Cryptomator

Cryptomator is a free, open-source client-side encryption tool for cloud storage, enabling users to encrypt files locally before they are uploaded to cloud providers like Dropbox, Google Drive, OneDrive, iCloud, and any WebDAV-compatible service. Developed by Sebastian Stenzel and Armin Schrenk at Skymatic GmbH (Germany) since 2014, Cryptomator has over 12,300 stars as of 2026. Unlike full-disk encryption tools like VeraCrypt or BitLocker, Cryptomator focuses on file-level encryption optimized for cloud synchronization: each file is individually encrypted, enabling efficient partial sync when a single file changes. The encryption architecture uses AES-256-CTR for file content encryption and AES-256-HMAC-SHA256 for authentication, with file-specific content keys derived from a master key using HKDF-SHA256. Directory and file names are also encrypted (using AES-SIV to prevent name leakage). The master key is protected by a user passphrase using scrypt (N=32768, r=8, p=1) for key derivation, and can optionally be stored in a key file for passwordless access. Key features include: cross-platform desktop apps (Windows, macOS, Linux) and mobile apps (iOS, Android) sharing the same vault format, multiple vaults per cloud provider, transparent on-the-fly encryption (files are decrypted in a virtual drive as they are accessed), integration with the operating system's file manager (via WinFsp on Windows, macFUSE on macOS, and FUSE on Linux), vault format 8 (current format with forward secrecy considerations), multi-device access (same vault accessible from multiple devices), and no account registration required. The core library Cryptofs is open-source under LGPL-3.0, while desktop and mobile apps are GPLv3.