How to encrypt files in the cloud with Cryptomator step by step

Informatec Digital » Resources » How to encrypt files in the cloud with Cryptomator step by step

Most people upload documents, photos, or backups to the cloud without giving it much thought, but blindly trusting services like Google Drive, OneDrive, or Dropbox isn't always a good idea if you have even the slightest concern for privacy. While these platforms offer some encryption, you don't control the keys, and ultimately, your files depend on how they handle security.

To truly control your data, the wisest course of action is to encrypt your files before they leave your computer or mobile device . That's where Cryptomator comes in, an open-source tool designed precisely for this purpose: protecting what you upload to the cloud without complicating things, with a simple interface and robust encryption technology that meets the most demanding standards and GDPR compliance.

What is Cryptomator and why use it with the cloud?

Cryptomator is a client-side encryption program designed specifically for cloud services , such as OneDrive, Google Drive, Dropbox, Box, iCloud Drive, ownCloud, or Nextcloud, as long as there's a sync folder on your computer. Instead of relying on the provider's security, your files are encrypted locally on your device before syncing.

One of the biggest advantages is that you don't need to create additional accounts or register personal information to use it. There's no central Cryptomator server receiving your files: the entire encryption and decryption process happens on your computer or mobile device, and the cloud provider only sees encrypted data with no apparent meaning.

The tool creates a "vault" or safe within a folder (for example, inside your OneDrive folder) and mounts that vault as a virtual drive on your system. When the vault is unlocked, you see your files in plain text on that virtual drive; when it's locked, all that remains visible are encrypted files and names that are impossible to interpret.

Cryptomator is cross-platform and open source : it's available for Windows, macOS, and Linux, and also has apps for iOS and Android. It's free on desktop; on mobile, the Android app is paid (around €14,99), while the iOS app is also paid, although it's generally considered a small investment compared to the value of protecting your personal data.

The encryption system is based on AES with 256-bit keys , one of the most widely used standards in modern security, considered strong enough to protect sensitive data. Furthermore, not only are file contents encrypted, but also folder names and part of the folder structure, making it even more difficult for anyone to deduce what you store in your cloud.

Main technical and safety features

From a technical point of view, Cryptomator offers a range of features that make it a very solid option for encrypting files in the cloud, both for individual users and for professionals who handle sensitive information and must comply with data protection requirements such as the GDPR.

The core functionality revolves around the creation of encrypted vaults. Each vault is a special folder where all the files you store are individually encrypted . This means that if you change a single file, only that file is synchronized, not the entire vault, improving performance and reducing bandwidth consumption.

The AES-256 encryption applied to each file is complemented by mechanisms to hide filenames, paths, and file sizes . The resulting directory structure, as seen by the cloud provider, appears "confusing," without recognizable patterns, making it difficult to infer the nature of the documents.

Cryptomator has been audited by independent third parties and is deemed suitable for synchronizing personal data in accordance with the European Union's General Data Protection Regulation (GDPR). This is especially relevant if you are self-employed, work with customer information, or manage medical, legal, or financial data.

Another key advantage is that the tool operates entirely on the client side . There are no additional cloud services, extra transfers, or the need to rely on a new intermediary; it simply encrypts what you're already uploading to your existing cloud provider. This reduces the attack surface and simplifies the threat model.

Compatible platforms and basic requirements

Cryptomator is available for most commonly used operating systems, making it easy to use the same encrypted vault from different devices without any hassle. You can start on a Windows PC and then access the same data from your mobile device, as long as you use the same vault password.

On computers, the application is available for Windows, macOS, and Linux , in fully functional desktop versions. On Windows, you can download installers in EXE or MSI format, while on macOS and Linux, the standard packages for each platform are used. For Linux, there are DEB packages that can be easily installed on distributions like Ubuntu and its derivatives.

On mobile devices, Cryptomator offers dedicated apps for Android and iOS . These apps allow you to access your encrypted vaults, view, add, or modify files from your smartphone or tablet, ensuring a consistent user experience across all your devices.

