Encrypt Files Before They Hit the Cloud (Cryptomator Recipe)

Use any cloud — Dropbox, Drive, OneDrive, S3 — and keep the provider from reading your files. Cryptomator vault setup, sync mechanics, and recovery in one go.

1. STEP 1

   Install Cryptomator

   Free on macOS, Windows, Linux. Mobile is paid one-time (~$15) and worth it for cross-device access. Install on every device that will sync the vault.

2. STEP 2

   Create the vault inside your cloud folder

   Point Cryptomator at, e.g., Dropbox/SecretVault. Set a strong passphrase. Cryptomator generates an encrypted directory tree there — to Dropbox it just looks like random binary blobs.

3. STEP 3

   Mount and use

   Unlocking presents the vault as a virtual drive (V:\\ on Windows, /Volumes/SecretVault on macOS). Drop files in normally. Cryptomator transparently encrypts on write, decrypts on read. Lock when done.

4. STEP 4

   Save the recovery key

   Cryptomator prints a recovery key when you create the vault. Lose your password = lose your data, unless you have this. Save it in your password manager AND somewhere offline (printed paper in a safe).

5. STEP 5

   Sync mechanics

   Cryptomator writes encrypted blobs as small files. Cloud sync handles them like any other file. Delta sync (Dropbox, Drive) works because Cryptomator writes block-level. Bandwidth on first upload of a large vault is the only annoyance.

6. STEP 6

   Test recovery on a different device

   On a friend's machine or a fresh laptop, install Cryptomator, point it at the vault folder synced from the cloud, enter your passphrase. If you can read the files, your setup is solid. If you can't, fix it now while you still have the original.