Cryptomator review — encrypt cloud storage without trusting the provider

Cryptomator review

Who is this for? Anyone using a cloud service — Dropbox, OneDrive, iCloud, Nextcloud — who does not want the provider to have access to readable files. Cryptomator encrypts files locally before they are synced.

Cryptomator solves a specific problem: cloud storage is convenient, but the provider technically has access to your files. Cryptomator adds an encryption layer to your existing cloud sync without requiring you to switch services.

Open-source (GPLv3 for the desktop app), made by German company Skymatic, and independently auditable.

---

How it works

Cryptomator creates a vault — a folder on your disk. You unlock the vault with a password, and it appears as a regular drive in your file manager. Everything you store inside is encrypted before it touches the folder.

You place that encrypted folder inside your cloud sync folder (your Dropbox folder, OneDrive folder, etc.). The cloud sync then copies encrypted files to the server — the provider only sees unreadable data.

The key never leaves your device. Cryptomator encrypts locally; the cloud server stores only the encrypted result.

---

Comparison with alternatives

	Cryptomator	VeraCrypt container in cloud	Proton Drive	Tresorit
Cloud-provider agnostic	Yes — works with any service	Yes	No — own service	No — own service
Per-file sync	Yes	No — whole container	Yes	Yes
Open-source	Yes (GPLv3 desktop)	Yes	Partially	No
Free on desktop	Yes	Yes	Limited (free tier)	No
Mobile	Free read-only; €29.99 / ~$30 one-time to unlock write access	Not practical	Yes	Yes
Requires own cloud infra	No	No	Yes	Yes

VeraCrypt note: a VeraCrypt container in a cloud folder works technically but is impractical for daily sync — the entire container must re-sync on every change, even if you modified a single file. Cryptomator encrypts per file, so incremental sync works correctly.

---

Which cloud services are supported

Cryptomator works with any service that syncs files locally via a folder on your disk:

• Dropbox — via the Dropbox desktop app
• OneDrive — via the OneDrive desktop app
• Google Drive — via Google Drive for Desktop
• iCloud Drive — on macOS via the iCloud folder
• Nextcloud — via the Nextcloud desktop client

And any other sync mechanism that uses a local folder, including SFTP mounts or NAS folders.

---

Mobile: free read-only, paid write access

Since mid-2026 both mobile apps are freemium: you download them for free and get read-only access — enough to open a vault and view files. Adding or editing files needs a one-time in-app purchase (a subscription option also exists).

• Android: via Google Play (freemium), or buy a license key for the F-Droid / direct-APK build via cryptomator.org/android/
• iOS: via the App Store (freemium)

The write-access unlock is €29.99 (about $30) on both platforms as of 2026 — Android was raised to match iOS and the old lower Android price no longer applies. Cryptomator applies purchasing-power-based regional adjustments, and both stores show the price in your own local currency at checkout. This is a deliberate choice by Skymatic: the desktop app is free and open-source; the mobile payment funds development. Desktop-only users pay nothing, and mobile users can still read their vaults without paying.

---

Audit

Cryptomator’s cryptographic libraries were independently audited by Cure53 in 2017 (the report is published at cryptomator.org/audits/). The architecture was rated robust with a very small attack surface. One finding was classified “Critical” — a PGP signing key had accidentally been committed to a public GitHub repository; it was passphrase-protected, was rotated, and had no impact on end-user security. This remains the only public third-party audit as of 2026.

The source code is public on GitHub and independently verifiable.

---

Getting started

Install:

• Windows / macOS / Linux: download from cryptomator.org/downloads/
• Linux (Flatpak): via Flathub: flatpak install flathub org.cryptomator.Cryptomator

Create a vault:

1. Open Cryptomator → “Add New Vault”
2. Choose a name for your vault
3. Save the vault inside your cloud sync folder (e.g. ~/Dropbox/MyVault/ or ~/OneDrive/MyVault/)
4. Choose a strong password — this is the only key; no recovery without it
5. Vault created — unlock it via the lock icon

Open and use:

1. Open Cryptomator → click “Unlock” next to your vault
2. Enter your password
3. The vault appears as a drive in your file manager
4. Save files normally — encryption is transparent
5. Lock it again via Cryptomator when done

Migrate existing files:

Encryption only applies to files you store inside the unlocked vault. Existing files in your cloud folder are not automatically encrypted — copy them into the vault manually.

---

Caveats

Password loss is permanent: Cryptomator stores the key nowhere. If you forget your password, your files are permanently inaccessible. Store the vault password in a password manager.

Recovery key: when creating a vault, Cryptomator offers a recovery key — a sequence of words. Store it in your password manager or on paper in a safe location. This is the only fallback if you lose your password.

Sync conflicts: if the same vault is open on multiple devices simultaneously and the same files are modified, your cloud sync may create conflict copies. Avoid keeping the same vault unlocked on multiple devices at the same time.

Cloud search does not work: the encrypted files in the cloud are unreadable to Dropbox or OneDrive search. Search only works while the vault is unlocked locally on your device.

Mobile cost: reading vaults on mobile is now free, but write access needs a one-time €29.99 (~$30) unlock on both Android and iOS — a barrier for mobile-only users who need to add or edit files. For desktop-only use there is no cost barrier.

---

Pros and cons

Pros

• Works with any existing cloud service — no provider switch required
• Per-file encryption — incremental sync stays efficient
• Open-source (GPLv3 desktop), independently audited (Cure53, 2017)
• Desktop completely free; mobile vaults are readable for free
• Skymatic is a German company — no US jurisdiction

Cons

• Write access on mobile needs a one-time €29.99 (~$30) unlock on both platforms
• Password loss = permanent data loss — no recovery without the recovery key
• Cloud search does not work on encrypted files
• No protection if your device itself is compromised (true of all client-side encryption)

---

Conclusion

Cryptomator is the most practical way to encrypt an existing cloud service without switching providers. It fits into an existing workflow without additional subscriptions or new services.

The only real friction is the mobile unlock payment — for desktop use the barrier is low and the approach is solid.

If you already use a cloud service and do not want the provider reading your files: start here.

Next step

Chosen Cryptomator?

• Choose a password manager — the Cryptomator vault password should go in a password manager; this helps you pick one

Similar options

• VeraCrypt review — for local encrypted containers and full-disk encryption without cloud
• Proton Drive review — if you prefer switching cloud services over adding an encryption layer
• Tresorit review — end-to-end encrypted cloud service as an alternative to Proton Drive

Want to go further?

• Backup implementation guide — Cryptomator encrypts cloud storage but does not replace a backup; local copies are still necessary
• VeraCrypt: encrypted storage — for use cases where you do not need the cloud