Cryptomator: The Most Secure Encryption for Your Cloud Storage! (And Boxcryptor Alternative)

[@donannsmith5574]

You present the information clearly and without hype. Thank you!

[@bonochromatic6841]

Recovery keys should be stored in a secure Password Manager, which everyone should be using, as should your Vault's password, which should be a strong generated password from your password manager.

[@nikosonex8237]

a password manager is not as secure as you think, A better option is storing passwords in an encrypted UDB drive or in something like this in which you can share your passwords across the cloud using an encrypted OneDrive file

[@alternatuber6698]

@@nikosonex8237 what will happen if your encrypted dongle lost, burnt or unreachable?

[@UKsystems]

@@nikosonex8237 there are actually many options for secure password managers but the best way is to store things like back up keys on an air gap computer

[@cyphersurf890]

Awesome, very helpful & professional content Leo. You're a G! Thanks for your help and wisdom. With that valuable information, I can be PERSPICACIOUS! and ANALYSE the world more effectively. Then, take ACTION & make the smartest moves on the chessboard. Your videos are straight to the point. which is MASSIVE added value. Actionable advice. Actionable info. That's the way to go. How can we support you? Any plans of selling cool merch? - PS: I like your "Saved!" course so far. Very fair price. Great value inside. Thanks again & keep doing what you do!

[@NickyCashAntwerp]

As Always, awesome video. Every Video you make is so interesting. Just great

[@ramcholan2034]

Wow, very clearly explained. Thanks. I have couple of questions which comes to mind as I try to implement. 1. I want to access/save these encrypted files from both work and personal laptop, my work laptop has Bitlocker enabled at drive level, will it affect? 2. if any case cryptomator goes out of business, is it possible to decrypt using any other standard encryption tool like Bitlocker? 3. How to share a encrypted file in place from a OneDrive to a family member? thanks

[@askleonotenboom]

1. Bitlocker will not affect Cryptomator. (Perhaps a very slight slowdown for the double encryption) 2. Cryptomator's encryption is proprietary, meaning no other tool can be used. Even if they do go out of business the existing installations will continue to work. Finally, I always recommend backing up an UNencrypted copy of your data secured some other way. 3. You can't, really. That's part of the point. (You could give them access to your ENTIRE cryptomator vault, I suppose.)

[@ramcholan2034]

@@askleonotenboom very clear responses, thanks.

[@dkhiani]

Awesome walkthru...this is what I've been looking for...could you also give a more detailed explanation/definition of mounted and unmounted drives? Like what does a drive state of "mounted" or "unmounted" actually mean? Would "installed" be a synonym for "mounted"?

[@askleonotenboom]

Install is not a synonym. "Attached" or "connected" might also be good. An external drive is mounted when it's connected, for example.

[@dkhiani]

@@askleonotenboom great...thanks for that Leo

[@pepperparkffm]

Cryptomator is great. However, by default the private key is stored in the cloud aswell. So the whole protection is based on the password strength. For my this is a huge security issue. It is always said that a private key needs to be kept secure as possible. I agree with this.

[@Milesco]

Are you talking about the recovery key that Leo mentions, starting at 4:28 ?

[@pepperparkffm]

@@Milesco No. The private key file Cryptomator is creating while initializing a new Vault. It's stored alongside the encrypted files. If you use a cloud storage, this file is also pushed to the cloud.

[@sunnyflorist]

​@@pepperparkffm afaik that file in itself won't do anything, you still need the password to gain access

[@pepperparkffm]

@@sunnyflorist This "file" is the actual key and is more important than the password itself. If someone can steal this key, it can be brute-forced. Without that key file you will never have any chance to do anything. Thats what I meant.

[@websitesbylou]

Thank you, sir, for the excellent video. Simple, straightforward, and very relevant. Lou from Georgia.

[@sprtwlf9314]

Thanks for the video. Very well explained. I would strongly caution anyone against storing the recovery key on your computer. Attackers look for this such thing and text files as crypto wallet keys are also a series of random words.

[@kevinmcfarlane2752]

I save mine encrypted in the cloud.

[@chrisjackowski591]

on iphone, when you connect cryptomator to google drive, how do you send the files to one of the vaults? can you do it via a safari browser, or should you do it via iphone?

