← Privacy Guides

Encryption

Private cloud storage: encrypt it yourself, or pick an end-to-end provider

An ordinary cloud drive (Google Drive, OneDrive, Dropbox, iCloud) can read your files by default, because the provider holds the keys — iCloud offers an opt-in end-to-end mode, but it is off unless you turn it on. You have two ways to fix that: wrap a tool like Cryptomator around the drive you already use, or move to a provider that encrypts everything before it leaves your device. This guide explains the trade-off and how to set either one up.

  • Medium threat
  • Time 45 minutes
  • Difficulty Moderate
  • Last verified

What this protects, and what it doesn't

Protects

  • Provider access to your file contents: with client-side (end-to-end) encryption the service stores only ciphertext and cannot read, scan or hand over readable files.
  • Breaches of the provider: if their servers are compromised or a subpoena lands, there is nothing readable to take.
  • Account-level exposure: someone who gets into your cloud account still faces encrypted vaults rather than your documents.
  • Portability: Cryptomator vaults are just encrypted files, so they move between providers (or to a USB disk) unchanged.

Does not protect

  • A lost password means lost files. Client-side encryption has no "reset" that recovers data; without your password or a recovery key, nobody — including you — can decrypt it.
  • Metadata still leaks to some degree. The provider can see when you sync and roughly how much; Cryptomator hides file names and contents but not the number and sizes of encrypted files perfectly.
  • Your device is the weak point. If malware or someone with access reads the files while a vault is unlocked, encryption does not help.
  • Sharing re-introduces trust. The moment you share a decrypted link or file, the recipient (and any link-handling service) can read it.
  • "Zero-knowledge" is a marketing phrase, not a certificate. Judge a provider by published audits and open-source clients, not the label.

Prerequisites

  • The cloud drive you already use (for the Cryptomator route), or willingness to switch provider (for the end-to-end route).
  • A password manager to store a long, unique vault or account password, and a safe place for the recovery key.

Step by step

  1. Understand the two approaches

    You do not have to leave your current cloud to get real privacy:

    • Wrap your existing drive (Cryptomator): you keep Google Drive, OneDrive, Dropbox, iCloud or Nextcloud, and add a layer that encrypts files on your device before the sync client uploads them. Best when you cannot or do not want to move, or need the provider's collaboration features for non-sensitive files.
    • Switch to an end-to-end provider: a service whose own apps encrypt everything client-side by default, so the smoother experience (mobile apps, sharing, previews) comes built in. Best for a clean start where privacy is the default.

    Both put the key in your hands. The difference is convenience versus reusing what you have.

  2. How Cryptomator works

    Cryptomator is free and open-source (desktop is GPLv3). It creates an encrypted vault — a folder of encrypted files — inside whatever folder your cloud sync client watches. Each file is encrypted individually with AES-256, and the file and folder names are encrypted too, so the provider sees only scrambled names and contents. When you unlock a vault with its password, Cryptomator mounts it as a virtual drive where you work with the decrypted files; the cloud copies stay encrypted the whole time. Cryptomator does not talk to the cloud itself — it relies on the provider's own sync client (or a mounted network drive) to move the encrypted files.

  3. Set up a Cryptomator vault

    1. Install Cryptomator from the official site (desktop) or the iOS/Android app, and download it only from cryptomator.org or the official app stores.
    2. Create a new vault and choose a location inside your synced cloud folder (for example a folder in your Dropbox or Drive).
    3. Set a long, unique password and store it in your password manager. Cryptomator cannot recover it for you.
    4. When prompted, create and save the recovery key somewhere safe and offline; it is the only way to reset a forgotten vault password.
    5. Unlock the vault, and move your sensitive files into the mounted virtual drive. The sync client uploads the encrypted versions automatically.

    The desktop app is free. The iOS and Android apps are free to download but read-only; a one-time in-app purchase unlocks full (write) access. Unlock options depend on your phone — check the app’s settings.

  4. Or choose an end-to-end provider

    If you prefer a service that encrypts client-side by default, look for published security audits and open-source apps rather than the word "zero-knowledge". Commonly cited options, each with its own documentation and pricing to check directly:

    • Proton Drive: Swiss-based, end-to-end encrypted, part of the Proton privacy suite; a common default for individuals.
    • Tresorit: Swiss-owned (part of Swiss Post), end-to-end encrypted and ISO 27001-certified, aimed at regulated teams; check its data-residency options for where your data is actually stored.
    • Sync.com, Filen, MEGA: other client-side-encrypted services; verify each one's audit history, jurisdiction and recovery model yourself.

    Watch for a common catch: some mainstream drives (for example pCloud’s paid Crypto folder) encrypt end-to-end only inside a special folder, not the whole account. If you want everything protected, confirm it covers the account, not just an upsell folder.

  5. Plan recovery before you need it

    The one thing client-side encryption cannot do is rescue you from a forgotten password. Before you store anything important: save the vault password (or account password) in your password manager, save any recovery key offline, and if the provider offers a recovery mechanism, understand exactly what it protects and what it would expose. Test that you can unlock from a second device. The privacy you gain is exactly the risk you take on if you lose the key, so make losing it hard.

Common mistakes

  • Trusting a mainstream drive's own "encryption" to keep files from the provider — standard Google Drive, OneDrive, Dropbox and iCloud hold the keys and can read your files by default (iCloud's opt-in Advanced Data Protection, availability varying by country, is the exception).
  • Storing the only copy of the vault password or recovery key inside the encrypted vault itself, so a lockout is permanent.
  • Putting a Cryptomator vault outside the synced folder, so it never actually reaches the cloud.
  • Assuming "zero-knowledge" on a marketing page means audited; check for a real security audit and open-source clients.
  • Sharing a decrypted link for convenience and forgetting it bypasses all the client-side encryption.

Going further

For files you keep on the device rather than the cloud, see Encrypted files and containers and Full-disk encryption. For a dependable copy that survives ransomware or a provider failure, see Secure backups. When you need to hand a file to someone without any cloud at all, see Secure file sharing.