Pairing more devices
Each device you pair gets its own Curve25519 keypair and a copy of the master key, wrapped so only that device can unwrap it. The server forwards pairing messages but never sees the master key.
Before you start
Section titled “Before you start”You need one device already signed in to authorize the new one. Pair codes expire after 5 minutes (PAIR_CODE_TTL_MS on the server).
On the device you already use
Section titled “On the device you already use”- Open Settings → Devices.
- Click Pair a device. A QR code and a 6-word code appear (the words are the manual fallback).
- When the new device scans it, a 6-digit verification code appears here.
- Confirm the code matches the new device, then click Approve & pair. Leave this screen open and online until pairing completes — it delivers the wrapped master key.
The existing device must stay online to seal and deliver the master key after you approve.
On the new device
Section titled “On the new device”- Open the SyncBins app and tap Scan QR to pair.
- Grant camera access and point it at the QR code.
- Check the 6-digit verification code matches the one on the signed-in device, then approve there.
- Name the device. It unlocks once the master key arrives.
No camera? Tap use passphrase instead, or type the 6-word code.
- Open your SyncBins URL (hosted subdomain or self-hosted domain).
- During onboarding choose Pair this device and enter the six words (spaces or hyphens both work).
- Confirm the verification code matches, approve on the existing device, name this one, and finish.
The new device:
- Fetches the ephemeral public key from the server using the code.
- Generates its own keypair and sends its public key plus an HMAC attestation (proves it read the code out-of-band).
- Shows a verification code derived from both public keys; you confirm it matches and approve on the existing device.
- Receives the master key sealed to its public key, then downloads and decrypts items as the sync cursor catches up.
Handshake details: How encryption works → Pairing.
What syncs to the new device
Section titled “What syncs to the new device”- Future items — immediate real-time fanout over WebSocket.
- Past items — when a paired device comes online, it runs a re-wrap pass: any item this device can already decrypt gets updated with wrapped keys for devices that were missing. Items nobody can decrypt (e.g. written on a revoked device only) are skipped.
So a newly paired laptop should receive your history within a few minutes of the first online session, not only new drops.
Managing devices
Section titled “Managing devices”Settings → Devices lists every paired device: name, glyph, paired date, last seen, online/offline.
| Action | Effect |
|---|---|
| Rename | Click the device name (not available for the current device label). |
| Revoke | Invalidates that device’s session token immediately. It stops receiving new items. Cannot revoke This device from itself — use another device. |
| This device | The browser you’re in now; revoke it from elsewhere. |
Revocation does not remotely wipe items already downloaded on that device.
Pairing MCP or other agents
Section titled “Pairing MCP or other agents”The @syncbins/mcp CLI uses the same six-word handshake. See MCP server → Install & pair.
Troubleshooting
Section titled “Troubleshooting”| Problem | What to do |
|---|---|
| Code expired | Generate a new code on the existing device. |
| Attestation invalid | Wrong word order or typo — re-enter all six words. |
| Waiting for existing device | Keep the device that generated the code signed in with an active session. |
| Items unreadable on new device | Wait for re-wrap to finish; pull to refresh. Items created before any surviving decryptor existed may remain inaccessible. |
| Verification codes don’t match | Reject and start over — a mismatch means the device that scanned isn’t the one you expect. |
| QR won’t scan | Check camera permission, lighting, and that the code hasn’t expired (5 min). Fall back to typing the six words. |