Cryptomator

Cryptomator encrypts files on a user's device before they are uploaded to a chosen cloud storage service. It uses AES with a 256-bit key and encrypts filenames as well as file contents. The software is open source, with source code available for community security audits. Desktop access to cloud vaults requires the storage provider's sync software on the computer. Mobile apps natively support services such as Dropbox, Google Drive, OneDrive, pCloud, S3, and WebDAV, although availability varies by platform. Mega is listed as incompatible with the Android and iOS apps, including through WebDAV. Free iOS and Android versions are read-only; full access requires a separate one-time purchase for each platform. Cryptomator Hub adds user and group management and zero-knowledge key management for teams, with OpenID Connect, SAML, and LDAP integrations. Hub can be self-hosted or managed; managed hosting is maintained in an EU data center with ISO/IEC 27001:2022 certification. Cryptomator does not protect against malware on the local computer or encrypt timestamps, file counts, or stored file sizes. The personal plan is free; optional upgrades are listed at €29.99, paid once.

Cryptomator offers file encryption before cloud upload, with desktop, mobile, and team options. Check mobile access limits and its stated security boundaries against your needs.

Cryptomator suits individuals who want device-side encryption for files stored with a cloud provider of their choice. Teams can consider Hub for user, group, and key management.

Overview

Cryptomator is file-encryption software that adds protection to cloud storage you already use. It suits individuals who want private vaults and teams that need managed access and key administration. Its appeal is control over file encryption without being tied to one storage provider; its boundary is that it does not conceal every piece of file metadata or secure a compromised computer.

Files are encrypted on the device before upload with AES using a 256-bit key, and filenames are encrypted alongside contents. Cryptomator is open source, with code available for community security audits. Founded in 2016 and headquartered in Bonn, Germany, it focuses on files rather than general-purpose data protection.

Key features

• Provider flexibility: Cryptomator works with a cloud service of your choice, which lets users retain an existing storage setup. On desktop, however, access to cloud vaults requires that provider’s sync software on the computer.
• Mobile integrations: The Android and iOS apps natively support services including Dropbox, Google Drive, OneDrive, pCloud, S3, and WebDAV, with some variation by platform. Mega is currently incompatible with both mobile apps, including via WebDAV, so it is a poor fit for users who depend on Mega mobile access.
• Open-source code: Publicly available source code enables community security audits, a meaningful transparency advantage for security-conscious users.
• Team administration: Cryptomator Hub offers user and group management and zero-knowledge key management. It can connect to existing identity systems through OpenID Connect, SAML, and LDAP.
• Defined security boundary: Cryptomator does not protect against malware on the local computer and does not encrypt timestamps, file counts, or stored file sizes. Users needing protection for those exposures should not treat it as a complete security layer.

Pricing

The free Cryptomator plan is for personal use and includes one seat, unlimited vaults, full desktop access, and community support. The free iOS and Android apps are read-only, so mobile users who need full access must buy a separate one-time upgrade for each platform.

The personal plan is a strong fit for desktop use, but its mobile read-only cap makes the separate platform purchases necessary for editing or other full mobile access. Hub Community gives small teams a no-cost route if they can self-host; it does not include managed hosting. Standard is the more practical step for teams wanting managed hosting and email support, with per-seat monthly pricing and a 30-day trial. Enterprise starts at 50 seats and adds emergency access and higher-touch support, making its €10,000 annual starting price a team-scale commitment rather than an individual option.

The managed Hub service is maintained in an ISO/IEC 27001:2022 certified data center in the EU, while self-hosted deployment is also available. The individual plan includes community support; Hub Standard includes email support, and Enterprise includes priority email support.

Platforms

Cryptomator supports Android, iOS, Linux, macOS, Windows, web, and self-hosted deployment. Desktop cloud access depends on the storage provider’s sync software, while mobile integration is native for several services and varies by platform. Mobile free access is read-only, an important distinction for anyone expecting to manage files from a phone without purchasing an upgrade.

Who it's for

Choose Cryptomator if you want to encrypt files before they reach a cloud provider, keep control of your storage choice, and are comfortable relying on that provider’s sync software on desktop. It also fits teams that need group access and zero-knowledge key management, particularly when Hub’s identity integrations or EU-hosted managed service matter.

Look elsewhere if you need encrypted timestamps, file counts, or file sizes, or if your local devices may be compromised: Cryptomator does not cover those risks. Mobile-first users should also account for the paid full-access upgrades and the Mega incompatibility.

Pros and cons

• Pro: Device-side AES 256-bit encryption covers both file contents and names, adding privacy before cloud upload.
• Pro: Cloud-agnostic operation and broad mobile integrations preserve provider choice, rather than forcing a single storage destination.
• Pro: Open-source code and Hub’s user, group, and key management address transparency and team administration needs.
• Con: Free mobile access is read-only; full Android and iOS access require separate one-time purchases.
• Con: Metadata such as timestamps, file counts, and stored sizes remains exposed, and local malware is outside its protection.
• Con: Desktop cloud vault access requires the provider’s sync software, and Mega is incompatible with the Android and iOS apps.

Alternatives

For a wider comparison of this category, browse Cloud Encryption Software.

Acra is another freemium option with a free community edition and Android, iOS, Linux, API, and self-hosted platforms; choose it when those platform choices and its SQL-oriented encryption and masking focus better match the job. Entrust Certificate Manager is a paid option with Android, iOS, Linux, API, self-hosted, and web support; consider it when you want to discuss pricing with Entrust experts.

Evervault has a free plan and trial, plus a $995/mo Platform plan with usage charges, recommended for under 25K transactions/mo; it is the alternative to consider when that transaction-oriented offering fits better than file vaults. Skyflow is a paid option with a free trial and custom pricing based on platform fees, data subjects, localization regions, and feature requirements, so it is worth considering when those pricing drivers suit your needs.

MySQL offers a free Community Edition for SQL and NoSQL applications, with replication and high-availability components; choose it for database workloads rather than file encryption. Thales CipherTrust Data Security Platform has a free community edition and trial across API, Linux, self-hosted, and web platforms, making it a broader platform alternative to evaluate for those environments. Confidencial is a paid, enterprise-oriented option with custom pricing by demo inquiry. PK Protect is another paid alternative for Linux, macOS, self-hosted, and Windows.

Verdict

Cryptomator is the right choice for individuals and teams who want cloud-provider flexibility with file contents and names encrypted before upload. Its free desktop offering and team-oriented Hub give it a clear path from personal vaults to managed access. Choose another approach if mobile editing without a purchase is essential, if you rely on Mega on mobile, or if your security requirement includes metadata or protection from local malware.