2
Advanced options Here are the advanced options specific to crypt (Encrypt/Decrypt a remote).
--crypt-server-side-across-configs Allow server-side operations (e.g.  copy) to work across different crypt configs.
Normally this option is not what you want, but if you have two crypts pointing to the same backend you can use it.
This can be used, for example, to change file name encryption type without re-uploading all the data.  Just make two crypt backends pointing to two different directories with the single changed parameter and use rclone move to move the files between the crypt remotes.
• Config: server_side_across_configs
• Env Var: RCLONE_CRYPT_SERVER_SIDE_ACROSS_CONFIGS
--crypt-show-mapping For all files listed show how the names encrypt.
If this flag is set then for each file that the remote is asked to list, it will log (at level INFO) a line stating the decrypted file name and the encrypted file name.
This is so you can work out which encrypted names are which decrypted names just in case you need to do something with the encrypted file names, or for debugging purposes.
• Config: show_mapping
• Env Var: RCLONE_CRYPT_SHOW_MAPPING
--crypt-no-data-encryption Option to either encrypt file data or leave it unencrypted.
• Config: no_data_encryption
• Env Var: RCLONE_CRYPT_NO_DATA_ENCRYPTION
• Don't encrypt file data, leave it unencrypted.
• Encrypt file data.
Backend commands Here are the commands specific to the crypt backend.
encode Encode the given filename(s)
rclone backend encode remote: [options] [<arguments>+]
This encodes the filenames given as arguments returning a list of strings of the encoded results.
Usage Example:
rclone backend encode crypt: file1 [file2...] rclone rc backend/command command=encode fs=crypt: file1 [file2...]
decode Decode the given filename(s)
rclone backend decode remote: [options] [<arguments>+]
This decodes the filenames given as arguments returning a list of strings of the decoded results.  It will return an error if any of the inputs are invalid.
rclone backend decode crypt: encryptedfile1 [encryptedfile2...] rclone rc backend/command command=decode fs=crypt: encryptedfile1 [encryptedfile2...]
Backing up a crypted remote If you wish to backup a crypted remote, it is recommended that you use rclone sync on the encrypted files, and make sure the passwords are the same in the new encrypted remote.
This will have the following advantages
• rclone sync will check the checksums while copying
• you can use rclone check between the encrypted remotes
• you don't decrypt and encrypt unnecessarily
For example, let's say you have your original remote at remote: with the encrypted version at eremote: with path remote:crypt.  You would then set up the new remote remote2: and then the encrypted version eremote2: with path remote2:crypt using the same passwords as eremote:.
To sync the two remotes you would do
rclone sync -i remote:crypt remote2:crypt
And to check the integrity you would do
rclone check remote:crypt remote2:crypt
File formats File encryption Files are encrypted 1:1 source file to destination object.  The file has a header and is divided into chunks.
Header • 8 bytes magic string RCLONE\x00\x00
• 24 bytes Nonce (IV)
The initial nonce is generated from the operating systems crypto strong random number generator.  The nonce is incremented for each chunk read making sure each nonce is unique for each block written.  The chance of a nonce being re-used is minuscule.  If you wrote an exabyte of data (10¹⁸ bytes) you would have a probability of approximately 2×10⁻³² of re-using a nonce.
Chunk Each chunk will contain 64 KiB of data, except for the last one which may have less data.  The data chunk is in standard NaCl SecretBox format. SecretBox uses XSalsa20 and Poly1305 to encrypt and authenticate messages.
Each chunk contains:
• 16 Bytes of Poly1305 authenticator
• 1 - 65536 bytes XSalsa20 encrypted data
64k chunk size was chosen as the best performing chunk size (the authenticator takes too much time below this and the performance drops off due to cache effects above this).  Note that these chunks are buffered in memory so they can't be too big.
This uses a 32 byte (256 bit key) key derived from the user password.
Examples 1 byte file will encrypt to
• 32 bytes header
• 17 bytes data chunk
49 bytes total
1 MiB (1048576 bytes) file will encrypt to
• 16 chunks of 65568 bytes
1049120 bytes total (a 0.05% overhead).  This is the overhead for big files.
Name encryption File names are encrypted segment by segment - the path is broken up into / separated strings and these are encrypted individually.
File segments are padded using PKCS#7 to a multiple of 16 bytes before encryption.
They are then encrypted with EME using AES with 256 bit key.  EME (ECB-Mix-ECB) is a wide-block encryption mode presented in the 2003 paper "A Parallelizable Enciphering Mode" by Halevi and Rogaway.
This makes for deterministic encryption which is what we want - the same filename must encrypt to the same thing otherwise we can't find it on the cloud storage system.
• filenames with the same name will encrypt the same
• filenames which start the same won't have a common prefix
This uses a 32 byte key (256 bits) and a 16 byte (128 bits) IV both of which are derived from the user password.
