Cryptomator

Open source alternative to Tresorit, NordLocker and pCloud Crypto

16.4K stars
GPL-3.0
Active this week
Last commit today

Last verified Nov 4, 2026

Secure cloud files with client-side AES-256 encryption so only you hold the decryption key, keeping Dropbox, Google Drive, and OneDrive private.

Visit website GitHub16.4K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Cryptomator is for#

Individuals storing sensitive documents in a personal cloud drive

If you store tax returns, medical records, ID scans, or legal documents in Dropbox or Google Drive, Cryptomator adds encryption to files the cloud provider would otherwise be able to access. You keep your existing storage and interface; the vault just adds a password step before you can read or write files.

Skip if:

If you need to access these files from devices where you cannot install applications, like a shared work computer or a kiosk, Cryptomator will not help you.

Small teams sharing sensitive client files via cloud storage

A shared Cryptomator vault with a team password lets a small firm, law practice, or accounting team store client files in Dropbox Business or OneDrive without giving those providers access to sensitive documents. Setup requires sharing one vault directory and one vault password.

Skip if:

Teams needing granular per-user access control or audit logs should look at a dedicated encrypted file storage product. Cryptomator has no per-user permissions within a vault.

Privacy-conscious users who distrust cloud provider data policies

Users who want the convenience of cloud sync without accepting that the provider can read their files get the best of both: familiar sync behavior plus zero-knowledge encryption. Scrypt key derivation and AES-256 mean the encryption quality is not a compromise.

Skip if:

If your concern is metadata such as file access times, storage usage patterns, or IP addresses, Cryptomator does not address those; it encrypts only file contents and names.

Developers and IT teams adding encryption to existing cloud backup workflows

Cryptomator can be incorporated into backup pipelines on platforms where it is installed. Sensitive backups can be written into an encrypted vault directory that syncs automatically to cloud storage, keeping the data unreadable to the storage provider without changing the underlying backup tool.

Skip if:

Teams needing enterprise key management, compliance reporting, or integration with identity providers should evaluate a dedicated enterprise encryption tool instead.

the problem

The problem it solves#

Cloud storage providers encrypt data at rest and in transit, but they keep the decryption keys. That means Dropbox, Google Drive, Microsoft OneDrive, and others can access your files if compelled, hacked, or simply subject to a policy change. For anyone storing sensitive client files, medical records, financial documents, or business data in the cloud, this is a real exposure: you have outsourced control of your data to a third-party infrastructure you do not audit.

The common workaround is to switch to a different end-to-end encrypted storage service, which means moving all your files, paying for new storage, and training your team on a different interface. That trades one problem for another. What most people want is to keep using Dropbox or Google Drive and add encryption on top, without giving up their existing sync behavior or paying for a second storage subscription.

how Cryptomator solves it

How it solves it#

Client-side AES-256 encryption

Files are encrypted on your machine before they sync to the cloud. Cryptomator uses AES-256 with individual initialization vectors per file, so each file's ciphertext is unique even if the plaintext is identical. No unencrypted data ever leaves your device.

Virtual drive interface

Cryptomator mounts an encrypted vault as a regular drive letter or volume on your computer. You can open, edit, and save files using any application, and they are encrypted and decrypted transparently in the background. No special software is needed to open files; just unlock the vault with its password.

File name and folder structure obfuscation

Cryptomator encrypts not only file contents but also file names and obfuscates the folder structure inside a vault. Someone with access to your cloud storage cannot determine what files you have stored, their names, or how they are organized.

Works with any cloud storage service

Cryptomator works with Dropbox, Google Drive, OneDrive, MEGA, pCloud, ownCloud, Nextcloud, and any other service that syncs to a local folder. No special integration or API access is needed; it encrypts the sync folder directly.

No accounts and no server component

Cryptomator has no servers, no user accounts, and no network component of its own. Encryption and decryption happen entirely on your device. There is no service to trust beyond the open source code itself.

