Cryptomator is open-source, client-side encryption software that creates transparent encrypted vaults inside any cloud storage folder, so files are scrambled on your device before sync and stay unreadable to providers, network snoops, and anyone else without your password.
Cryptomator solves a narrow but important problem: cloud providers encrypt data at rest, yet they still hold the keys, so your documents remain readable to them. The software creates a vault — an ordinary folder that syncs like any other — and encrypts every file and folder name inside it individually before the sync client uploads anything. You unlock the vault with a password, and it appears as a normal drive letter or mounted volume where applications can read and write as usual. Changes are re-encrypted on the fly, so Dropbox, OneDrive, Google Drive, or a plain USB stick only ever stores ciphertext. Nothing routes through a company server, and no account is required.
The threat model is worth understanding before you rely on it. Cryptomator protects data after it leaves your machine and while it sits in a provider's storage; it does not hide metadata such as file sizes, timestamps, or the number of items in a vault, and it cannot protect a device that is already compromised while the vault is unlocked. Pairing it with network-level privacy tooling such as Simple DNSCrypt covers a different layer, keeping DNS lookups away from ISPs and other observers. Because encryption happens locally and the format is documented and open, you can move a vault between providers or keep an offline copy without losing access.
The practical benefit is that you keep using the storage service you already pay for without handing over readable copies of your work. Backups, shared folders, and versioning continue to function because the vault is just a folder; the provider sees opaque files with scrambled names, and a breach at the provider exposes nothing usable. Recovery is straightforward too, since the vault format is open and multiple independent tools can open it. Cross-platform support means the same vault opens on a desktop and on a phone, which matters when you need a document away from your desk. There is no subscription tied to storage, no vendor that can lock you out of your own files, and no learning curve beyond choosing a strong password and keeping a copy of the recovery key. For freelancers, researchers, and small teams handling client records, that combination replaces an awkward manual encryption routine with something that simply runs in the background.
Key capabilities and highlights.
An unlocked vault appears as a regular drive letter or mounted volume, so you can open, edit, and save files from Word, Photoshop, or a code editor exactly as you would in any normal folder. Files are decrypted as they are read and re-encrypted as they are saved, with no manual export, decryption, or re-import step in the middle of your work.
Every file inside a vault gets its own randomly generated content key, which is itself encrypted and stored in that file's header. Sharing or exposing a single file never reveals the master key, so one leaked document cannot be used to unlock anything else in the vault, and deleting a file destroys its unique key with it.
Names are encrypted along with contents, so browsing the cloud account shows only scrambled strings. That stops a provider or an intruder from inferring what you store based on folder names such as tax-returns-2025 or client-contracts, and it also hides the shape of your directory tree and the relationships between files and folders.
Because the vault is nothing more than a folder, it syncs through Dropbox, OneDrive, Google Drive, iCloud Drive, Nextcloud, a NAS share, or an external disk without the provider supporting encryption itself. You keep your existing sync client, sharing habits, and version history while the service only ever stores ciphertext it cannot interpret.
The source code and vault specification are public, so security researchers can review the cryptography and independent projects can build compatible readers. If the main project ever stalled, your data would still be recoverable through other tools rather than being trapped inside a closed, undocumented container that only one vendor can open.
Dedicated Android and iOS apps unlock vaults stored in a phone's cloud integration, so you can read a protected document while travelling without copying plaintext onto the device. The same passphrase and the same vault folder work across desktop and mobile, so you maintain one archive instead of juggling separate copies.
You can export a recovery file when the vault is created and later change the passphrase without re-encrypting every stored file, because only the keys wrapped by the passphrase are rewritten. That keeps long-lived vaults practical when passwords rotate, a laptop is retired, or a team member leaves.
Desktop vaults can also be exposed through a local WebDAV address, which gives applications unable to use a virtual drive a way to open encrypted files. Backup agents, media players, and scripted tools can therefore read and write inside the vault without anyone weakening the encryption or leaving plaintext copies behind.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about Cryptomator.
The desktop versions for Windows, macOS, and Linux are free and open source. The Android and iOS apps are sold as one-time paid purchases, which is how the mobile development is funded. No part of the software requires a subscription or an online account.
File contents are encrypted with AES-256 in CTR mode using a unique key per file. File headers and the keys themselves are protected with AES-GCM, and file names are encrypted with AES-SIV so identical names do not produce identical ciphertext. All keys are derived from your vault passphrase.
No. The provider only receives encrypted files with scrambled names, so it cannot read document contents or infer names. It can still observe metadata such as file sizes, modification times, and how many items a vault contains, which is a known limitation of the design.
There is no backdoor and no reset mechanism, so a forgotten password means the data is unrecoverable. Cryptomator provides a masterkey backup file when you create a vault — store that file separately from the vault and keep the passphrase in a password manager.
Any service that syncs a local folder works, including Dropbox, Google Drive, OneDrive, iCloud Drive, Nextcloud, pCloud, and MEGA, as well as NAS shares, external drives, and plain local disks. The software does not integrate with provider APIs, so no per-service configuration is needed.
No. File sizes are padded only to the encryption block size, and the number of encrypted files roughly mirrors the number of real files, so an observer can estimate volume and size distribution. Cryptomator protects content and names, not traffic patterns or metadata.
Yes. Install the software on each device, point it at the same synced folder, and unlock with the same passphrase. Editing the same file on two devices simultaneously can create sync conflicts, so close documents before switching machines or work on separate files.
Yes, because the format is documented. Cyberduck supports vaults directly, and the command-line tool can decrypt or encrypt files for scripts and servers. On desktop, the local WebDAV address also lets ordinary applications reach files through an unlocked vault.
Microsoft Application Inspector is an open-source source code characterization tool that reports what a codebase actually contains, from cryptography and shell calls to cloud APIs, so teams can assess third-party components before trusting them.
GoodSync is file synchronization and backup software for desktops, servers, and NAS devices. It runs one-way backups or two-way syncs between local folders, network shares, FTP and SFTP servers, and cloud accounts, with scheduling, version history, and AES-256 encryption.
Proton Authenticator is a free, open source two-factor authentication app that stores six-digit codes behind end-to-end encryption and syncs them across phones and desktops, with no ads and no tracking.
Comments