Cryptomator, a client-side encryption tool for cloud files (and more), has seen a new major release. The latest 1.5.0 version comes with a brand-new user interface, a new vault format, and various other improvements.
Cryptomator is a free and open source Java tool that provides client-side encryption for your cloud storage files, available for Windows, Mac and Linux. There are also iOS and Android applications – these are open core (a business model for the monetization of commercially produced open-source software), and need to be purchased.
It works with cloud storage services that synchronize with a local directory, like Dropbox, OneDrive (on Linux using e.g. OneDrive Free Client fork) and Google Drive (including using it with Insync). You can choose to either encrypt your whole cloud storage, or only a few sensitive files, in either a single or multiple vaults.
It’s worth mentioning that while Cryptomator was created with cloud storage encryption in mind, it can also be used to encrypt a folder on your system or some external drive.
Cryptomator uses client-side encryption, it means your data is first encrypted and only then synchronized with the online cloud storage service, so no unencrypted data leaves your computer. Internally, Cryptomator uses FUSE, WebDAV or Dokany, depending on what you want to use and the operating system you’re using, to provide the virtual, unencrypted drive.
For encryption, Cryptomator encrypts the file contents as well as the filenames using AES with 256-bit keys (unlimited strength policy bundled with native binaries), while the passphrase is protected against brute force attacks using Scrypt, a password-based key derivation function (which is designed to be computationally intensive, so the attacker would need to perform the operation billions of times).
 |
| Cryptomator 1.5.0 with a vault unlocked, and the vault opened in Nautilus (GNOME Files) file manager |
The latest Cryptomator 1.5.0 release comes with a full rewrite of the user interface, with the goal of making “the onboarding process easier for users”. The vault unlock, vault add, and vault options have all been redesigned, and there’s a new option to change the vault password. Also, the password input has been improved with a Caps Lock indicator and an option to reveal the password.
There’s also a new option to reset a vault’s password using recovery keys.
 |
| Unlock vault screen and Vault Options |
 |
| Add Vault password screen (left) / Cryptomator 1.5.0 Preferences (right) |
The user interface redesign also comes with themes support, and a new dark mode, but this needs to be unlocked by buying a donation key which helps support the development of Cryptomator.
I want to add a note here, about the new user interface. On my Ubuntu 20.04 GNOME Shell desktop, the main Cryptomator window can’t be moved by dragging it using only the left mouse button, but only after unlocking a vault. In case you’re having the same issue, hold down the Super or Alt key (depending on the desktop environment you’re using) and then drag the window using the mouse left button to move it. I did not have this issue while trying Cryptomator on Manjaro with Xfce.
Under the hood, Cryptomator 1.5.0 introduces a new vault format 7, in which the ciphertext file layout has been redesigned, with filenames encoded with base64url so that name shortenings are less likely.
It’s important to note that vaults created using older Cryptomator versions need to be upgraded when using the latest Cryptomator (and after doing so, the vault will no longer work in older Cryptomator versions). When accessing a vault created using an older Cryptomator version, you’ll see a button to upgrade the vault.
More changes in Cryptomator 1.5.0:
- Improved tray menu: added vault list, unlock and lock per vault, and option to lock all vaults
- Added support for right to left interface orientation
- Added compatibility checks for underlying filesystem
- Added “auto-start” setting on Windows and macOS
- Added “start hidden” setting
- Added
-Dcryptomator.minPwLengthconfiguration variable to set minimum password length, with the default being set to 8 for GDPR compliance - Improved update checker
- Improved termination handler to automatically lock vaults
- Fixed compatibility with certain Google Drive sync clients, where renaming long filenames into short ones didn’t work
- Fixed high CPU usage under certain conditions
- Fixed duplicates in vault list
- Linux:
- Fixed excessive RAM and CPU usage with certain versions of Mesa
- Support more than three simultaneous mounts with FUSE
- Windows: fix GUI freeze and slow writing when using Dokany
- macOS:
- Removed “keystroke receiving” prompt on macOS Catalina
- Fixed crash on macOS Catalina when file chooser dialog was shown
- Fixed usage of FUSE when device is offline
- Support for more than three simultaneous mounts with FUSE
I should note that on my Ubuntu 20.04 desktop with GNOME Shell, Cryptomator doesn’t have a tray icon. The application did have a tray icon in my test on Manjaro Xfce.
Download Cryptomator
On the downloads page there are Cryptomator binaries for Linux, Microsoft Windows and macOS. The source is available on GitHub. The Cryptomator download page also has links to the Android and iOS app store, but the mobile apps are not free!
On Linux, Cryptomator is offered as a generic AppImage binary that should run on any Linux distribution. To run it, make the .AppImage file executable (either from a terminal using chmod x cryptomator-1.5.0-x86_64.AppImage, or using your file manager, from the file properties), then double click the AppImage to run it.
There’s also a PPA (which oddly packages the AppImage, the differences being that you’ll get automatic updates and an application menu entry for Cryptormatoir) for Ubuntu and Ubuntu-based Linux distributions (Linux Mint, Pop!_OS, Elementary OS, Zorin OS, etc.) and an Arch Linux AUR package available.