After encryption they are written out using a modified version of standard base32 encoding as described in RFC4648.  The standard encoding is modified in two ways:
• it becomes lower case (no-one likes upper case filenames!)
• we strip the padding character =
base32 is used rather than the more efficient base64 so rclone can be used on case insensitive remotes (e.g.  Windows, Amazon Drive).
Key derivation Rclone uses scrypt with parameters N=16384, r=8, p=1 with an optional user supplied salt (password2) to derive the 32+32+16 = 80 bytes of key material required.  If the user doesn't supply a salt then rclone uses an internal one.
scrypt makes it impractical to mount a dictionary attack on rclone encrypted data.  For full protection against this you should always use a salt.
SEE ALSO • rclone cryptdecode (https://rclone.org/commands/rclone_cryptdecode/) - Show forward/reverse mapping of encrypted filenames
Compress (Experimental) Warning This remote is currently experimental.  Things may break and data may be lost.  Anything you do with this remote is at your own risk.  Please understand the risks associated with using experimental code and don't use this remote in critical applications.
The Compress remote adds compression to another remote.  It is best used with remotes containing many large compressible files.
Configuration To use this remote, all you need to do is specify another remote and a compression mode to use:
Current remotes:
Name                 Type ====                 ==== remote_to_press      sometype
e) Edit existing remote $ rclone config n) New remote d) Delete remote r) Rename remote c) Copy remote s) Set configuration password q) Quit config e/n/d/r/c/s/q> n name> compress ... 8 / Compress a remote \ "compress" ... Storage> compress ** See help for compress backend at: https://rclone.org/compress/ **
Remote to compress. Enter a string value. Press Enter for the default (""). remote> remote_to_press:subdir Compression mode. Enter a string value. Press Enter for the default ("gzip"). Choose a number from below, or type in your own value 1 / Gzip compression balanced for speed and compression strength. \ "gzip" compression_mode> gzip Edit advanced config? (y/n) y) Yes n) No (default) y/n> n Remote config -------------------- [compress] type = compress remote = remote_to_press:subdir compression_mode = gzip -------------------- y) Yes this is OK (default) e) Edit this remote d) Delete this remote y/e/d> y
Compression Modes Currently only gzip compression is supported.  It provides a decent balance between speed and size and is well supported by other applications.  Compression strength can further be configured via an advanced setting where 0 is no compression and 9 is strongest compression.
File types If you open a remote wrapped by compress, you will see that there are many files with an extension corresponding to the compression algorithm you chose.  These files are standard files that can be opened by various archive programs, but they have some hidden metadata that allows them to be used by rclone.  While you may download and decompress these files at will, do not manually delete or rename files.  Files without correct metadata files will not be recognized by rclone.
File names The compressed files will be named *.###########.gz where * is the base file and the # part is base64 encoded size of the uncompressed file.  The file names should not be changed by anything other than the rclone compression backend.
Standard options Here are the standard options specific to compress (Compress a remote).
--compress-remote Remote to compress.
• Env Var: RCLONE_COMPRESS_REMOTE
--compress-mode Compression mode.
• Config: mode
• Env Var: RCLONE_COMPRESS_MODE
• Default: "gzip"
• "gzip"
• Standard gzip compression with fastest parameters.
Advanced options Here are the advanced options specific to compress (Compress a remote).
--compress-level GZIP compression level (-2 to 9).
Generally -1 (default, equivalent to 5) is recommended.  Levels 1 to 9 increase compression at the cost of speed.  Going past 6 generally offers very little return.
Level -2 uses Huffmann encoding only.  Only use if you know what you are doing.  Level 0 turns off compression.
• Config: level
• Env Var: RCLONE_COMPRESS_LEVEL
--compress-ram-cache-limit Some remotes don't allow the upload of files with unknown size.  In this case the compressed file will need to be cached to determine it's size.
Files smaller than this limit will be cached in RAM, files larger than this limit will be cached on disk.
• Config: ram_cache_limit
• Env Var: RCLONE_COMPRESS_RAM_CACHE_LIMIT
• Default: 20Mi
Dropbox Paths are specified as remote:path
Dropbox paths may be as deep as required, e.g. remote:directory/subdirectory.
Configuration The initial setup for dropbox involves getting a token from Dropbox which you need to do in your browser.  rclone config walks you through it.
n) New remote d) Delete remote q) Quit config e/n/d/q> n name> remote Type of storage to configure. Choose a number from below, or type in your own value [snip] XX / Dropbox \ "dropbox" [snip] Storage> dropbox Dropbox App Key - leave blank normally. app_key> Dropbox App Secret - leave blank normally. app_secret> Remote config Please visit: https://www.dropbox.com/1/oauth2/authorize?client_id=XXXXXXXXXXXXXXX&response_type=code Enter the code: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX_XXXXXXXXXX -------------------- [remote] app_key = app_secret = token = XXXXXXXXXXXXXXXXXXXXXXXXXXXXX_XXXX_XXXXXXXXXXXXXXXXXXXXXXXXXXXXX -------------------- y) Yes this is OK e) Edit this remote d) Delete this remote y/e/d> y
List directories in top level of your dropbox
List all the files in your dropbox
To copy a local directory to a dropbox directory called backup
Dropbox for business Rclone supports Dropbox for business and Team Folders.
