Cryptomator 1.19.3

Cryptomator editor’s review: open-source client-side encryption for cloud storage

Cryptomator is a mature, open-source client-side encryption tool that encrypts files and filenames locally before they are uploaded to cloud services. Designed to work with Dropbox, Google Drive, OneDrive, S3 and any sync client that uses a local folder, Cryptomator provides per-file AES-256 encryption, scrypt-based key derivation and a transparent virtual drive so applications can access decrypted files natively. The project is actively maintained by Skymatic and the community, with signed releases, reproducible artifacts and public changelogs on GitHub.

Core features and platform coverage

• Per-file AES-256 encryption: File content, filenames and directory structure are protected to reduce metadata leakage while keeping sync efficiency high.
• Virtual mounts: Decrypted vaults are presented via platform-appropriate drivers (WinFsp/Dokany or WebDAV on Windows, FUSE/AppImage/Flatpak on Linux, macOS dmg installs), enabling native file access from any application.
• Cross-platform availability: Desktop apps for Windows, macOS and Linux are freely downloadable from the official site and GitHub releases. Mobile apps are available on Google Play and the App Store; Android supports APK/F‑Droid distribution and an optional one-time unlock, while iOS uses a one-time in-app purchase for write access.
• Transparent open source development: Source code and release artifacts are published on GitHub under GPLv3. Releases include checksums and GPG signatures so users can verify integrity.
• Cryptomator Hub for teams: A managed or self‑hosted Hub option adds zero-knowledge team management and enterprise features for secure, GDPR‑aware collaboration.

Security model and audits

Cryptomator performs all cryptographic operations on the client. Vault passwords are hardened with scrypt to resist brute-force attempts, and AES-256 protects payloads and filenames. The codebase is public, has undergone independent audits, and the project publishes security advisories and fixes via GitHub. Users can verify release artifacts with SHA-256 and GPG signatures published alongside GitHub releases.

User experience and workflow

Setup is straightforward: install the app, create a vault inside a cloud-synced folder, set a strong password, and mount the vault to access decrypted files. The virtual drive supports normal file operations—drag and drop, save-from-app, and editing—without extra steps. Mobile apps include fingerprint/Face ID unlock, background auto-locking and integration with system file pickers for importing and exporting files.

Performance and reliability

Because Cryptomator encrypts files individually, only changed files are reuploaded, which usually reduces cloud sync overhead. Performance is responsive on modern hardware; very large vaults or directories with many small files can affect indexing and thumbnail generation, particularly on mobile. The project follows a regular release cadence with dependency updates and bugfixes visible on the GitHub releases page.

Installers, packaging and verification

• Windows: EXE installer bundles WinFsp for mounts; MSI packages without dependencies are also available. Portable community builds exist via Portapps.
• macOS: Disk images (dmg) are provided for Intel and Apple silicon builds.
• Linux: AppImage, Flatpak (Flathub), AUR and official PPAs cover mainstream distributions; Debian packages are available from Launchpad repositories.
• Mobile: Android: Google Play free install with optional one‑time in‑app unlock or APK/F‑Droid purchases for a platform-specific license. iOS: App Store download with a one‑time in‑app purchase to enable write access.
• Verification: Releases include SHA‑256 checksums and GPG-signed artifacts; the public verification key and instructions are published on GitHub and the website.

Support, community and commercial options

Documentation and step‑by‑step guides live in the project docs, while a community forum and GitHub issue tracker handle support and bug reports. Contact and press channels are listed on the official site; Skymatic offers enterprise services, managed Hub hosting and white‑label partnerships. Funding options include donations, supporter certificates (desktop extras like dark mode) and paid mobile licenses; anonymous purchase options exist for specific channels.

Strengths and trade-offs

• Strengths:
  1. Zero-knowledge client-side encryption compatible with virtually any cloud provider.
  2. Open source, auditable releases with cryptographic verification and active maintenance.
  3. Wide platform support and enterprise-ready Hub for team workflows.
• Trade-offs:
  1. No password recovery: if you lose your vault password or masterkey, data is unrecoverable.
  2. Mobile write access may require a one‑time purchase on some stores; licenses are platform-specific.
  3. Not a real-time collaborative editor: simultaneous multi-user editing requires external collaboration tools layered above encrypted storage.

Who should pick Cryptomator

Cryptomator is best for privacy-conscious individuals, open-source advocates and teams that want straightforward, auditable client-side encryption without changing cloud providers. It’s a good fit when you need end-to-end protection, verifiable releases, and a predictable cross-platform experience from desktop to mobile.

To download installers, verify release artifacts, read the changelog or explore the Cryptomator Hub, visit the official website or the project’s GitHub releases page. Official contact, support and enterprise inquiry channels are available on the Cryptomator site.