To keep a cloud provider from receiving readable files, encrypt them on your device before they enter the cloud sync folder. A client-side encrypted vault is a practical option for files you update regularly; an eligible Google Workspace account can instead use Google Drive’s managed client-side encryption. Ordinary provider encryption in transit and at rest protects data in important ways, but it is not the same as encryption performed on your device with keys the provider cannot use.
What “encrypted in the cloud” means
Cloud services commonly encrypt data while it travels to their servers and while it is stored there. Google says Drive uploads and files created in Docs, Sheets, and Slides are encrypted in transit and at rest using AES256. Those safeguards protect against certain threats to transmission and storage, but they do not by themselves mean that the provider cannot decrypt customer content. See Google’s Drive encryption documentation.
As an Amazon Associate I earn from qualifying purchases.
With client-side encryption, an app encrypts the file on a device you control before the cloud sync client uploads it. The cloud stores the encrypted representation, and an authorized device decrypts it when you unlock or open it. This changes the trust boundary: you are responsible for protecting the password or keys and the devices where plaintext is opened. It does not make the file safe from someone who can read it on an unlocked, compromised device.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsChoose an approach that fits how you use the files
| Approach | Good fit | What to consider |
|---|---|---|
| Client-side encrypted vault that syncs through a cloud folder | Files you want to edit and sync over time | A vault app handles encryption and decryption as files are accessed. Cryptomator says it encrypts file contents and names and obfuscates directory structure, while leaving some metadata visible to support synchronization. Platform and recipient compatibility, password recovery, and the app’s security design matter. See its Security Target and Security Architecture. |
| Cloud provider’s built-in client-side encryption | Organizations whose account and administrator support the feature | Google Workspace client-side encryption requires a Workspace account, administrator enablement, and identity verification. Google says it cannot decrypt files protected with this feature. Editing, comments, previews, and other editor functions have limitations; check Google’s feature documentation for the applicable details. |
| Password-encrypted archive for a one-off transfer | A small, occasional transfer where an archive is appropriate | Confirm that the chosen tool encrypts filenames and any metadata you need to hide, not just file contents. The available documentation here does not establish current settings for a particular archive utility, so verify its own documentation before relying on it. |
A vault built for cloud syncing is generally more convenient for files you continue to edit than encrypting an entire disk or applying a local operating-system feature. For example, Cryptomator uses a virtual filesystem: supported apps can work with files in an unlocked vault while the cloud sync folder receives the encrypted form. That workflow depends on the app supporting your operating system and cloud setup.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set up a client-side encrypted vault
The labels and screens differ by app version and operating system. The sequence below describes the essential workflow rather than a version-specific click path.
- Choose and install a supported encryption app. For an ongoing cloud-synced workspace, choose a client-side vault designed to work with cloud storage. Obtain the app from its official source and confirm that it supports your devices and the sync service you use.
- Create a vault and protect it with a strong, unique password. Do not reuse your cloud account password. Check how the app derives and protects its encryption keys; Cryptomator documents its password-derived key protection and 256-bit master keys in its architecture documentation.
- Store recovery material separately and securely. Losing the password or required recovery material can mean losing access to the files. Follow the app’s documented recovery process, keep the recovery copy away from the synced vault, and test recovery before relying on the setup. NIST’s SP 800-111 explains why key location, authentication, and key management are central to storage encryption.
- Put the files inside the unlocked vault. Open or mount the vault using its app, then move or save files into that protected workspace. Do not put the only copy of sensitive files in a regular cloud folder and assume the provider will encrypt them in a way that keeps them unreadable to the provider.
- Let the cloud client sync the encrypted vault representation. Confirm that the cloud folder contains the vault’s encrypted files rather than an unintended plaintext copy. The exact names and layout depend on the vault design; do not expect cloud-side filenames or folders to look like the originals.
- Verify access on another device before removing originals. Install a compatible client there, unlock the synced vault with the necessary credentials, and open representative files. Keep an independent backup and test that you can restore and decrypt it. Sync is not a backup: deletion or corruption can also sync.
- Lock or dismount the vault when finished. This reduces the time files are exposed as plaintext through the unlocked workspace, but does not erase every copy an application or operating system may have created. Protect the device, its user account, and the encryption password as well as the cloud account.
What other people and the cloud provider can still learn
Client-side encryption is not a promise that every trace of activity is hidden. In Cryptomator’s design, contents and names are encrypted and directory structure is obfuscated, but some metadata remains available for synchronization. Depending on the service and vault design, information such as file sizes, timestamps, access patterns, and the presence of encrypted-vault files may still be visible. Do not treat an encrypted folder as anonymous or assume it conceals all usage.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When a vault is unlocked, authorized applications can read plaintext so you can work with it. Malware that captures a password or reads files in an unlocked vault is outside the protection Cryptomator describes in its Security Target. Use device updates and account protections, lock the vault when you finish, and avoid opening sensitive files on devices you do not control.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google Drive’s managed client-side encryption
Google distinguishes ordinary Drive encryption from Workspace client-side encryption. Its help page describes an “Encrypt and upload file” option for supported Drive file types. Using that feature requires a Workspace account, administrator enablement, and identity verification; it is not a general feature for every consumer Google account. Google says it cannot decrypt files protected with Workspace client-side encryption. The same documentation lists limitations to some editing, commenting, preview, and other editor functions. Check the current eligibility and supported file types in Google’s instructions before choosing it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This managed option can suit an organization that has configured the feature and wants users to work within Google’s supported flow. A separate encrypted vault may be more appropriate when you want a cloud-folder workflow across services or need to choose a client-side tool independently. In either case, sharing requires recipients to have compatible access and the necessary identity or key permissions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Windows file encryption is not the same as a portable vault
Windows includes Encrypting File System (EFS) support in some editions, but Microsoft says file encryption is unavailable in Windows Home. EFS is a local Windows feature, not a universal cross-platform vault that automatically provides a portable unlock workflow on another operating system. Before relying on it for cloud uploads, establish your Windows edition and verify that files remain encrypted in the form uploaded and can be recovered on the devices you intend to use. See Microsoft’s file and folder encryption guidance.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft’s OneDrive documentation describes provider safeguards and account or device protections; those are distinct from a user-controlled pre-upload encryption workflow. For OneDrive’s provider-side safeguards, see How OneDrive safeguards your data in the cloud.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before you rely on the setup
- Confirm the encryption happens locally before sync or upload, rather than only after the provider receives the file.
- Understand whether filenames and folder structure are protected, and what metadata remains visible.
- Keep the password or recovery material safe, separate from the synced data, and test that recovery works.
- Check app compatibility on every device and confirm how intended recipients will get access.
- Keep an independent backup and test restoring and decrypting files; synchronization alone does not protect against deletion or corruption.
- Remember that encryption protects stored or transmitted ciphertext, not plaintext displayed on an unlocked device.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