When using Dropbox for business remote: and remote:path/to/file will refer to your personal folder.
If you wish to see Team Folders you must use a leading / in the path, so rclone lsd remote:/ will refer to the root and show you all Team Folders and your User Folder.
You can then use team folders like this remote:/TeamFolder and remote:/TeamFolder/path/to/file.
A leading / for a Dropbox personal account will do nothing, but it will take an extra HTTP transaction so it should be avoided.
Modified time and Hashes Dropbox supports modified times, but the only way to set a modification time is to re-upload the file.
This means that if you uploaded your data with an older version of rclone which didn't support the v2 API and modified times, rclone will decide to upload all your old data to fix the modification times.  If you don't want this to happen use --size-only or --checksum flag to stop it.
Dropbox supports its own hash type (https://www.dropbox.com/developers/reference/content-hash) which is checked for all transfers.
Restricted filename characters Character   Value   Replacement ──────────────────────────────── NUL         0x00         ␀ /           0x2F         ／ DEL         0x7F         ␡ \           0x5C         ＼
Batch mode uploads Using batch mode uploads is very important for performance when using the Dropbox API.  See the dropbox performance guide (https://developers.dropbox.com/dbx-performance-guide) for more info.
There are 3 modes rclone can use for uploads.
--dropbox-batch-mode off In this mode rclone will not use upload batching.  This was the default before rclone v1.55.  It has the disadvantage that it is very likely to encounter too_many_requests errors like this
NOTICE: too_many_requests/.: Too many requests or write operations. Trying again in 15 seconds.
When rclone receives these it has to wait for 15s or sometimes 300s before continuing which really slows down transfers.
This will happen especially if --transfers is large, so this mode isn't recommended except for compatibility or investigating problems.
--dropbox-batch-mode sync In this mode rclone will batch up uploads to the size specified by --dropbox-batch-size and commit them together.
Using this mode means you can use a much higher --transfers parameter (32 or 64 works fine) without receiving too_many_requests errors.
This mode ensures full data integrity.
Note that there may be a pause when quitting rclone while rclone finishes up the last batch using this mode.
--dropbox-batch-mode async In this mode rclone will batch up uploads to the size specified by --dropbox-batch-size and commit them together.
However it will not wait for the status of the batch to be returned to the caller.  This means rclone can use a much bigger batch size (much bigger than --transfers), at the cost of not being able to check the status of the upload.
This provides the maximum possible upload speed especially with lots of small files, however rclone can't check the file got uploaded properly using this mode.
If you are using this mode then using "rclone check" after the transfer completes is recommended.  Or you could do an initial transfer with --dropbox-batch-mode async then do a final transfer with --dropbox-batch-mode sync (the default).
Standard options Here are the standard options specific to dropbox (Dropbox).
--dropbox-client-id OAuth Client Id.
• Env Var: RCLONE_DROPBOX_CLIENT_ID
--dropbox-client-secret OAuth Client Secret.
• Env Var: RCLONE_DROPBOX_CLIENT_SECRET
Advanced options Here are the advanced options specific to dropbox (Dropbox).
--dropbox-token OAuth Access Token as a JSON blob.
• Env Var: RCLONE_DROPBOX_TOKEN
--dropbox-auth-url Auth server URL.
• Env Var: RCLONE_DROPBOX_AUTH_URL
--dropbox-token-url Token server url.
• Env Var: RCLONE_DROPBOX_TOKEN_URL
--dropbox-chunk-size Upload chunk size (< 150Mi).
Any files larger than this will be uploaded in chunks of this size.
Note that chunks are buffered in memory (one at a time) so rclone can deal with retries.  Setting this larger will increase the speed slightly (at most 10% for 128 MiB in tests) at the cost of using more memory.  It can be set smaller if you are tight on memory.
• Env Var: RCLONE_DROPBOX_CHUNK_SIZE
• Default: 48Mi
--dropbox-impersonate Impersonate this user when using a business account.
Note that if you want to use impersonate, you should make sure this flag is set when running "rclone config" as this will cause rclone to request the "members.read" scope which it won't normally.  This is needed to lookup a members email address into the internal ID that dropbox uses in the API.
Using the "members.read" scope will require a Dropbox Team Admin to approve during the OAuth flow.
