Cryptomator

Cryptomator is an open-source desktop application for encrypting files before they are stored in a cloud-synchronized folder. It suits people who want an additional encryption layer for personal or work documents while continuing to use a storage provider of their choice. Skymatic develops the project; Cryptomator does not include cloud storage capacity or operate your provider's synchronization service.

Vaults and everyday file access

Create a password-protected vault in a local folder, optionally inside an existing cloud provider's sync folder. Unlock it to mount a virtual drive, then use Finder and ordinary applications to read and write its decrypted files. Cryptomator encrypts file contents and file and folder names, and obfuscates the directory structure. Lock the vault after use to remove its mounted decrypted view. Vault options control mounting behavior; encrypted-name tools and recovery functions help manage existing vaults.

Synchronization is performed by the cloud provider's client or your other synchronization software. Accessing the same vault from multiple devices requires the relevant encrypted files to finish syncing. A cloud account and any storage charges belong to that provider. Cryptomator is not itself a backup: deletion, corruption and sync conflicts can still affect encrypted data. Maintain independent backups of the entire vault, including its configuration and masterkey files, and check that backups can be restored.

Passwords and recovery

Choose a strong vault password and securely retain the vault's recovery key separately from the vault. The key can reset the password and is as sensitive as access to the vault itself. Cryptomator cannot reset a forgotten password for you without the appropriate recovery key. The key cannot recreate deleted encrypted file contents and does not replace a backup. Optional macOS Keychain or Touch ID integration can remember a password locally; protect access to that Mac and keychain.

Encryption protects stored vault data, not everything about the computer using it. An unlocked vault exposes plaintext to programs with access, and malware or an editor's unencrypted temporary copies can bypass that protection. File sizes, timestamps and item counts are not all hidden. Changing a password does not re-encrypt every file or necessarily revoke old masterkey copies retained in cloud version history. Consult the security and recovery documentation before changing a recovery strategy.

Mac installation, architecture and mounting

Install the cryptomator Homebrew Cask or choose the official DMG matching your Mac. The recorded Apple Silicon arm64 1.19.3 DMG is 62,393,246 bytes by HTTP HEAD, matching GitHub's release asset size. An x64 DMG is available separately for Intel. Download size is not installed disk use. The official download page lists macOS 11 as the minimum; the recorded Cask declares no numeric minimum, additional dependency or explicit conflict. Windows and Linux desktop packages and Android and iOS apps are separate distributions.

The packaged desktop release carries its runtime components; Maven and a development JDK are source-build requirements rather than an instruction to install a separate JDK merely to use the DMG. Version 1.19.3 updates its runtime to JDK 26.0.1 and JavaFX 25.0.3.

Without an installed FUSE driver, the Mac setup guide describes WebDAV as the default mounting option. Its server is local to the computer, not a public cloud endpoint. The setup guide recommends macFUSE for Intel and FUSE-T for Apple Silicon for smoother browsing. These are optional external drivers, not automatically installed by this Cask. macFUSE has separate licensing and kernel-extension approval requirements; its library is not included with Cryptomator. FUSE-T uses a different implementation. Installing a driver may need administrator authorization or platform security changes, whereas ordinary vault use and driver installation are different permission steps. Choose the documented volume type appropriate to your system instead of assuming all Macs require reduced security. Access to protected document folders may also require macOS authorization.

Cost, licenses and accounts

Desktop encryption and functional features are free on Windows, macOS and Linux. The desktop source is GPL-3.0 software, with component notices applying separately. An optional supporter certificate unlocks dark mode and supports development; it is not a mobile license. No Cryptomator account or subscription is required for an ordinary password-based local vault. Cryptomator Hub is a separate team-access product with its own deployment, account and licensing requirements.

Mobile apps have different terms: current free iOS and Android use is read-only, with paid platform-specific access for writing. A purchase for one mobile platform does not automatically unlock another or grant Hub services. Check current regional prices rather than assuming a desktop donation buys a mobile license.

Official sources: Project, Setup, Volume types, Password and recovery, Security target, Downloads and licensing FAQ.