# Work without the server

> Keep an encrypted offline copy of your vaults on your device, open it while the server is unreachable, and sync changes made as drafts after you sign in.

URL: https://crunu.com/docs/guides/work-without-the-server
Language: en
Updated: 2026-10-30

When the Crunu server is unreachable, during a maintenance window or a network outage, work doesn't have to stop. Each person can keep an encrypted copy of their vaults on their own device and open it with no server at all. Machines keep their environments too, from the agent's encrypted cache.

Available from Crunu 6.3.0, on app.crunu.com and on [your own server](https://crunu.com/self-hosting/on-premises) alike.

## Turn on the offline copy

Open **Account**, then **Profile**, and turn on **Keep an offline copy of my vaults on this device**. The copy holds every environment you can read, in every organization of your account on this server, and it is kept up to date while you're signed in.

- It's encrypted with a key that comes from your password and Secret Key, so it opens only with both.
- It's kept per device and per account. Turn it on on each device where you want it.
- **Refresh now** updates it at once. **Download .pebble** saves the same copy as a file, after a check with the server.
- A copy is limited to 64 MB per account.
- A private window can't keep a copy, because the browser deletes its data when the window closes.

*Screenshot: Account, Profile, the On this device group: Keep an offline copy of my vaults on this device is on, updated just now, with Refresh now and Download .pebble*

Environments restricted by a network rule are never put into the copy. When an environment becomes restricted, or your access to it ends, it leaves the copy with its draft at the next refresh, and the app tells you.

## Open it without the server

When the server doesn't answer, the web app shows **The server is unavailable** with **Open offline vault**. The same button is on the welcome and lock screens, and the full sign-in form has **Work offline**. Enter your password, and your Secret Key if this device doesn't remember it.

*Screenshot: The server is unavailable: no connection to the server, with Try again, Sign in again and Open offline vault*

The copy opens with an **Offline** badge: “Opened on this device without the server. Changes are drafts until you sign in again.” You can:

- browse organizations, projects and environments, and search;
- read, reveal and copy values, as fields, code or text;
- edit, add, rename and delete files.

The copy locks by hand or after the same idle time as the app, and locking clears the clipboard. You can also open a `.pebble` file downloaded earlier: choose **Open a .pebble copy** or drop the file on the page.

## Changes become drafts

An edit made without the server is saved on the device as a draft: “Draft saved on this device. It will be offered for sync after you sign in.” Nothing is signed while you're offline, and a draft never changes the version history by itself. The sidebar marks environments that have a draft.

*Screenshot: The offline vault opened without the server: the Offline mark, payments-api production marked draft, LOG_LEVEL changed to debug, and the message Draft saved on this device*

**Discard draft** deletes it from the copy. The version on the server isn't affected.

## Sync after you sign in

After the next sign-in, the app reminds you: “You have 1 draft made without the server.” **Sync offline changes** lists the drafts, and each one is saved as a new version of its environment through the normal save. It's signed with the keys and recipients the server has now.

*Screenshot: Sync offline changes for Kiteline: drafts for payments-api production and web-app development, each with a Sync button, and Sync all 2 drafts*

If someone changed the environment on the server meanwhile, the app merges the two. Files changed on both sides go to the same conflict chooser as in the online editor.

*Screenshot: The environment was changed on another device: the same field LOG_LEVEL was changed in different ways; choose My version or Version from the other device, then Apply and save*

Each draft ends as one of:

| Outcome                           | What it means                           |
| --------------------------------- | --------------------------------------- |
| Saved as a new version            | the draft is now a version              |
| Already the same as on the server | nothing to save                         |
| Kept as a draft                   | the conflict wasn't resolved; try again |

A draft that can't be saved, because you lost write access or the environment became restricted, stays on the sync screen. You can discard it, or **Export draft as files**.

## Things to know

- After you change your password or Secret Key, the old copy opens only with the old ones until it's rebuilt. The sync screen keeps its drafts until you decide.
- A copy opened from a `.pebble` file keeps drafts only if you download the updated file.
- Turning the copy off deletes it from the device, drafts included, after a confirmation.
- Anyone who has your Emergency Kit and knows your password can open the copy. Protect the device as you protect them.

## Machines without the server

An agent that restarts while the server is unreachable keeps serving the environments it had from its encrypted cache, `/var/lib/crunu/cache.bin`, until its lease ends: 24 hours by default. `crunu status` shows the state as `offline (from the cache saved …)`. The cache opens only with that machine's own key, and network-restricted environments are never cached. A revoked machine deletes it within one check.

See also [Export and offline copy](https://crunu.com/docs/guides/export-and-offline-copy) for the other export formats.