Add a second device

You need: the vault on a device that manages devices (its home; the device list marks it Manages devices), a sync target both devices can reach, and Sempere on the new device. Five minutes.

A new device makes its own key, asks to join, and the home device adds it to the vault. Nothing is re-encrypted.

1. Give the vault a sync target

The request to join, and the approval, travel through a sync target the two devices share. If the vault has none yet, add one on the home device: Sync Targets… (sidebar ▸ More, or File ▸ Sync Targets… on the Mac) ▸ Add Folder… (for example a folder in iCloud Drive) or Add WebDAV Server…. See Where to keep your vault.

2. Open the vault on the new device

• From a folder: Open Vault…, choose the .sempere folder, leave Keep syncing with this folder on, and tap Copy.
• From WebDAV: Open from WebDAV…, the server’s URL, user name and password, Test Connection, then Download and Open next to the vault.

Sempere copies the vault onto the device and shows its unlock screen. The device has no key for it yet.

3. Ask to join

On the new device: Join This Device…, then Ask to Join. The device makes its own key, writes a request into the vault, and shows six words and a QR code. Keep this screen open; it checks for the approval every few seconds, and Check Now checks at once.

4. Approve on the home device

1. Settings ▸ Sync & Devices ▸ Devices ▸ Add Device… (on the Mac, also View ▸ Vault Keys).
2. Wait for the request: the sheet says “Asked to join:” and the new device’s name once a sync has brought it. Sync Now speeds that up.
3. Type the six words the new device shows (on an iPad or iPhone you can also Scan QR Code…). You type them rather than compare them, so a near match cannot slip through.
4. Confirm with Face ID, Touch ID or your passcode, and tap Approve.

The home device now shows six words of its own, and a QR code.

5. Confirm on the new device

When the approval reaches the new device, it asks you to type the home device’s six words (or scan its code). Type them and tap Confirm. The vault unlocks, and from now on it opens by itself on this device.

The words in each direction prove something: the home device knows it approved the device you are holding, not one a storage provider slipped in; the new device knows it joined your vault, not a copy someone made.

If something stalls

• No request arrives on the home device: both devices must sync with the same target. Check the sync bar on both, and Sync Now.
• “These are not the words of this vault’s approval”: check the words on the home device again. If they are right, someone may have given the new device a different copy of the vault; do not go on.
• “The request to join expired”: the home device deletes requests after 7 days. Ask to join again.
• The home device is lost: no one can approve. Take over with the recovery kit instead: Replace a lost or broken device.

With the CLI

A computer joins the same way, with the vault folder synced between the machines:

sempere device init --vault ~/Notes.sempere --name "linux box"        # prints six words
sempere devices approve --vault ~/Notes.sempere WORD WORD WORD WORD WORD WORD   # on home; prints six words
sempere device confirm --vault ~/Notes.sempere WORD WORD WORD WORD WORD WORD    # on the new machine

The home device can be the app: approve the computer’s six words in Add Device….