[@PIYUSHMANDALIA]

CABLE OR BLUETOOTH

[@ramcholan2034]

Hi Leo, Can you please make a video of how one can isolate personal documents/activity from work laptop which they have to access during work hours or while at office. 1. scenarios like having to make a stock buy/sell order on broker website and save in excel; fetch and send a tax related document; submit a benefits claim for a amazon receipt. etc. - I am considering to store personal documents on OneDrive encrypted with cryptomator.... primarily accessed from exclusive personal laptop, which is connected to KVM allowing to switch between work and personal. - while at workplace, I am thinking to use a Azure VM with Cryptomater installed accessing the OneDrive - but I am not sure if this will work smoothly. your thoughts/video appreciated.

[@askleonotenboom]

Depending on how intrusive the workplace is, there's no way to absolutely protect yourself. What you do on your work computer can be seen. Period. If that's a problem, then don't do it on your work computer.

[@ramcholan2034]

@@askleonotenboom Thanks for the response, the goal is more for 1) document isolation i.e. not storing any personal documents in work computer as work documents are protected and classified. 2) not having to install any personal software like cryptomator on work computer; the goal is not to hide from any monitoring.,

[@giteshtrivedi]

Thanks a lot for providing crystal clear golden help. How can we use it same with Pcloud? Could you please help.

[@PeterPan-qi8oc]

hi Leo, if we use an offline password manager that is already encrypted and password protected but want to keep a back up of that database vault in the cloud. Should we just upload that database vault as-is or should we run it through cryptomator before it goes on cloud storage? wasn't sure what's best practice in those situation. Would love to get your feedback. Your videos are amazing helpful ... new subscriber :)

[@askleonotenboom]

It REALLY depends on which password manager you're using and how good their encryption is. Most are designed to be uploaded without additional encryption.

[@PeterPan-qi8oc]

@@askleonotenboom aha. got it. Does it hurt to use cryptomator to encrypt an encrypted pwd database before putting it on cloud? in my mind, i am thinking more is better so double encryption is the way to go. not sure if that is bad practice where "double encryption" causes some technical challenges that i have not thought about...thanks.

[@askleonotenboom]

@@PeterPan-qi8oc No harm. Only thing I can think of is of your password manager wants to access the vault directly from your Cryptomator drive it might hiccup - depends on the vault you're using. But if you're just copying it manually for backup, no harm.

[@pleno7764]

I think I just locked myself out, lol. I had everything set up properly and everything was fine until I moved my KeePass database file to my drive created by Cryptomator and locked the drive. Then I realized that I had disabled Syncthing, so my changes hadn’t been synchronized. Fortunately, I already had all those files on my phone. I just have to start over... That was a close call, lol...Great video by the way👍

[@PeterPan-qi8oc]

hi Leo, what is a good way to send sensitive data to other people you work with? putting it on the cloud storage and sharing access is the easy way to do it but data itself is in plain text. If i use cryptomator, the recipient cannot read the files. i guess i could just zip all the files and put password protection of some sort. your thoughts recommendations on this use case? Thank you again

[@askleonotenboom]

What I would do varies depending on the data, the people I'm dealing with, and whether this is a one-time or ongoing sharing. I regularly share a LOT of data with Dropbox, with no additional layer of encryption. I rely on the security of the users (myself and the person I'm sharing with) and trust Dropbox. If it's one time I'm more likely to email an attachment if it's small enough, zipped if it really needs to be encrypted, but in my case it's rare. Finally, you can certainly both use the same Cryptomator account to have things shared encrypted. There's more here: community.cryptomator.org/t/how-do-i-share-files-with-others/41

[@PeterPan-qi8oc]

@@askleonotenboom thank you Leo

[@CR7UX]

You are amazing thank you so much, I have watched a video of yours long time ago. Now I am a subscriber to the channel. One question to ask, if i encrypt a file and upload it somewhere and deleted Cryptomator. Would that affect anything? Let’s say I install Cryptomator a year later can I still decrypt the file I created? Thank you so much.

[@askleonotenboom]

You should be able to reinstall Cryptomator, and as long as you supply the same master password you should be able to view your files.

[@CR7UX]

@@askleonotenboom I don’t use cloud folder the same way you do, I access it via web, is there a way to encrypt it before uploading it?

