# Sync between your Macs > iCloud sync with Pro · 3 Macs, end-to-end encrypted, the recovery passphrase, conflicts, and what Apple and LonelyDuck can't see. Applies to Canto 1.0 beta 3 · Updated Oct 10, 2026 · https://lonelyduck.io/docs/canto/sync Canto can keep your notes in step on up to three Macs through your own iCloud account. Everything is encrypted on your Mac before it leaves, with a key only your Macs have: Apple can't read your notes, and LonelyDuck never receives them. There's no Canto server in between. Sync is part of **Pro · 3 Macs**, with no free tries. Canto Free still runs on a second Mac; it just doesn't sync. A 1-Mac license can be upgraded to 3 Macs; see [Free and Pro](https://lonelyduck.io/docs/canto/pro). ## What you need * Canto Pro for 3 Macs, active on each Mac you sync. * Each Mac signed in to the same iCloud account. * iCloud Keychain, so new Macs get the key by themselves. Without it, you type your recovery passphrase on each new Mac. ## Turn on sync On your first Mac: 1. Open **Settings › Sync & storage** and press **Turn on…** in the iCloud sync row. 2. The sheet says what happens: Canto backs up this Mac's notes first, then encrypts each note here, with a key only your Macs have, before it goes to your iCloud. Press **Turn on sync**. 3. **Choose a recovery passphrase.** It's the only way into your synced notes on a Mac that doesn't get the key from iCloud Keychain, and **Canto can't recover it for you**. Write it down somewhere safe. Nothing is uploaded until you choose one. On your other Macs, press **Turn on…** the same way. They get the key from iCloud Keychain. If it hasn't arrived yet, the row says "Enter your sync passphrase to see notes from your other Macs": press **Enter passphrase…** and type the one you chose. If iCloud Keychain catches up first, the question goes away by itself. ## What syncs Notes, folders, tags, attachments, canvases, projects, chats, templates, actions and styles, and the settings that make sense on every Mac (your palette among them) sync between your Macs. Some things stay on each Mac: version history, downloaded models, keys you saved for servers and web search, your license, window layout and file paths, and the search index, which each Mac builds for itself. ## When changes arrive Changes go to iCloud as you make them. In this beta, Canto checks for changes from your other Macs when you switch to it, when your Mac wakes, and every 5 minutes, so a change can take a few minutes to arrive. **Sync now** looks right away. The row's status says where sync stands in a word, and so does the toolbar's status dot: | Status | Means | | --------------- | -------------------------------------------------------------- | | Synced | Everything is in iCloud, with when it was last up to date | | Syncing | Canto is sending or receiving changes ("Syncing 214 changes…") | | Paused | Your changes stay on this Mac until you resume | | Needs attention | Sync is waiting for you, and the line says why | | Off | Your notes are on this Mac only | ## When two Macs change the same note Canto merges what it can: for most things, such as a title or a folder, the latest change wins, and sets such as a note's tags are merged item by item. When a note's text was edited on two Macs at the same time, **both versions are kept**: the other version becomes a new note named "*title* (conflicted copy from *Mac*, *time*)", which starts with a line linking to the original. Compare the two, keep what you want, and delete the copy. ## Settings for sync On a Mac that syncs, **Settings › Sync & storage** has: * **Pause sync**: your changes stay on this Mac until you turn it off. * **Recovery passphrase › Change…**: choose a new one. Write it down; Canto can't recover it. * **In iCloud**: how much space Canto uses in your iCloud storage. Attachments no note has used for 30 days are removed from iCloud; your files on this Mac stay. * **Old sync folder › Move to Trash…**: Canto 0.10's iCloud Drive sync folder, which 1.0 doesn't use. Move it to the Trash once every Mac you use shows up to date. It goes to the Trash on every Mac signed in to that iCloud account, and iCloud Drive keeps it in Recently Deleted for 30 days. * **Turn off sync › Turn off…**: this Mac stops sending and receiving changes. Your notes stay here and in iCloud, and you can turn sync on again any time. * **Your Macs**: every Mac that syncs, with its macOS and Canto versions and when it was last seen. ### Start over Two choices, each behind a sheet that asks first: * **Replace this Mac with iCloud** makes this Mac match iCloud exactly. Notes only on this Mac are removed; Canto backs them up first and says where. * **Reset sync** deletes Canto's data in iCloud and uploads this Mac's notes again. Nothing on this Mac is deleted; your other Macs ask what to do. When something changed underneath sync (Canto's data in iCloud was deleted, sync was reset from another Mac, or you're signed in to a different iCloud account), the row says so and offers **Upload notes** or **Turn off here**. Your notes are still on the Mac either way. ## Lost your recovery passphrase? If one of your Macs still syncs, open Settings there and use **Recovery passphrase › Change…**. If no Mac has the key any more, choose **Reset sync** on the Mac with the notes you want to keep: Canto's data in iCloud is deleted and that Mac's notes go up again, under a new passphrase. ## What Apple and LonelyDuck can see * **Apple** stores encrypted records in your iCloud. It can see that they exist and how big they are, never what's in them. Your notes, titles, tags, chats and attachments are sealed with your vault's key (AES-256-GCM) on your Mac first. * **The key** travels between your Macs in iCloud Keychain, and is also protected by your recovery passphrase. Neither Apple nor LonelyDuck has the passphrase. * **LonelyDuck** is never involved: Canto talks to your iCloud directly, and nothing about your notes or your sync reaches LonelyDuck. Sync isn't a backup: a note you delete on one Mac goes to the Trash on all of them, and deleting it forever deletes it everywhere. Keep backups too; see [Backups, history and the Trash](https://lonelyduck.io/docs/canto/backups). ## Moving from 0.10's sync The old iCloud Drive sync is gone in 1.0. It kept every edit forever in your database and could lose changes. Canto copied attachments that existed only in iCloud Drive back to your Mac before clearing the old history. Once sync through iCloud is running on every Mac, move the **Old sync folder** to the Trash as above. More in [Upgrading from Canto 0.10](https://lonelyduck.io/docs/canto/upgrade). If sync says something you don't expect, see [Troubleshooting](https://lonelyduck.io/docs/canto/troubleshooting#sync).