Multiple vaults with separate passwords

You can create as many vaults as you want, each protected by its own password. This lets you separate personal and professional files, share a vault with one password while keeping another private, or segment sensitive categories of files independently.

strengths · trade-offs

Strengths and trade-offs#

Strengths

GPL-3.0 licensed and independently auditableCryptomator's source code is available under GPL-3.0, which means no hidden backdoors, no undisclosed data collection, and the ability for independent security researchers to audit the encryption implementation. With 16,442 GitHub stars and consistent active development since 2014, it is a mature codebase with a long public review history.
Provider-agnostic encryption layerUnlike Tresorit or NordLocker, which bundle encryption with their own storage, Cryptomator encrypts files inside the sync folder of any cloud service you already use. You keep your Dropbox or Google Drive subscription and add encryption on top without paying for a second storage service.
Cross-platform with consistent vault formatCryptomator runs on Windows, macOS, and Linux, with mobile apps available for iOS and Android. A vault created on one operating system can be opened on any other, so encrypted files follow you across devices regardless of the platform you are using.
Zero-knowledge architecture with no single point of failureEach encrypted file contains all the metadata needed for its decryption, except the key itself, so there is no central database of keys or file mappings to compromise. Loss of one file does not affect the decryptability of others, eliminating a single point of failure in the encryption model.

Trade-offs

-No real-time collaboration inside vaultsBecause files are encrypted per-vault before sync, real-time collaborative editing does not work inside a Cryptomator vault. Applications like Google Docs or Notion bypass this by storing data server-side. With Cryptomator, only one person can open and edit a file at a time to avoid sync conflicts and potential data loss from simultaneous writes.
-Desktop app required on every deviceCryptomator's encrypted vault format is not natively readable through cloud provider web interfaces or mobile apps. You need Cryptomator installed on any device where you want to access your files. If you need to access files from a device where you cannot install software, you are blocked without a workaround.
-Password loss means permanent data lossCryptomator is intentionally zero-knowledge, with no password recovery mechanism, no account to reset, and no server that holds a backup key. If the vault password is forgotten and no backup exists, the encrypted files are permanently inaccessible. This is a tradeoff of the security model, not a bug.

versus alternatives

Cryptomator vs alternatives#

Cryptomator vs Tresorit

Tresorit is a commercial end-to-end encrypted cloud storage service. The comparison with Cryptomator is a choice between a managed storage product and an encryption layer for the cloud storage you already have.

Feature	Cryptomator	Tresorit
License	GPL-3.0	Proprietary
Self-hosting	No server needed	No
Storage provider	Any (Dropbox, Drive, OneDrive)	Tresorit's own infrastructure
Desktop	Free	Subscription required
Zero-knowledge	Yes	Yes

Cryptomator is the stronger fit when you already have a Dropbox or Google Drive subscription and want to add encryption without paying for a second storage service. Its zero-knowledge design and 256-bit AES encryption match Tresorit's security model for the encryption layer itself. Tresorit is worth its subscription if you want a fully managed, integrated product with per-user sharing controls, granular access management, and no need to maintain your own cloud storage subscription separately.

Cryptomator vs NordLocker

NordLocker is Nord Security's end-to-end encrypted cloud storage product, with a free tier and paid plans above that.

Feature	Cryptomator	NordLocker
License	GPL-3.0	Proprietary
Free tier	Unlimited (desktop app)	Capacity-limited
Storage	Your existing cloud provider	NordLocker's cloud
Open source	Yes	No

Cryptomator works on top of storage you already have and is not capacity-limited for the encryption layer itself. NordLocker bundles encrypted storage with a specific cloud backend at a subscription price. Cryptomator is the better fit when storage cost or provider choice matters; NordLocker suits users who want a tightly integrated, all-in-one encrypted backup product and are comfortable with a proprietary implementation.

Cryptomator vs pCloud Crypto

pCloud Crypto is an add-on to pCloud's cloud storage service that adds client-side encryption to a specific folder called the Crypto folder.

Feature	Cryptomator	pCloud Crypto
License	GPL-3.0	Proprietary
Works with existing providers	Any cloud provider	pCloud only
Cost	Free (desktop)	Paid add-on
Open source	Yes	No

Cryptomator works with any cloud storage service, while pCloud Crypto is locked to pCloud's storage. For users already on pCloud, pCloud Crypto is tightly integrated and simpler to set up. For users on Dropbox, Google Drive, OneDrive, or any other provider, Cryptomator is the only viable option between the two.

install · quick start

Quick start#

bash

Download the signed installer for Windows, macOS, or Linux from GitHub Releases: https://github.com/cryptomator/cryptomator/releases/latest

tech stack · detected from GitHub

What it's built on#

Languages: Java

frequently asked

FAQ#

Is Cryptomator free to use?

