Encrypt Files Before Cloud Sync on Mac: iCloud Drive, Dropbox and Others

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

What the provider can see by default

Apple says iCloud Drive is not end-to-end encrypted by default. Under standard data protection it is encrypted in transit and on the server, and the encryption keys are held by Apple, so Apple can decrypt the data when you need it, such as when you sign in on a new device. Apple says Advanced Data Protection makes iCloud Drive end-to-end encrypted. See the iCloud Advanced Data Protection guide.

For Dropbox and every other service, read that provider's own documentation. This guide makes no claim about them. Encrypting before sync means the provider receives files it cannot read, whatever its own policy says. Cryptomator's site describes this as a way to protect cloud data yourself, because only you have the key.

Two ways to encrypt before sync

Set up a Cryptomator vault in a synced folder

1. Install Cryptomator from its own site

   Download it from cryptomator.org. On macOS, open the .dmg, accept the license and drag Cryptomator into Applications. If it lists a checksum, you can check it with the file hash tool.

2. Make sure your sync software is installed

   Cryptomator's docs say: "Cryptomator is not a sync tool." You need your cloud service's synchronization software on your Mac.

3. Create the vault

   In Cryptomator, choose Create New Vault… and enter a name. For the storage location, pick a folder inside your synced folder. Cryptomator tries to detect common sync clients, or you can choose Custom Location.

4. Set the password

   The docs ask for at least 8 characters and recommend a longer passphrase. No one else can reset it for you.

5. Create a recovery key

   Optional. The docs say a recovery key gives full access to the vault and can reset its password. Store it as safely as the password, ideally printed. Do not keep it in the same cloud.

6. Unlock and add files

   Unlock the vault. A virtual drive appears. Cryptomator encrypts files as you save them to it.

7. Lock and check

   Click Lock. Cryptomator says your files remain encrypted at the vault's location. Let your sync software finish, then look at the folder on your provider's website. You should see encrypted names, not your own.

Which services work

On a desktop, the docs say you need the cloud service's synchronization software installed, so any service that syncs a folder to your Mac is a candidate. Cryptomator's page lists iCloud, Dropbox, Google Drive, OneDrive, pCloud, Box.com, S3 and WebDAV among the services its iPhone and iPad app supports directly. For the Mac, test with a small vault before you move real files.

Daily habits that keep the vault safe

• Test the password at once. Cryptomator's own advice is to lock and unlock the vault right after you set it. Keyboard layouts and dead keys can change what you type, so use the same layout each time.
• Think before you save the password. The docs say Cryptomator does not store your vault password on your hard drive by default. Saving it in the system keychain is optional, and the docs warn it is a risk if your device is compromised.
• Keep the recovery key off the Mac and out of the cloud folder. The docs say anyone who has it can reset the vault password.
• Lock when you finish. Locked, the files stay encrypted at the vault location.

Limits to know

• Metadata is visible. Cryptomator's security page lists timestamps, the number of files and folders, and file sizes as not encrypted.
• Malware on your Mac. The page says Cryptomator cannot protect you if the computer is infected with malware that reads passwords and file contents from an unlocked vault. It recommends full disk encryption. See what is FileVault on a Mac.
• It is not a backup. The docs say Cryptomator is not a backup solution. Check your provider's version history, or add a separate backup.
• A weak password stays weak. The docs say changing the password does not re-encrypt files, and that once older copies of the key file have synced, you cannot upgrade a weak passphrase. Make a new vault, move the data and wipe the old backups.
• Names can collide. The virtual drive is always case-sensitive, so avoid names that differ only by case.
• Photos. Pictures in the Photos app are a separate case. See photos you do not want in iCloud.