You will have to use your own App (setting your own client_id and client_secret) to use this option as currently rclone's default set of permissions doesn't include "members.read".  This can be added once v1.55 or later is in use everywhere.
• Config: impersonate
• Env Var: RCLONE_DROPBOX_IMPERSONATE
--dropbox-shared-files Instructs rclone to work on individual shared files.
In this mode rclone's features are extremely limited - only list (ls, lsl, etc.) operations and read operations (e.g.  downloading) are supported in this mode.  All other operations will be disabled.
• Config: shared_files
• Env Var: RCLONE_DROPBOX_SHARED_FILES
--dropbox-shared-folders Instructs rclone to work on shared folders.
When this flag is used with no path only the List operation is supported and all available shared folders will be listed.  If you specify a path the first part will be interpreted as the name of shared folder.  Rclone will then try to mount this shared to the root namespace.  On success shared folder rclone proceeds normally.  The shared folder is now pretty much a normal folder and all normal operations are supported.
Note that we don't unmount the shared folder afterwards so the --dropbox-shared-folders can be omitted after the first use of a particular shared folder.
• Config: shared_folders
• Env Var: RCLONE_DROPBOX_SHARED_FOLDERS
--dropbox-batch-mode Upload file batching sync|async|off.
This sets the batch mode used by rclone.
For full info see the main docs (https://rclone.org/dropbox/#batch-mode)
This has 3 possible values
• off - no batching
• sync - batch uploads and check completion (default)
• async - batch upload and don't check completion
Rclone will close any outstanding batches when it exits which may make a delay on quit.
• Config: batch_mode
• Env Var: RCLONE_DROPBOX_BATCH_MODE
• Default: "sync"
--dropbox-batch-size Max number of files in upload batch.
This sets the batch size of files to upload.  It has to be less than 1000.
By default this is 0 which means rclone which calculate the batch size depending on the setting of batch_mode.
• batch_mode: async - default batch_size is 100
• batch_mode: sync - default batch_size is the same as --transfers
• batch_mode: off - not in use
Setting this is a great idea if you are uploading lots of small files as it will make them a lot quicker.  You can use --transfers 32 to maximise throughput.
• Config: batch_size
• Env Var: RCLONE_DROPBOX_BATCH_SIZE
• Default: 0
--dropbox-batch-timeout Max time to allow an idle upload batch before uploading.
If an upload batch is idle for more than this long then it will be uploaded.
The default for this is 0 which means rclone will choose a sensible default based on the batch_mode in use.
• batch_mode: async - default batch_timeout is 500ms
• batch_mode: sync - default batch_timeout is 10s
• Config: batch_timeout
• Env Var: RCLONE_DROPBOX_BATCH_TIMEOUT
• Default: 0s
--dropbox-batch-commit-timeout Max time to wait for a batch to finish comitting
• Config: batch_commit_timeout
• Env Var: RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT
• Default: 10m0s
--dropbox-encoding This sets the encoding for the backend.
• Env Var: RCLONE_DROPBOX_ENCODING
• Default: Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot
Limitations Note that Dropbox is case insensitive so you can't have a file called "Hello.doc" and one called "hello.doc".
There are some file names such as thumbs.db which Dropbox can't store. There is a full list of them in the "Ignored Files" section of this document (https://www.dropbox.com/en/help/145).  Rclone will issue an error message File name disallowed - not uploading if it attempts to upload one of those file names, but the sync won't fail.
Some errors may occur if you try to sync copyright-protected files because Dropbox has its own copyright detector (https://techcrunch.com/2014/03/30/how-dropbox-knows-when-youre-sharing- copyrighted-stuff-without-actually-looking-at-your-stuff/) that prevents this sort of file being downloaded.  This will return the error ERROR : /path/to/your/file: Failed to copy: failed to open source object: path/restricted_content/.
If you have more than 10,000 files in a directory then rclone purge dropbox:dir will return the error Failed to purge: There are too many files involved in this operation.  As a work-around do an rclone delete dropbox:dir followed by an rclone rmdir dropbox:dir.
When using rclone link you'll need to set --expire if using a non-personal account otherwise the visibility may not be correct.  (Note that --expire isn't supported on personal accounts).  See the forum discussion (https://forum.rclone.org/t/rclone-link-dropbox- permissions/23211) and the dropbox SDK issue (https://github.com/dropbox/dropbox-sdk-go-unofficial/issues/75).
Get your own Dropbox App ID When you use rclone with Dropbox in its default configuration you are using rclone's App ID.  This is shared between all the rclone users.
