Cryptomator

Overview

Cryptomator is file-encryption software for people who want to keep using their own cloud storage while encrypting files on their device. It suits individuals who want protection for personal files and teams that need managed access to shared vaults. Its focused approach is useful, but it does not hide every trace of file activity or protect a compromised computer.

It encrypts filenames and file contents with AES using a 256-bit key before upload. Its source code is publicly available for community security audits. Cryptomator was founded in 2016 and is headquartered in Bonn, Germany; team features are offered through Cryptomator Hub.

Key features

Device-side file encryption: Encryption happens before files reach the chosen cloud service, so users can add protection without switching to a particular storage provider. The scope is files, not a general-purpose data protection system.

Provider choice with platform caveats: Mobile apps natively support services including Dropbox, Google Drive, OneDrive, pCloud, S3, and WebDAV, with some variation between platforms. Desktop cloud vault access requires the provider’s sync software on the computer. Mega is incompatible with the Android and iOS apps, both natively and through WebDAV, so it is a poor fit for mobile users relying on Mega.

Open-source code: Publicly available source code allows community security audits, a meaningful transparency advantage for encryption software.

Team key and user management: Hub provides user and group management and zero-knowledge key management. It can connect to existing identity management through OpenID Connect, SAML, and LDAP, making it relevant to teams that need to align vault access with established identity systems.

Defined security boundary: Cryptomator does not protect against malware on the local computer. Timestamps, file counts, and stored file sizes also remain unencrypted, so it is not the right choice when those metadata must be concealed.

Pricing

The individual Cryptomator plan is free for personal use and includes one seat, unlimited vaults, full desktop access, and community support. That is a strong starting point for an individual whose primary need is desktop encryption, but it does not make the free mobile apps writable.

Optional upgrades are separate one-time purchases per platform, priced at €29.99, with regional prices potentially varying. They provide desktop dark mode, full Android access, or full iOS access. The Android and iOS upgrades are the relevant purchases for users who need full mobile access; the free versions on both platforms are read-only.

Cryptomator Hub Community is free, self-hosted only, and capped at five seats, with unlimited vaults. It suits small teams able to run their own deployment; it gives up managed hosting and the support tiers included with paid Hub plans.

Hub Standard has custom pricing, billed per seat per month excluding VAT. It starts at three seats, includes a 30-day free trial, offers managed hosting, and includes email support. This is the more suitable Hub option for teams that want managed service rather than self-hosting, though the per-seat model makes team size relevant to cost.

Hub Enterprise starts at €10,000/yr excl. VAT and begins at 50 seats. It includes emergency access, priority email support, and a dedicated account manager, so it is aimed at larger organizations that need those services rather than small teams seeking only shared vaults.

Platforms

Cryptomator spans Android, iOS, Linux, macOS, and Windows, alongside web and self-hosted options. Desktop users need their cloud provider’s sync software to access cloud vaults; mobile users can connect supported storage services natively, subject to platform differences. Hub is available as a managed service or self-hosted deployment, while the free Community tier is self-hosted only.

Who it's for

Choose Cryptomator if you want device-side encryption for files in a cloud service you already use, especially if desktop access and provider choice matter more than concealing metadata. It also fits teams that need zero-knowledge key management and user or group controls, with identity integration as an option. Look elsewhere if you need protection against local malware, encryption of timestamps or file counts, or full mobile access without paying for platform-specific upgrades.

Pros and cons

Pro: Encrypts both file contents and filenames before upload, while letting users choose their cloud storage provider.

Pro: Hub adds zero-knowledge key management and identity integrations for teams, with self-hosted and managed deployment options.

Pro: The free personal plan includes unlimited vaults and full desktop access.

Con: Free Android and iOS apps are read-only; full access requires separate one-time purchases for each platform.

Con: Cloud access on desktop depends on the provider’s sync software, and Mega does not work with the Android or iOS apps.

Con: Local malware remains outside its protection, and timestamps, file counts, and stored file sizes are not encrypted.

Alternatives

For a broader shortlist of products in this category, see Cloud Encryption Software.

MySQL is a freemium option with a free Community Edition for SQL and NoSQL applications, while Cryptomator is focused on encrypting files for cloud storage.

Thales CipherTrust Data Security Platform offers a free Community Edition alongside a broader data security platform; consider it instead if that platform scope fits your needs better than Cryptomator’s file-vault focus.

Acra has a free Community Edition for non-profit and business use, with encryption, masking, and a SQL request firewall. Choose it instead if those database-oriented controls suit the task better than file encryption.

Cosmian Data Protection Suite is a paid option with a free trial and a per-CPU KMS plan. It may suit readers looking for key management with connectors and no per-server limit rather than personal cloud file vaults.

Evervault offers a freemium platform with a $995/mo plan plus usage, recommended for under 25K transactions/mo. It is a different option for transaction-focused needs rather than encrypting files in a chosen cloud storage service.

Skyflow uses custom pricing based on platform fees, data-subject counts, data-localization regions, and feature requirements; consider it for needs that align with those pricing factors rather than Cryptomator’s file-focused use.

Entrust Certificate Manager is a paid product with pricing available by contacting Entrust experts; it is an alternative to assess if its certificate-management focus fits your requirements.

PK Protect is another paid option to compare.

Verdict

Cryptomator is a clear recommendation for individuals who want to encrypt files before they reach a cloud provider they choose, and for teams that need Hub’s zero-knowledge key and user management. Its main strengths are provider flexibility, file-and-filename encryption, and a capable free desktop tier. Choose another tool if you need full mobile access at no charge, protection from local malware, or encryption of file metadata.