[@askleonotenboom]

@@CR7UX Well, that's kinda what Cryptomator is all about. So it really depends on EXACTLY how you're using cloud folder. You'll need to encrypt somehow on a PC before uploading, that much I can tell you. Cryptomator makes that all pretty transparent, but you could do something like create a passworded-zip file and upload that manually. But then accessing it's contents cannot happen online, you'll need to download to decrypt as well.

[@oliyile365]

Hi Leo, first of all thank you so much for this excellent video, everything is very clear without too much background music and hypes. I have a question: Eventhough the file is encrypted and locked either in the local pc or cloud drives, the encrypted file(not original) is still accessible if there is a hack. It is possible to just open the encrypted file in a text editor and type some random generated texts and save it. This means the original file is corrupted and no longer can open in its true form. This ends up in losing the file itself. Is there any better way to protect along with the encryption?

[@askleonotenboom]

I've long recommended backing up the unencrypted data regularly. This protects you from the scenario you outline.

[@FulanodeTal-wh8ub]

Very interesting and easy tutorial. What happens if suddenly cryptomator program doesnt exist anymore? How could we acces our encrypted data without the program? Are there any other programs who can unencrypt our data? (obviously with our password)

[@askleonotenboom]

If the program goes away, existing installations will continue to work. But you can easily protect yourself by securely backing up the unencrypted contents of your CryptoMator encrypted folder(s).

[@kevinmcfarlane2752]

There’s a program called AESCrypt that I use that has File Explorer integration but only works on files. However you can zip up a folder and encrypt that. You can also program it, which is what I do for my automated cloud backup.

[@richardmyers7579]

Leo, Thank You for another excellent video. It is going directly in to my Ask Leo file for future reference. Is there any chance you could make a video outlining how to remove all files from Boxcryptor, how to insure that all files have been decrypted and removed from BC, and how to uninstall and remove all tentacles of BC from a Windows 11 computer. I am a paying customer of BoxCryptor, up for renewal on 03-22-23, and BC has notified me that I won't be able to renew and that my account will be locked and no longer accessible on that date. I think that my entire OneDrive is in BoxCryptor. I can probably figure it out, but it is always nice to have a professional opinion. Thanks for all you do, Leo.

[@askleonotenboom]

The process is pretty simple, if tedious: 1) copy all the files from wthin Box Cryptor to a folder anywhere outside of BoxCryptor. 1a) (Back 'em up.) 2) Replace BoxCryptor with something else, or simply remove it 3) Copy all the files to the BoxCryptor replacement

[@philrose7716]

I wish you would do a video on the android application of this program

[@petermorton1607]

Can Cryptomatot be used on an Android tablet's SD card? I sometimes worry that my sd card can be swiped out of my tablet. I know I could encrypt the whole card, but that crestes a lot of issues of its own. I'd like to be able to store an encrypted vault on my sd card...

[@askleonotenboom]

I don't believe so. On mobile it works with the cloud services like Dropbox, etc.

[@vincenthudry7864]

Cryptomator is a paid android app that is compatible with the desktop app. I have a folder protected by cryptomator and simply coping it to my android phone (with syncthing) and I can open the vault inside my phone, very useful if you need something like credit card number that you need on both the phone and the computer yet need it to be obviously very secure

[@txreal2]

Ok, in Windows 10, I checked "RememberPassword". How do I change the settings to require password everytime? I installed MyVault in an external USD SSD. Thanks

[@larvideoscott]

What if my Vault is in the cloud but my pc dies on me. Will I be able to replace the pc and use Cryptomator to decrypt my files in the cloud?

[@askleonotenboom]

Yes.

[@ramneitor]

Wow, really thanks for the info.

[@NoToPCBS]

QUESTION PLS Does it upload the entire encrypted folder every time change something or does it just upload the changes. Thx

[@askleonotenboom]

Cryptomator is designed so that only files which are changed are uploaded.

[@AGoogleUser-e7v]

Hi Leo is it a good idea if I use both veracrypt and cryptomator? Let's say I'm creating a veracrypt file vault then the files I'm going put in that vault are cryptomator encrypted files is that a good idea best of both worlds? Sorry for my bad English thanks in advanced👍

[@askleonotenboom]

You can, but it seems overkill and pointless, to be honest.