Here is how to create your own Dropbox App ID for rclone:
1. Log into the Dropbox App console (https://www.dropbox.com/developers/apps/create) with your Dropbox Account (It need not to be the same account as the Dropbox you want to access)
2. Choose an API => Usually this should be Dropbox API
3. Choose the type of access you want to use => Full Dropbox or App Folder
4. Name your App.  The app name is global, so you can't use rclone for example
5. Click the button Create App
6. Switch to the Permissions tab.  Enable at least the following permissions: account_info.read, files.metadata.write, files.content.write, files.content.read, sharing.write.  The files.metadata.read and sharing.read checkboxes will be marked too. Click Submit
7. Switch to the Settings tab.  Fill OAuth2 - Redirect URIs as http://localhost:53682/
8. Find the App key and App secret values on the Settings tab.  Use these values in rclone config to add a new remote or edit an existing remote.  The App key setting corresponds to client_id in rclone config, the App secret corresponds to client_secret
Enterprise File Fabric This backend supports Storage Made Easy's Enterprise File Fabric™ (https://storagemadeeasy.com/about/) which provides a software solution to integrate and unify File and Object Storage accessible through a global file system.
Configuration The initial setup for the Enterprise File Fabric backend involves getting a token from the the Enterprise File Fabric which you need to do in your browser.  rclone config walks you through it.
No remotes found - make a new one n) New remote s) Set configuration password q) Quit config n/s/q> n name> remote Type of storage to configure. Enter a string value. Press Enter for the default (""). Choose a number from below, or type in your own value [snip] XX / Enterprise File Fabric \ "filefabric" [snip] Storage> filefabric ** See help for filefabric backend at: https://rclone.org/filefabric/ **
URL of the Enterprise File Fabric to connect to Enter a string value. Press Enter for the default (""). Choose a number from below, or type in your own value 1 / Storage Made Easy US \ "https://storagemadeeasy.com" 2 / Storage Made Easy EU \ "https://eu.storagemadeeasy.com" 3 / Connect to your Enterprise File Fabric \ "https://yourfabric.smestorage.com" url> https://yourfabric.smestorage.com/ ID of the root folder Leave blank normally.
Fill in to make rclone start with directory of a given ID.
Enter a string value. Press Enter for the default (""). root_folder_id> Permanent Authentication Token
A Permanent Authentication Token can be created in the Enterprise File Fabric, on the users Dashboard under Security, there is an entry you'll see called "My Authentication Tokens". Click the Manage button to create one.
These tokens are normally valid for several years.
For more info see: https://docs.storagemadeeasy.com/organisationcloud/api-tokens
Enter a string value. Press Enter for the default (""). permanent_token> xxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx Edit advanced config? (y/n) y) Yes n) No (default) y/n> n Remote config -------------------- [remote] type = filefabric url = https://yourfabric.smestorage.com/ permanent_token = xxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx -------------------- y) Yes this is OK (default) e) Edit this remote d) Delete this remote y/e/d> y
List directories in top level of your Enterprise File Fabric
List all the files in your Enterprise File Fabric
To copy a local directory to an Enterprise File Fabric directory called backup
Modified time and hashes The Enterprise File Fabric allows modification times to be set on files accurate to 1 second.  These will be used to detect whether objects need syncing or not.
The Enterprise File Fabric does not support any data hashes at this time.
Restricted filename characters The default restricted characters set (https://rclone.org/overview/#restricted-characters) will be replaced.
Empty files Empty files aren't supported by the Enterprise File Fabric.  Rclone will therefore upload an empty file as a single space with a mime type of application/vnd.rclone.empty.file and files with that mime type are treated as empty.
Root folder ID You can set the root_folder_id for rclone.  This is the directory (identified by its Folder ID) that rclone considers to be the root of your Enterprise File Fabric.
In order to do this you will have to find the Folder ID of the directory you wish rclone to display.  These aren't displayed in the web interface, but you can use rclone lsf to find them, for example
$ rclone lsf --dirs-only -Fip --csv filefabric: 120673758,Burnt PDFs/ 120673759,My Quick Uploads/ 120673755,My Syncs/ 120673756,My backups/ 120673757,My contacts/ 120673761,S3 Storage/
The ID for "S3 Storage" would be 120673761.
Standard options Here are the standard options specific to filefabric (Enterprise File Fabric).
--filefabric-url URL of the Enterprise File Fabric to connect to.
• Config: url
• Env Var: RCLONE_FILEFABRIC_URL
• "https://storagemadeeasy.com"
• Storage Made Easy US
• "https://eu.storagemadeeasy.com"
• Storage Made Easy EU
• "https://yourfabric.smestorage.com"
• Connect to your Enterprise File Fabric
--filefabric-root-folder-id ID of the root folder.
• Env Var: RCLONE_FILEFABRIC_ROOT_FOLDER_ID
--filefabric-permanent-token Permanent Authentication Token.
A Permanent Authentication Token can be created in the Enterprise File Fabric, on the users Dashboard under Security, there is an entry you'll see called "My Authentication Tokens".  Click the Manage button to create one.