Yes. Cryptomator is free and open source under the GPL-3.0 license for personal and FOSS projects. The desktop version for Windows, macOS, and Linux is free, with donation and sponsorship options for those who want to support development. Mobile apps for iOS and Android are available in their respective app stores as paid apps.

Does Cryptomator work with Google Drive, Dropbox, and OneDrive?

Yes. Cryptomator works with any cloud storage service that syncs files to a local folder, including Dropbox, Google Drive, OneDrive, MEGA, pCloud, ownCloud, and Nextcloud. It encrypts the contents of the local sync folder so whatever the cloud service uploads is ciphertext, not readable files.

Can someone with access to my cloud storage read my Cryptomator vault?

No. Files inside a Cryptomator vault are encrypted with AES-256 before they sync. Without the vault password, the ciphertext in cloud storage is unreadable. File names and folder structure are also encrypted, so an attacker cannot determine what is stored even if they can browse the cloud directory.

What happens if I lose my vault password?

There is no password recovery mechanism. Cryptomator is zero-knowledge, meaning the password is never sent to any server and there is no account with a reset option. If you lose the vault password, the encrypted files cannot be recovered. Keep a secure backup of your vault password in a password manager.

How does Cryptomator compare to Tresorit as a free alternative?

Tresorit is a proprietary cloud storage service with built-in end-to-end encryption and subscription pricing. Cryptomator is GPL-3.0 licensed and free for desktop use, but it adds encryption to cloud storage you already have rather than providing its own. If you want a fully managed, zero-knowledge cloud storage service with sharing features, Tresorit is more integrated. If you want to encrypt files on a provider you already use at no additional software cost, Cryptomator is the more practical fit.

also worth a look

Similar open-source tools#

Syncthing

Alternative toResilio Connect

Decentralized continuous file sync with no central server

90,005 GitHub stars
Licence MPL-2.0

Android-DataBackup

Alternative toTitanium Backup PRO Key

Full app data backup for rooted Android; Magisk, KernelSU, APatch.

7,556 GitHub stars
Licence GPL-3.0

Kopia

Alternative toVeeam Data Platform

Encrypted, deduplicated backups to any cloud or local storage

14,563 GitHub stars
Licence Apache-2.0

Ente

Alternative toGoogle Photos

E2EE photo backup with face recognition, AI search, and family plans

29,859 GitHub stars
Licence AGPL-3.0

Gitdrive

Alternative toiCloud Drive

Your GitHub repos as a native drive in macOS Finder

129 GitHub stars
Licence MIT

Keda

Alternative toKedify

Event-driven Kubernetes autoscaling with 70+ scalers and scale to zero

10,687 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

154

Security & Monitoring

REA (Reverse Engineer Anything), RustDesk, Uptime Kuma 69

Databases & Storage

Immich, Supabase, Redis

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,889 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

6,568 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Cryptomator vs Tresorit

Feature	Cryptomator	Tresorit
License	GPL-3.0	Proprietary
Self-hosting	No server needed	No
Storage provider	Any (Dropbox, Drive, OneDrive)	Tresorit's own infrastructure
Desktop	Free	Subscription required
Zero-knowledge	Yes	Yes

Cryptomator vs NordLocker

NordLocker is Nord Security's end-to-end encrypted cloud storage product, with a free tier and paid plans above that.

Feature	Cryptomator	NordLocker
License	GPL-3.0	Proprietary
Free tier	Unlimited (desktop app)	Capacity-limited
Storage	Your existing cloud provider	NordLocker's cloud
Open source	Yes	No

Cryptomator vs pCloud Crypto

pCloud Crypto is an add-on to pCloud's cloud storage service that adds client-side encryption to a specific folder called the Crypto folder.

Feature	Cryptomator	pCloud Crypto
License	GPL-3.0	Proprietary
Works with existing providers	Any cloud provider	pCloud only
Cost	Free (desktop)	Paid add-on
Open source	Yes	No