Cryptomator

Overview

Cryptomator is file-encryption software for people who want to add protection to cloud storage they already use. It is a strong fit for individuals who need private file vaults or teams that need managed user and key access. Its focused approach leaves important gaps for anyone who needs protection from a compromised device or wants file metadata concealed.

Files are encrypted on the user's device before upload, using AES with a 256-bit key; filenames are encrypted as well as contents. Its open-source code is publicly available for community security audits, a useful basis for scrutiny rather than a guarantee against every risk. Cryptomator does not protect against malware on the local computer, and timestamps, file counts, and stored file sizes remain visible.

Founded in 2016 and headquartered in Bonn, Germany, Cryptomator pairs personal vault software with Cryptomator Hub for team management.

Key features

• Encryption before upload: Device-side encryption keeps the cloud provider from receiving the files in their unencrypted form. Encryption covers filenames and file contents, but not timestamps, counts, or sizes.
• Provider choice: Cryptomator works with a cloud storage service of the user's choice. On desktop, accessing cloud vaults requires that provider's sync software on the computer, so it is not a substitute for a sync client.
• Mobile integrations: Mobile apps natively support services including Dropbox, Google Drive, OneDrive, pCloud, S3, and WebDAV, though support varies by platform. Mega is currently incompatible with both Android and iOS apps, including through WebDAV.
• Hub for teams: Hub offers user and group management and zero-knowledge key management. It can connect to existing identity management through OpenID Connect, SAML, and LDAP. Organizations can use managed hosting in an EU data center certified to ISO/IEC 27001:2022 or deploy Hub themselves.
• Access and key control: Bring-your-own-key support and hybrid deployment suit organizations that want control over keys and hosting choices. Automated key rotation is not available.

Pricing

The individual Cryptomator plan is free for personal use and includes one seat, unlimited vaults, full desktop access, and community support. It is a capable desktop option for a single user, but does not provide full mobile access at no cost: the free Android and iOS apps are read-only.

Optional upgrades are separate one-time purchases per platform, priced from €29.99; prices may vary by region. They cover desktop dark mode and full Android or iOS access. Since mobile access is platform-specific, users who need full access on both mobile platforms should account for separate purchases.

Cryptomator Hub Community is free, self-hosted, limited to five seats, and includes unlimited vaults. It suits small teams able to manage their own hosting, but does not include managed hosting or the support terms of paid Hub plans.

Hub Standard has custom pricing, charged per seat per month, requires at least three seats, and includes a 30-day free trial, managed hosting availability, and email support. It is the managed option for teams that need support and prefer not to self-host.

Hub Enterprise starts at €10,000/yr excl. VAT and begins at 50 seats. It adds emergency access, priority email support, and a dedicated account manager, making it a large-organization option rather than a step up for a small team. The individual plan includes community support; Hub Standard includes email support.

Platforms

Cryptomator supports Android, iOS, Linux, macOS, Windows, web, and self-hosted deployment. Desktop cloud-vault access depends on the chosen provider's sync software. Mobile users should check platform-specific integration support, and Mega users should look elsewhere for Android or iOS access.

Who it's for

Cryptomator suits individuals who want to encrypt files before storing them with a preferred cloud provider, especially if desktop access and unlimited vaults on the free personal plan meet their needs. It also suits teams that need shared user and group administration with zero-knowledge key management, identity integration, and a choice of managed or self-hosted Hub.

It is a poor fit when the requirement is to hide file sizes or activity metadata, defend against malware already on a computer, or use Mega through the mobile apps. Teams needing automated key rotation should also look elsewhere.

Pros and cons

• Pro: Encrypts file contents and names on the device before upload, while allowing users to choose their cloud provider.
• Pro: Free personal desktop use includes unlimited vaults; optional mobile upgrades are one-time purchases rather than recurring personal subscriptions.
• Pro: Hub supports zero-knowledge key management, group administration, and OpenID Connect, SAML, and LDAP integration.
• Con: Free Android and iOS access is read-only, and full access requires a separate one-time purchase for each platform.
• Con: Desktop vault access relies on the cloud provider's sync software, while Mega is incompatible with the Android and iOS apps.
• Con: Local malware remains outside its protection, and timestamps, file counts, and stored file sizes are not encrypted.
• Con: Hub Enterprise starts at 50 seats and €10,000/yr excl. VAT, a substantial threshold for smaller teams; automated key rotation is unavailable.

Alternatives

Cloud Encryption Software is the broader category to explore when comparing file-encryption options.

MySQL is a freemium option for SQL and NoSQL applications, with replication and high-availability components rather than Cryptomator's stated focus on encrypting files before cloud upload.

Acra is a free-forever option for non-profit and business use, with encryption and masking and a SQL request firewall; consider it when those capabilities are closer to the need than cloud file vaults.

Evervault offers a $995/mo platform plus usage, recommended for under 25K transactions/mo, with card collection, 3D Secure, and network tokens. It is a more relevant option for transaction-oriented requirements than personal cloud file encryption.

Thales CipherTrust Data Security Platform has a free-forever Community Edition with CipherTrust Manager Community Edition and connector licenses for Data Protection; consider it when that platform scope fits better than file vaults.

Protegrity Data Security Platform is another freemium option with a free plan.

Entrust Certificate Manager is a paid option with no free plan; choose it when a certificate-management product is the requirement.

PK Protect is a paid option for Windows and Linux.

Skyflow is a paid option for web, iOS, and Android.

Verdict

Choose Cryptomator if you want device-side encryption for files in cloud storage you select, or Hub's team and key management for a self-hosted or managed setup. Its free desktop plan and provider flexibility are compelling for individuals, while mobile access costs extra and Hub Enterprise has a high entry threshold. Look elsewhere if you need metadata protection, local malware defense, mobile Mega support, or automated key rotation.