• Config: permanent_token
• Env Var: RCLONE_FILEFABRIC_PERMANENT_TOKEN
Advanced options Here are the advanced options specific to filefabric (Enterprise File Fabric).
--filefabric-token Session Token.
This is a session token which rclone caches in the config file.  It is usually valid for 1 hour.
Don't set this value - rclone will set it automatically.
• Env Var: RCLONE_FILEFABRIC_TOKEN
--filefabric-token-expiry Token expiry time.
• Config: token_expiry
• Env Var: RCLONE_FILEFABRIC_TOKEN_EXPIRY
--filefabric-version Version read from the file fabric.
• Config: version
• Env Var: RCLONE_FILEFABRIC_VERSION
--filefabric-encoding This sets the encoding for the backend.
• Env Var: RCLONE_FILEFABRIC_ENCODING
• Default: Slash,Del,Ctl,InvalidUtf8,Dot
FTP is the File Transfer Protocol.  Rclone FTP support is provided using the github.com/jlaffaye/ftp (https://godoc.org/github.com/jlaffaye/ftp) package.
Limitations of Rclone's FTP backend
Paths are specified as remote:path.  If the path does not begin with a / it is relative to the home directory of the user.  An empty path remote: refers to the user's home directory.
Configuration To create an FTP configuration named remote, run
Rclone config guides you through an interactive setup process.  A minimal rclone FTP remote definition only requires host, username and password. For an anonymous FTP server, use anonymous as username and your email address as password.
No remotes found - make a new one n) New remote r) Rename remote c) Copy remote s) Set configuration password q) Quit config n/r/c/s/q> n name> remote Type of storage to configure. Enter a string value. Press Enter for the default (""). Choose a number from below, or type in your own value [snip] XX / FTP Connection \ "ftp" [snip] Storage> ftp ** See help for ftp backend at: https://rclone.org/ftp/ **
FTP host to connect to Enter a string value. Press Enter for the default (""). Choose a number from below, or type in your own value 1 / Connect to ftp.example.com \ "ftp.example.com" host> ftp.example.com FTP username, leave blank for current username, $USER Enter a string value. Press Enter for the default (""). user> FTP port, leave blank to use default (21) Enter a string value. Press Enter for the default (""). port> FTP password y) Yes type in my own password g) Generate random password y/g> y Enter the password: password: Confirm the password: password: Use FTP over TLS (Implicit) Enter a boolean value (true or false). Press Enter for the default ("false"). tls> Use FTP over TLS (Explicit) Enter a boolean value (true or false). Press Enter for the default ("false"). explicit_tls> Remote config -------------------- [remote] type = ftp host = ftp.example.com pass = *** ENCRYPTED *** -------------------- y) Yes this is OK e) Edit this remote d) Delete this remote y/e/d> y
To see all directories in the home directory of remote
Make a new directory
rclone mkdir remote:path/to/directory
List the contents of a directory
rclone ls remote:path/to/directory
Sync /home/local/directory to the remote directory, deleting any excess files in the directory.
rclone sync -i /home/local/directory remote:directory
Example without a config file rclone lsf :ftp: --ftp-host=speedtest.tele2.net --ftp-user=anonymous --ftp-pass=`rclone obscure dummy`
Implicit TLS Rlone FTP supports implicit FTP over TLS servers (FTPS).  This has to be enabled in the FTP backend config for the remote, or with --ftp-tls.  The default FTPS port is 990, not 21 and can be set with --ftp-port.
File names cannot end with the following characters.  Repacement is limited to the last character in a file name:
Not all FTP servers can have all characters in file names, for example:
FTP Server   Forbidden characters ────────────────────────────────── proftpd               * pureftpd            \ [ ]
This backend's interactive configuration wizard provides a selection of sensible encoding settings for major FTP servers: ProFTPd, PureFTPd, VsFTPd.  Just hit a selection number when prompted.
Standard options Here are the standard options specific to ftp (FTP Connection).
--ftp-host FTP host to connect to.
E.g.  "ftp.example.com".
• Config: host
• Env Var: RCLONE_FTP_HOST
--ftp-user FTP username, leave blank for current username, $USER.
• Config: user
• Env Var: RCLONE_FTP_USER
--ftp-port FTP port, leave blank to use default (21).
• Config: port
• Env Var: RCLONE_FTP_PORT
--ftp-pass FTP password.
• Config: pass
• Env Var: RCLONE_FTP_PASS
--ftp-tls Use Implicit FTPS (FTP over TLS).
When using implicit FTP over TLS the client connects using TLS right from the start which breaks compatibility with non-TLS-aware servers.  This is usually served over port 990 rather than port 21.  Cannot be used in combination with explicit FTP.
• Config: tls
• Env Var: RCLONE_FTP_TLS
--ftp-explicit-tls Use Explicit FTPS (FTP over TLS).