To function correctly on Windows, Cryptomator relies on WinFSP to mount the virtual drive where the decrypted files are displayed. On systems like Linux, it has traditionally used WebDAV for mounting vaults, although this method can cause occasional problems with certain applications, for example, when opening LibreOffice documents directly from the mounted drive.

In any case, the fundamental requirement is that your cloud service has a sync client that creates a local folder on your computer (for example, C:\Users\YourUsername\OneDrive). Cryptomator will work on that folder to place the encrypted data there, which will then be synced with the cloud.

Install Cryptomator on your computer

The Cryptomator installation process is fairly straightforward on most platforms. Generally, you just need to download the official installer, run it, and follow a few simple steps , without any complex configuration required. Even so, it's helpful to be aware of some specific details depending on your operating system.

On Windows, after downloading the EXE or MSI file from the project website, simply launch the wizard and accept the default options . During the process, the necessary components will be installed, including WinFsp, which is responsible for creating the virtual drive where the decrypted files will be displayed.

On macOS, the process involves downloading the disk image and dragging the application to the Applications folder , as is typical on this platform. Once installed, you can open Cryptomator from Launchpad and begin creating encrypted vaults in your iCloud Drive, Dropbox, OneDrive, or other providers' sync folders.

On Linux, depending on the distribution, you can install a pre-made DEB package. For Ubuntu-based systems, after checking your system architecture (for example, with `uname -m`) , download the corresponding package (32-bit or 64-bit) and install it using tools like `dpkg`. The typical command would be similar to installing any other Debian package, which will then place the program in your applications menu.

Once installed, the next step is to open the application and create your first vault . Before that, make sure your cloud service client (OneDrive, Google Drive, Dropbox, etc.) is already installed and properly syncing a local folder on your system.

Create your first encrypted vault in the cloud

Once you have Cryptomator installed and configured the cloud service you want to use, it's time to create a new vault to store your sensitive files . This process is done from the program's main window and only takes a few minutes.

In the Cryptomator interface, you'll see a button to add a new vault . Clicking it will allow you to choose between opening an existing vault or creating a completely new one. If you select the new vault option, the program will first ask you to enter a name for the vault, such as "Private Documents" or something that clearly identifies its contents.

When you choose a name, Cryptomator will create a directory with that name in the location you specify. Typically, you'll place this folder within your cloud service's directory , for example, in the path C:\Users\YourUsername\OneDrive or in your Google Drive folder. If the program automatically detects the locations of your installed cloud services, you can select them directly; otherwise, you can always use a "Custom Location" and manually navigate to the sync folder.

In the advanced setup options, you can adjust some details, but for most users, the default settings are sufficient . The truly important part comes in the next step: defining the vault password, which will be your master key for encrypting and decrypting all its contents.

Cryptomator will then ask you to enter a strong password, which will form the basis of the encryption . It's crucial that it be long, difficult to guess, and that you don't reuse it from other services. In addition, the program offers the option to generate a recovery or security key, a kind of "emergency key" that will allow you to regain access to the vault if you forget the main password.

It is highly recommended to activate this extra security option and save the recovery key in a reliable password manager , never in the cloud folder itself or on the same unprotected computer. This way, if you ever forget it, you won't permanently lose access to all your encrypted files.

Once you confirm your password and generate your security key (if you're using one), simply click the button to create your vault. In just a few seconds, your new safe will be ready to use and will appear listed on the Cryptomator home screen.

How to unlock the vault and work with your files

With the vault created, the daily workflow is very simple: just unlock it when you need to access your files and lock it when you're finished. While unlocked, it functions like any other drive on the system, to which you can copy, move, or delete documents just as you would with any other folder.

In the Cryptomator main window, you'll see a list of all known vaults on your computer. To access one, select it and click the unlock button. The program will then display a field for you to enter the password associated with that vault . Once validated, Cryptomator will mount a virtual drive on your system: on Windows, for example, it will appear with a new drive letter, such as E: or F:.

