Skip to content
Skip to content
Get started
/Account

Account

Sign in with Google or GitHub

Skip the password and authenticate to zcrypt with an identity you already have. OAuth covers signing in only: your files stay protected by your vault passphrase exactly as they would otherwise.

Sign-in with GitHub ≠ GitHub as storage

These are two unrelated things that both mention GitHub:

Signing in with GitHub (this page) uses GitHub as an identity provider to log you into your zcrypt account. It grants zcrypt nothing beyond your basic profile and email.

Connecting GitHub as storage is a separate step where you add a personal access token in settings so zcrypt can store your encrypted file chunks in a repository. That is covered in Connect your storage. You can do either, both, or neither.

Sign-in is not storage

OAuth sign-in answers one question: who are you? Where your encrypted data lives is a completely separate decision. You could sign in with Google and store chunks on GitHub, sign in with GitHub and store on HuggingFace, or sign in with a password and store anywhere: the two choices never constrain each other.

Signing in with a provider

Choose Continue with Google or Continue with GitHub on the login page. zcrypt redirects you to the provider, you approve, and the provider sends you back. From there one of three things happens:

  • •Already linked, if that provider account is tied to an existing zcrypt user, you're signed straight in.
  • •Matching email, if a zcrypt account already uses the provider's email and that email is verified, the provider is auto-linked to it and you're signed in.
  • •New to zcrypt: otherwise a fresh account is created with a username derived from your name or email, and a verified email. OAuth-only accounts have no password until you add one.

Why the verified-email rule matters

If a zcrypt account exists for an email that was never verified, zcrypt refuses to auto-link a provider to it and asks you to log in with your existing method first, then link in settings. This stops someone who controls a Google/GitHub account for an unverified address from quietly taking over the matching local account. Tokens are also returned to the browser in the URL fragment, so they never land in server logs or referrer headers.

Linking & unlinking

From your account settings you can see which providers are connected and link additional ones. Linking lets you sign in to the same zcrypt account through more than one identity: handy if you sometimes have Google handy and sometimes GitHub.

You can unlink a provider just as easily, with one guardrail: zcrypt will not let you remove your last remaining sign-in method. If a provider is the only way into your account, add a password or link a second provider before unlinking it: otherwise you'd lock yourself out.

Unlinking a provider only removes it as a way to sign in. It does not delete your zcrypt account, your files, or any storage backend you connected.

Desktop sign-in

The desktop app signs you in through your normal system browser rather than an embedded webview, so you authenticate in a trusted, full-featured browser you already use. The flow:

  1. The app starts an OAuth sign-in with a high-entropy, single-use session identifier and opens the provider in your default browser.
  2. You approve in the browser and land on a short confirmation page.
  3. The app polls a one-time endpoint for that session, receives your tokens once, and the server immediately discards them.

The session identifier must carry real entropy and each result is handed out exactly once, then expires quickly, so the hand-off can't be guessed or replayed to capture your tokens. See the desktop app for the rest of the native experience.

Where to go next