When using explicit FTP over TLS the client explicitly requests security from the server in order to upgrade a plain text connection to an encrypted one.  Cannot be used in combination with implicit FTP.
• Config: explicit_tls
• Env Var: RCLONE_FTP_EXPLICIT_TLS
Advanced options Here are the advanced options specific to ftp (FTP Connection).
--ftp-concurrency Maximum number of FTP simultaneous connections, 0 for unlimited.
• Config: concurrency
• Env Var: RCLONE_FTP_CONCURRENCY
--ftp-no-check-certificate Do not verify the TLS certificate of the server.
• Config: no_check_certificate
• Env Var: RCLONE_FTP_NO_CHECK_CERTIFICATE
--ftp-disable-epsv Disable using EPSV even if server advertises support.
• Config: disable_epsv
• Env Var: RCLONE_FTP_DISABLE_EPSV
--ftp-disable-mlsd Disable using MLSD even if server advertises support.
• Config: disable_mlsd
• Env Var: RCLONE_FTP_DISABLE_MLSD
--ftp-writing-mdtm Use MDTM to set modification time (VsFtpd quirk)
• Config: writing_mdtm
• Env Var: RCLONE_FTP_WRITING_MDTM
--ftp-idle-timeout Max time before closing idle connections.
If no connections have been returned to the connection pool in the time given, rclone will empty the connection pool.
Set to 0 to keep connections indefinitely.
• Config: idle_timeout
• Env Var: RCLONE_FTP_IDLE_TIMEOUT
--ftp-close-timeout Maximum time to wait for a response to close.
• Config: close_timeout
• Env Var: RCLONE_FTP_CLOSE_TIMEOUT
--ftp-tls-cache-size Size of TLS session cache for all control and data connections.
TLS cache allows to resume TLS sessions and reuse PSK between connections.  Increase if default size is not enough resulting in TLS resumption errors.  Enabled by default.  Use 0 to disable.
• Config: tls_cache_size
• Env Var: RCLONE_FTP_TLS_CACHE_SIZE
• Default: 32
--ftp-disable-tls13 Disable TLS 1.3 (workaround for FTP servers with buggy TLS)
• Config: disable_tls13
• Env Var: RCLONE_FTP_DISABLE_TLS13
--ftp-shut-timeout Maximum time to wait for data connection closing status.
• Config: shut_timeout
• Env Var: RCLONE_FTP_SHUT_TIMEOUT
--ftp-encoding This sets the encoding for the backend.
• Env Var: RCLONE_FTP_ENCODING
• Default: Slash,Del,Ctl,RightSpace,Dot
• "Asterisk,Ctl,Dot,Slash"
• ProFTPd can't handle '*' in file names
• "BackSlash,Ctl,Del,Dot,RightSpace,Slash,SquareBracket"
• PureFTPd can't handle '[]' or '*' in file names
• "Ctl,LeftPeriod,Slash"
• VsFTPd can't handle file names starting with dot
Limitations FTP servers acting as rclone remotes must support passive mode.  The mode cannot be configured as passive is the only supported one.  Rclone's FTP implementation is not compatible with active mode as the library it uses doesn't support it (https://github.com/jlaffaye/ftp/issues/29).  This will likely never be supported due to security concerns.
Rclone's FTP backend does not support any checksums but can compare file sizes.
rclone about is not supported by the FTP backend.  Backends without this capability cannot determine free space for an rclone mount or use policy mfs (most free space) as a member of an rclone union remote.
The implementation of : --dump headers, --dump bodies, --dump auth for debugging isn't the same as for rclone HTTP based backends - it has less fine grained control.
--timeout isn't supported (but --contimeout is).
--bind isn't supported.
Rclone's FTP backend could support server-side move but does not at present.
The ftp_proxy environment variable is not currently supported.
Modified time File modification time (timestamps) is supported to 1 second resolution for major FTP servers: ProFTPd, PureFTPd, VsFTPd, and FileZilla FTP server.  The VsFTPd server has non-standard implementation of time related protocol commands and needs a special configuration setting: writing_mdtm = true.
Support for precise file time with other FTP servers varies depending on what protocol extensions they advertise.  If all the MLSD, MDTM and MFTM extensions are present, rclone will use them together to provide precise time.  Otherwise the times you see on the FTP server through rclone are those of the last file upload.
You can use the following command to check whether rclone can use precise time with your FTP server: rclone backend features your_ftp_remote: (the trailing colon is important).  Look for the number in the line tagged by Precision designating the remote time precision expressed as nanoseconds. A value of 1000000000 means that file time precision of 1 second is available.  A value of 3153600000000000000 (or another large number) means "unsupported".
