Cloud storage services like Dropbox, Google Drive, and OneDrive encrypt your data in transit and at rest — but they hold the keys, meaning they can read your files, share them with law enforcement, or expose them in a breach. Cryptomator solves this by encrypting files on your device before they ever reach the cloud. The cloud provider sees only encrypted blobs.
How Cryptomator Works
Cryptomator creates an encrypted vault — a folder that lives inside your cloud sync folder (e.g., inside your Dropbox folder). When you unlock the vault with your password, a virtual drive appears in Windows/macOS/Linux. Anything you drag into that virtual drive is encrypted on-the-fly before being written to the vault folder, which then syncs to the cloud.
The encryption is zero-knowledge: your password never leaves your device, and the cloud provider has no way to decrypt your files.
Encryption used:
- AES-256-GCM for file content
- AES-SIV for file names
- Each file gets a unique random IV (initialization vector)
Installation
Download the desktop app from cryptomator.org — it’s free and open source. Mobile apps (iOS, Android) are paid (one-time purchase).
Available for: Windows, macOS, Linux.
Creating Your First Vault
- Open Cryptomator → click + Add Vault → Create New Vault
- Choose a name and location — create the vault inside your Dropbox/OneDrive/Google Drive folder
- Example:
C:\Users\Pat\Dropbox\SecureVault
- Example:
- Set a strong password — this is the only thing protecting your files. Write it down or store in a password manager.
- Optionally: create a recovery key (store it securely, separate from your device)
- Click Create Vault
Unlocking and Using the Vault
- In Cryptomator, select your vault → Unlock Vault
- Enter your password
- A virtual drive appears (e.g., drive letter Z: on Windows)
- Drag files into this drive — they’re automatically encrypted and stored in the vault folder
When done, click Lock Vault in Cryptomator. The virtual drive disappears and all files are encrypted on disk.
File Name Encryption
By default, Cryptomator encrypts file names — so an encrypted vault just shows random-looking filenames. This prevents metadata leakage (an attacker who accesses your cloud storage can’t see you have a folder called “Tax Returns 2024”).
If you need to access vault contents from multiple devices simultaneously (e.g., a team), be aware that file name encryption causes conflicts with some cloud sync behavior. Cryptomator handles this well with its conflict resolution, but it’s worth knowing.
Mobile Access
The Cryptomator iOS/Android app lets you access vaults directly on your phone:
- Add an existing vault by pointing to your cloud storage (Dropbox, Google Drive, iCloud Drive)
- Enter your password to unlock
- Browse and open files in the secure file browser
Alternatively, use Cyberduck (macOS/Windows) or Mountain Duck to mount vaults as network drives.
Cryptomator vs. Alternatives
| Tool | Approach | Best For |
|---|---|---|
| Cryptomator | Per-file encryption, cloud-compatible | Cloud users who want zero-knowledge |
| VeraCrypt | Encrypted container files | Local storage, offline use |
| Boxcryptor (now Dropbox) | Similar to Cryptomator, commercial | Enterprise |
| rclone crypt | CLI, cloud encryption | Power users, Linux servers |
Backup Your Vault Password
Losing your Cryptomator password = losing all your encrypted data. There’s no recovery mechanism without the password.
Best practices:
- Store your password in Bitwarden or KeePassXC
- Save the Cryptomator recovery key in a separate secure location (different from your main password manager)
- Print the recovery key and store it physically
Performance Considerations
Cryptomator adds minimal overhead for document files. For very large files (video, disk images), the per-block encryption adds some latency. For most personal use (documents, spreadsheets, photos), it’s imperceptible.
Note: Cryptomator creates individual encrypted files for each of your files — so a folder with 10,000 small files creates 10,000 encrypted cloud files. This is fine for sync purposes but takes longer to sync initially than a single container approach.
Cryptomator is the cleanest solution for anyone who wants to use cloud storage without trusting the provider. It’s transparent, open-source audited, and free for desktop use.