Cryptomator

Overview

Cryptomator is file-encryption software for people who want to keep using their preferred cloud storage without handing it unencrypted files. Its strongest fit is an individual protecting personal files or a team that needs managed access to encrypted vaults. The trade-off is a focused security boundary: it protects file contents and names, not every trace those files leave behind.

Files are encrypted on the device before upload, using AES with a 256-bit key; filenames are encrypted too. Cryptomator is open source, so its code is publicly available for community security audits. That transparency is useful, but it does not remove the need to secure the computer itself: Cryptomator does not protect against local malware, and leaves timestamps, file counts, and stored file sizes unencrypted.

Founded in 2016 and headquartered in Bonn, Germany, Cryptomator offers personal software alongside Cryptomator Hub for team access and key management. It focuses on files rather than broader data protection.

Key features

• Device-side encryption: Files are encrypted before they reach the storage provider, including their names and contents. This suits users who want to add encryption while keeping their existing storage arrangement.
• Cloud-provider choice: Cryptomator works with a cloud storage service of your choice. Desktop access to cloud vaults depends on having that service’s sync software installed, so it is not a standalone cloud-storage replacement.
• Mobile integrations: The mobile apps natively support services including Dropbox, Google Drive, OneDrive, pCloud, S3, and WebDAV, although support varies by platform. Mega is incompatible with both Android and iOS apps, including through WebDAV, so Mega users should not choose Cryptomator for mobile vault access.
• Team controls: Hub provides user and group management and zero-knowledge key management. It can connect to existing identity management through OpenID Connect, SAML, and LDAP, making it more relevant to organizations with established identity systems than to individuals.
• Hosting choice: Hub is available as a managed service or self-hosted deployment. The managed service is maintained in an EU data center certified to ISO/IEC 27001:2022; self-hosting gives teams a deployment option without managed hosting.

Pricing

The personal plan is free for personal use and includes one seat, unlimited vaults, full desktop access, and community support. It is a practical starting point for desktop users, but the free Android and iOS versions are read-only, so they are not a full mobile workflow.

Optional upgrades cost €29.99 per one-time purchase per platform, with prices potentially varying by region. They include desktop dark mode and full Android or iOS access. Mobile users need to account for a separate purchase for each platform they want to unlock; these are not recurring subscriptions.

Cryptomator Hub Community is free, self-hosted only, and limited to five seats with unlimited vaults. It suits small teams able to run their own deployment, but does not provide managed hosting.

Hub Standard has custom pricing, billed per seat per month excluding VAT, with a three-seat minimum and a 30-day free trial. It includes email support, and managed hosting is available, which makes it the more fitting Hub tier for teams that want a managed option rather than operating the service themselves.

Hub Enterprise starts at €10,000/yr excl. VAT, for 50+ seats. It adds emergency access, priority email support, and a dedicated account manager. That minimum scale and starting price make it a choice for larger organizations, not a small-team upgrade.

Individual users receive community support; Hub Standard includes email support, while Enterprise includes priority email support.

Platforms

Cryptomator is offered for Android, iOS, Linux, macOS, and Windows, as well as web and self-hosted environments. Desktop cloud-vault access requires the chosen storage provider’s sync software on the computer. Mobile support depends on the provider and platform, and the read-only free mobile versions limit what users can do before purchasing full access.

Who it's for

Cryptomator is a strong fit for individuals who want device-side encryption for files stored with a cloud provider they already use, especially on desktop. It also suits small teams that can self-host Hub, or larger organizations that need identity integration and managed key and access controls. It is a weaker fit for people who need full free mobile access, rely on Mega on mobile, or need protection for metadata or against malware on the local computer.

Pros and cons

• Pro: Encrypts both file contents and filenames before upload, adding protection without requiring a particular cloud provider.
• Pro: Open-source code is publicly available for community security audits.
• Pro: Hub combines user and group management with zero-knowledge key management and established identity integrations.
• Con: Free mobile apps are read-only; full Android and iOS access requires separate one-time purchases.
• Con: Desktop vault access depends on the provider’s sync software, and Mega is incompatible with the mobile apps.
• Con: Local malware and metadata such as timestamps, file counts, and stored file sizes remain outside its protection.

Alternatives

Cloud Encryption Software is the broader category to compare if Cryptomator’s file-focused, provider-agnostic approach is not the right fit.

• MySQL is a freemium option on desktop, self-hosted, and API platforms, with a community edition for SQL and NoSQL applications and replication and high-availability components; choose it when those database capabilities matter more than Cryptomator’s cloud-file vaults.
• Acra offers a free-forever community edition for nonprofit and business use, with encryption and masking and a SQL request firewall; consider it when those database-oriented controls are a closer match than file encryption.
• Evervault offers a $995/mo platform plan plus usage, recommended for under 25K transactions/mo and including card collection, 3D Secure, and network tokens; it is the alternative to consider for that payment-oriented use case.
• Thales CipherTrust Data Security Platform has a free community edition with CipherTrust Manager Community Edition and connector licenses for data protection; choose it when that platform and connector focus is preferable to encrypting cloud files.
• Entrust Certificate Manager is a paid option with no free plan; consider it if you want to compare against a paid certificate-management product.
• Cosmian Data Protection Suite is a paid suite with a free trial and per-CPU KMS pricing, all connectors included, and no hidden costs; it may suit teams seeking that KMS model rather than Cryptomator’s vault-based file protection.
• Protegrity Data Security Platform is another freemium option to compare.
• Virtru Data Security Platform is a paid option with a Starter plan at $119.00 per month billed annually, including five users; consider it if that paid plan structure better suits your team.

Verdict

Choose Cryptomator if you want to encrypt files on your device before they enter a cloud service, while keeping provider choice and a free desktop plan. Its open-source code and broad storage compatibility are compelling for that job. Look elsewhere if your priority is full mobile use without separate purchases, metadata protection, or defense against malware already running on the computer.