Google Cloud Storage Paths are specified as remote:bucket (or remote: for the lsd command.) You may put subdirectories in too, e.g.  remote:bucket/path/to/dir.
Configuration The initial setup for google cloud storage involves getting a token from Google Cloud Storage which you need to do in your browser.  rclone config walks you through it.
Note that rclone runs a webserver on your local machine to collect the token as returned from Google if you use auto config mode.  This only runs from the moment it opens your browser to the moment you get back the verification code.  This is on http://127.0.0.1:53682/ and this it may require you to unblock it temporarily if you are running a host firewall, or use manual mode.
See all the buckets in your project
Service Account support You can set up rclone with Google Cloud Storage in an unattended mode, i.e.  not tied to a specific end-user Google account.  This is useful when you want to synchronise files onto machines that don't have actively logged-in users, for example build machines.
To get credentials for Google Cloud Platform IAM Service Accounts (https://cloud.google.com/iam/docs/service-accounts), please head to the Service Account (https://console.cloud.google.com/permissions/serviceaccounts) section of the Google Developer Console.  Service Accounts behave just like normal User permissions in Google Cloud Storage ACLs (https://cloud.google.com/storage/docs/access-control), so you can limit their access (e.g.  make them read only).  After creating an account, a JSON file containing the Service Account's credentials will be downloaded onto your machines.  These credentials are what rclone will use for authentication.
To use a Service Account instead of OAuth2 token flow, enter the path to your Service Account credentials at the service_account_file prompt and rclone won't use the browser based authentication flow.  If you'd rather stuff the contents of the credentials file into the rclone config file, you can set service_account_credentials with the actual contents of the file instead, or set the equivalent environment variable.
Anonymous Access For downloads of objects that permit public access you can configure rclone to use anonymous access by setting anonymous to true.  With unauthorized access you can't write or create files but only read or list those buckets and objects that have public read access.
Application Default Credentials If no other source of credentials is provided, rclone will fall back to Application Default Credentials (https://cloud.google.com/video- intelligence/docs/common/auth#authenticating_with_application_default_credentials) this is useful both when you already have configured authentication for your developer account, or in production when running on a google compute host.  Note that if running in docker, you may need to run additional commands on your google compute machine - see this page (https://cloud.google.com/container-registry/docs/advanced- authentication#gcloud_as_a_docker_credential_helper).
Note that in the case application default credentials are used, there is no need to explicitly configure a project number.
Custom upload headers You can set custom upload headers with the --header-upload flag.  Google Cloud Storage supports the headers as described in the working with metadata documentation (https://cloud.google.com/storage/docs/gsutil/addlhelp/WorkingWithObjectMetadata)
• Cache-Control
• Content-Disposition
• Content-Encoding
• Content-Language
• Content-Type
• X-Goog-Storage-Class
• X-Goog-Meta-
Eg --header-upload "Content-Type text/potato"
Note that the last of these is for setting custom metadata in the form --header-upload "x-goog-meta-key: value"
Modification time Google Cloud Storage stores md5sum natively.  Google's gsutil (https://cloud.google.com/storage/docs/gsutil) tool stores modification time with one-second precision as goog-reserved-file-mtime in file metadata.
To ensure compatibility with gsutil, rclone stores modification time in 2 separate metadata entries.  mtime uses RFC3339 format with one-nanosecond precision.  goog-reserved-file-mtime uses Unix timestamp format with one-second precision.  To get modification time from object metadata, rclone reads the metadata in the following order: mtime, goog-reserved-file-mtime, object updated time.
Note that rclone's default modify window is 1ns.  Files uploaded by gsutil only contain timestamps with one-second precision.  If you use rclone to sync files previously uploaded by gsutil, rclone will attempt to update modification time for all these files.  To avoid these possibly unnecessary updates, use --modify-window 1s.
Restricted filename characters Character   Value   Replacement ──────────────────────────────── NUL         0x00         ␀ LF          0x0A         ␊ CR          0x0D         ␍ /           0x2F         ／
Standard options Here are the standard options specific to google cloud storage (Google Cloud Storage (this is not Google Drive)).
--gcs-client-id OAuth Client Id.
• Env Var: RCLONE_GCS_CLIENT_ID
--gcs-client-secret OAuth Client Secret.
• Env Var: RCLONE_GCS_CLIENT_SECRET
--gcs-project-number Project number.
Optional - needed only for list/create/delete buckets - see your developer console.
• Config: project_number
• Env Var: RCLONE_GCS_PROJECT_NUMBER
--gcs-service-account-file Service Account Credentials JSON file path.
Leave blank normally.  Needed only if you want use SA instead of interactive login.
• Config: service_account_file
• Env Var: RCLONE_GCS_SERVICE_ACCOUNT_FILE
--gcs-service-account-credentials Service Account Credentials JSON blob.
• Config: service_account_credentials
• Env Var: RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS