Your cloud provider holds the keys to your files, which is fine right up until it is not. Cryptomator is encryption software that closes that gap: it turns a folder inside Dropbox, Google Drive or OneDrive into a vault that only opens on your own machine, and it runs on Windows, macOS and Linux. The pitch is that it costs nothing. That holds on the desktop, and it stops holding the moment you want the same vault writable on your phone.
Why put Cryptomator on top of a cloud you already trust?
Most providers encrypt your files on their own servers with their own keys, so an account breach or a legal request is a failure mode you never see coming. Cryptomator moves the encryption back to your machine. Everything placed inside a vault is scrambled with AES before it touches the sync folder, using a key derived from a password only you hold, so the provider stores a directory of unreadable blobs.
There is reason to trust that claim beyond the marketing. The code is open source under GPLv3, the cryptographic design is published, not described in vague terms, and an independent security firm has audited it. Skymatic, the German company behind the project, is named and reachable rather than an anonymous account. None of that guarantees a flawless implementation, but the encryption can be checked by anyone who cares to look.
The limitation arrives in the same breath. Cryptomator syncs nothing and stores nothing of its own; it leans entirely on the cloud client you already run. It cannot protect a file you edit outside the vault, and it will not stop anyone sitting at your unlocked computer. Recent desktop releases have gone into recovery rather than new features, adding the ability to rebuild a lost or damaged vault configuration from the recovery key.
How a Cryptomator vault behaves once it is unlocked
Unlocking is where the design stops being abstract. The vault mounts as an ordinary drive: Windows uses the WinFsp driver, macOS uses FUSE-T or macFUSE, Linux uses FUSE. Files copied in are encrypted on write and decrypted on read. Lock the vault and the drive disappears.
Encryption happens per file rather than inside one big container, which is the quiet reason this works with cloud sync at all. Edit a single spreadsheet and one encrypted file changes, so the sync client uploads one file. Locking is not always instant: if a program still holds a document open on the virtual drive, Cryptomator waits and then offers to force the lock rather than failing quietly.
The desktop version is complete and the phone versions are not
Licensing splits by platform, and that split confuses more people than any technical part of the product. Cryptomator Hub, the paid product for shared team vaults, is a separate thing and none of what follows applies to it.
Windows, macOS and Linux
Every encryption function is free. There is no locked tier and no vault limit. A paid supporter certificate exists, but it is a donation with a perk attached: it unlocks dark mode, and it is explicitly not a key that will activate a mobile app.
Android
The app installs free and reads existing vaults. Write access comes from a one-time in-app purchase, or from a standalone license key bought outside Google Play if you would rather not route the payment through it.
iOS
Same shape, fewer escape routes. The app installs free and stays read-only for as long as you like, and write access comes only through a one-time in-app purchase. An iOS key does not carry over to Android, and no bundle covering both exists.
Filename encryption, and the storage a vault will sit on
Contents are only half the problem. Cryptomator encrypts file names and the folder structure too, which matters more than it first appears: documents named after clients or case numbers leak the story even when nobody can open one. What stays visible to the provider is the rough shape of the vault, meaning file sizes and object counts.
Because a vault is just a directory, it lives wherever a directory can live:
Losing the vault password is the one mistake with no repair
Nobody can reset a vault password. Not support, not the developer, not you without preparation, because no server holds a copy of anything to reset. The recovery key is the entire safety net:
There is a subtler trap that the product page never mentions. Changing a vault password does not re-encrypt your files. The password only wraps the same underlying key, so if the old vault configuration was ever synced to a service that keeps file history, an older copy can be pulled back and opened with the old password. The documented remedy is not a password change at all: create a fresh vault, move the files across by hand, and wipe the old backups afterwards.
Cryptomator against VeraCrypt, rclone and NordLocker
VeraCrypt is the obvious free rival and the wrong tool for this job. Its containers are fixed-size volumes, so changing one byte inside a large container marks the whole volume as modified and the cloud client re-uploads all of it. VeraCrypt earns its place on an external drive or a system partition, not in a synced folder. rclone goes the other way: its crypt remote encrypts on the way to the provider and suits scripted backups and servers, but it is a command-line tool with no drive to browse and no vault to unlock with a click. NordLocker sells the polish Cryptomator lacks and bundles its own storage, though the free allowance is small and the product is closed, so its key handling has to be taken on trust.
Pick Cryptomator when you want to keep the cloud you already have and want the encryption open to inspection. Choose VeraCrypt for local disks, rclone if you live in a terminal, or NordLocker if you would rather pay than manage a recovery key yourself.
The case for installing Cryptomator, and when to skip it
If you keep tax records or client work in a cloud account you do not control, Cryptomator is worth the download, and the Windows version costs nothing to try. Skip it if your files never leave one machine, where full-disk encryption already covers you, or if you want one price covering desktop and mobile together. For everyone else, download Cryptomator and generate the recovery key on day one, before the vault holds anything you cannot afford to lose.
