Cryptomator: Client-Side Encryption for Any Cloud Storage

My notes

Summary

Cryptomator is a free, open-source tool that client-side encrypts files and filenames before they sync to any cloud provider (Dropbox, Google Drive, OneDrive, iCloud). Encryption happens locally with AES-256, the provider never sees plaintext, and the code is publicly auditable. It is positioned as a way to keep using consumer cloud storage without trusting the provider’s own encryption claims.

Key Insight

• Zero-knowledge model: encryption and decryption happen on-device before upload, so the cloud provider (and anyone who subpoenas or breaches them) only ever sees ciphertext. Relevant given providers like Dropbox have stated they comply with government data requests.
• Encrypts both file contents and filenames. Many “encrypted cloud storage” tools only encrypt contents, leaking metadata such as file names and folder structure to the provider.
• Uses AES with 256-bit keys, is open source and auditable, and has undergone independent security audits, which reduces the “trust us” risk compared to closed-source encryption tools.
• Desktop is pay-what-you-want (donation-based) and works across Mac, Windows, and Android; mobile apps are typically paid.
• Marketed as GDPR-compliant when paired with a cloud provider that has an appropriate Data Processing Agreement (DPA), useful for teams syncing shared data under EU privacy rules.
• Works as a vault layer on top of existing cloud storage rather than replacing it, so there is no need to migrate providers or change existing sync workflows.