Vesper

Your own bucket Pro ​

By default, your encrypted entries and photos are stored by Vesper. On Pro you can keep them in a bucket you own instead, on Cloudflare R2 or another S3-compatible service.

Why you might want this ​

  • Storage beyond 5 GB. Content in your bucket does not count against the plan's storage, and you pay your provider directly.
  • You hold the files. Whoever runs the bucket still cannot read them, because they are encrypted with your workspace key. But they are on your account, not ours.

Search, tags and the timeline still run on Vesper; only the files move.

Set up a bucket on Cloudflare R2 ​

R2 has a free tier of 10 GB and no fees for downloads, which suits a journal well.

  1. In the Cloudflare dashboard, open R2 Object Storage and create a bucket, for example my-vesper. The location can stay automatic.
  2. Go back to the R2 overview and choose Manage API tokens → Create API token.
  3. Give it the Object Read & Write permission and limit it to the bucket you just created.
  4. Create the token. Copy the Access Key ID, the Secret Access Key and the S3 endpoint, which looks like https://<account id>.r2.cloudflarestorage.com. The secret is shown only once.

No CORS rules or public access are needed. Only Vesper's server talks to the bucket.

Other S3-compatible services ​

Any service that accepts path-style S3 requests over HTTPS should work, such as Backblaze B2, Wasabi or a MinIO server you run. You need the same four things: an HTTPS endpoint, the bucket name, the region (for example us-east-1; R2 uses auto) and an access key that can read, write and delete objects in that bucket.

Move your content ​

  1. Open Settings → Plan and data and choose Use my own bucket.
  2. Fill in the endpoint, bucket name, region, access key ID and secret access key.
  3. Choose Test and move.

Vesper first writes a small test file, reads it back and deletes it. If that fails, nothing changes and you see what the bucket answered. If it works, Vesper copies your content over, deleting each object from the old place after it is copied, and shows the progress.

Keep the page open until it finishes. Writing is paused during the move. If you close the page or lose the connection, come back and choose Continue moving; it picks up where it stopped.

The access key is stored encrypted with your workspace key, like your entries.

What ends up in the bucket ​

Everything sits under vesper/{workspace id}/:

  • entries/{year}/{month}/{id}.md for each entry
  • photos/{xx}/{hash}.bin and .thumb.bin for each photo and its thumbnail
  • _vesper/icon.bin for the workspace icon

Every file is encrypted, including the ones ending in .md. Do not edit, rename or delete them by hand; Vesper keeps an index of them and a changed file cannot be decrypted. For readable copies, use Export.

Thumbnails of public entries, the public page icon and the share card image stay on Vesper, because the public page has to show them without your key.

Move back or change buckets ​

Move back to Vesper brings everything back, as long as it fits your plan's storage. To use a different bucket, move back to Vesper first and then to the new bucket. There is one move a month, so plan a switch ahead.

If the bucket becomes unreachable, for example because the key was revoked or the bucket deleted, Vesper cannot read the entries stored there and shows the error the bucket returned. Restore access, or import an export into a new workspace.

Deleting the workspace empties the bucket too, as long as the workspace is unlocked. Starting over after losing every passkey cannot open the bucket's key, so empty or delete that bucket yourself.