Nextcloud includes a server side Encryption app, and when it is enabled by your Nextcloud administrator all of your Nextcloud data files are automatically encrypted on the server. Encryption is server-wide, so when it is enabled you cannot choose to keep your files unencrypted. You don’t have to do anything special, as it uses your Nextcloud login as the password for your unique private encryption key. Just log out and in and manage and share your files as you normally do, and you can still change your password whenever you want.
Its main purpose is to encrypt files on remote storage services that are connected to your Nextcloud server. This is an easy and seamless way to protect your files on remote storage. You can share your remote files through Nextcloud in the usual way, however you cannot share your encrypted files directly from the remote service you are using, because the encryption keys are stored on your Nextcloud server, and are never exposed to outside service providers.
If your Nextcloud server is not connected to any remote storage services, then it is better to use some other form of encryption such as file-level or whole disk encryption. Because the keys are kept on your Nextcloud server, it is possible for your Nextcloud administrator to snoop in your files, and if the server is compromised the intruder may get access to your files. (Read Encryption in Nextcloud to learn more.)
The only way to disable encryption is to run the “decrypt all” script, which decrypts all files and disables encryption.
Yes, if every user uses the file recovery key, “decrypt all” will use it to decrypt all files.
If you don’t have the users password or file recovery key, then there is no way to decrypt all files. What’s more, running it on login would be dangerous, because you would most likely run into timeouts.
If we did that, then we would need to store your login password in the database. This could be seen as a security issue, so nothing like that is planned.
If you mean adding users to groups and make it magically work? No. This only works with the master key.
Nextcloud encryption is pretty much set it and forget it, but you have a few options you can use.
When your Nextcloud administrator enables encryption for the first time, you must log out and then log back in to create your encryption keys and encrypt your files. When encryption has been enabled on your Nextcloud server you will see a yellow banner on your Files page warning you to log out and then log back in:
When you log back in it takes a few minutes to work, depending on how many files you have, and then you are returned to your default Nextcloud page.