From that moment on, you can open your file explorer and browse the virtual drive as if it were a USB drive or an additional hard drive. The documents and folders you see there are decrypted in real time, ready to be read, edited, or deleted. Everything you copy to that drive will be automatically encrypted and saved in the actual vault folder, which in turn syncs with the cloud.

An important point to remember is that you should never directly manipulate the encrypted files you see in the actual cloud folder (for example, the one inside your OneDrive folder). From there, you'll only see files with strange and incomprehensible names; do not attempt to modify or move them manually. Always work from the virtual drive that Cryptomator mounts when the vault is unlocked.

When you're finished using the vault, return to the program window and click the option to lock it. This will unmount the virtual drive and make the data inaccessible without the password, even if the cloud provider or someone with access to the computer tries to snoop in the sync folder.

Additional configuration and security options

In addition to basic vault creation and unlocking functions, Cryptomator offers several configuration options that help you tailor the application's behavior to your security and convenience needs. It's worth taking a few minutes to explore them to get the most out of it.

In the specific settings of each vault, you'll find, for example, the option to set an automatic lock after a period of inactivity . This feature is very useful if you often leave your computer on and get up frequently, as it reduces the risk of someone accessing the virtual drive while you're away.

You also have the option to choose whether you want the vault to unlock automatically when you start your system . While this might seem convenient, from a security standpoint it's best to keep this option disabled, especially if other people have physical access to the device or if it's a laptop you take outside your home or office.

In the mount tab, you can choose whether the drive should be read-only or have write permissions , as well as assign a specific drive letter in systems like Windows. Configuring it as read-only can be useful in situations where you only want to view documents without the risk of accidentally deleting or modifying them.

At a global level, in the application settings, you can enable Cryptomator to start automatically with the operating system , as well as adjust details related to the interface or the mounting method. In some specific environments, for example, on certain Linux distributions, it may be necessary to modify how the vault is mounted to avoid incompatibilities with specific programs.

In any case, the tool's overall philosophy is to keep complexity under control so as not to sacrifice security . Fewer convoluted options mean less room for critical configuration errors, and that's good news for users who don't want to become cryptography experts to protect their documents.

Advantages over other encryption solutions

Cryptomator isn't the only option for encrypting files, but it has several features that make it particularly attractive when it comes to protecting data on cloud storage services . It's an interesting alternative to tools like Picocrypt and other similar solutions, and even to disk encryption options like BitLocker.

One of the main differences is its focus on cloud services like Dropbox, Google Drive, or OneDrive. The application integrates seamlessly with your local sync folder, allowing you to continue using your existing services without changing your workflow . You simply add the encryption layer on top, maintaining your current saving and syncing habits.

While other tools use different algorithms, such as XChaCha20, Cryptomator relies on AES-256, which is widely audited and used extensively in the security field. For most users, the performance difference is minimal, but the confidence in such a proven standard is very reassuring.

Being open-source software adds a level of transparency: anyone can review the code, audit it, or verify that it does exactly what it promises. This contrasts with proprietary solutions where you have to trust the manufacturer's claims without being able to independently verify them.

On the other hand, the ability to create as many separate vaults as you want, each with its own password , helps organize and compartmentalize information. You can use one vault for personal documents, another for work, another for backups, and so on. If a password is compromised, the impact is limited to that specific vault.

All of this makes Cryptomator a kind of "Swiss Army knife" of cloud encryption, with a very successful balance between ease of use, technical robustness and respect for user privacy.

Protecting your files with Cryptomator before uploading them to the cloud allows you to maintain control of your data and reduce your reliance on each provider's internal security . With easy setup, an encrypted vault system, and audited, GDPR-compliant AES-256 encryption, the tool offers a powerful additional layer of defense for anyone who wants to take their digital privacy seriously while still enjoying the benefits of the cloud.