[@teegees]

@askleonotenboom So after your recommendation of CM, I decided to try it out with pCloud, since it has a built-in integration with it. This is all using my iPhone, and an iPad acting as another device. So, no PC/Desktop/Laptop involved here. I can see the encrypted files in pCloud, and guess which files are which by their file size. : Is it possible to decrypt (making it viewable) the encrypted file in pCloud, if I brought it back to the CM vault by using the "Save to Files" share action, and selecting the CM Vault as the destination? When I select it for viewing, I'm still seeing the encryption code, not the actual file contents. Also, is it not possible to create a CM vault in a sub-directory of a folder which contains a CM vault? It's telling me "Cryptomator detected an existing vault at this location. In order to create a new vault, please go back and choose a different folder."

[@Eric-bn3dd]

Very good explainations thank you!

[@PeterPan-qi8oc]

Hi Leo, i started using external HD for backup and been testing out cryptomator. your videos & ebook are so useful and helpful. I keep a full system image backup on a external HD which is password protected before it gets mounted. But the ext HD data itself is not encrypted. The external HD is always plugged into my machine - i guess i need to do that for daily incremental backup runs. Does it make sense to encrypt the whole ext HD using cryptomator to protect the data from getting to the wrong hands? What is a good security practice for data kept on an external HD? thank you

[@askleonotenboom]

One thing you can do is password protect you backups using that feature in your backup tool. That avoids adding more software to the mix. For general purpose external drives, either whole-drive encryption (bitlocker, Veracrypt), or tools like Cryptomator can make sense, depending on exactly how you use the drive. Personally I don't encrypt my externals here at home, because they're here at home and the risk is low. I DO encrypt sensitive data I backup, either with the backup tool as mentioned, or by using some other password protection like zip files or GPG encryption.

[@PeterPan-qi8oc]

@@askleonotenboom two quick questions Leo. when you say we can password protect backups using feature in our backup tool - are you referring to the password we enter to mount the external drive? and second question: when you say you do encrypt sensitive data on the externals using back up tool - which tool or feature would that be - is it inside macrium ?

[@askleonotenboom]

@@PeterPan-qi8oc 1) no, I mean the password that your backup program allows you to assign to the backup it creates. I assume you're using an actual backup program (like Macrium Reflect, EaseUS Todo, or many others). 2) Same. yes, Macrium allows you to password protect the backups it creates.

[@PeterPan-qi8oc]

@@askleonotenboom thanks for the clarification. Yes, i just started with macrium reflect (paid version). So, When you do your full system image back up and daily incremental back up on your external drive - are you "not" using the password protection since the external HD is at home (low risk) or are you still using the password protection feature that's available under macrium advanced options to protect your full system image backup file?

[@askleonotenboom]

@@PeterPan-qi8oc I am not using a password within Macrium Reflect. If I felt the need to protect the backups, however, that's exactly what I would use. 🙂

[@hassanmaje5849]

Can one in the same way encrypt native folders (e.g. Desktop, Documents, etc) on the PC that then get backed up and synced to the cloud (such as OneDrive, Google Drive, etc)?

[@askleonotenboom]

Given that Windows makes assumptions about the native folders, I'd say no. I generally avoid using them and focus on setting up my own folders.

[@hassanmaje5849]

@@askleonotenboom I therefore gather that one should make a folder directly in Onedrive or Google Drive folder on the PC such as one you illustrate in your video, and then encrypt it, as opposed to using PC native folders or folders created on PC's C drive and having them backed up and synced to the cloud service. Thanks.

[@askleonotenboom]

@@hassanmaje5849 Folders in OneDrive (for example) ARE on your PC. So you'd create C:\Users\\OneDrive\MyVeryOwnDocuments. You would reference that as the encrypted location, and Cryptomator would "mount" it and have the unencrypted files appear within another driveletter.

[@harrynicolas]

Hi Leo from Philippines, if we download the encrypted files in the secure virtual folder, was it auto-decrypted or still enrypted? If Yes, how to decrypt it? Thank you so much!

[@askleonotenboom]

When you mount the Cryptomator vault, it appears as another drive letter and everything is available unencrypted.

[@erikglimpse]

Cryptomator on Windows definitely has issues related to mounts and their compatibility with the Windows file system. I can't even cd into the mounted drive.

[@askleonotenboom]

I do all the time.

[@ZZ-zg5hy]

Any idea why, when I go to lock the vault, I keep getting a lock failed notification? I have to keep forcing it to lock every time. It doesn't seem to happen if I just store a text document, but if I store a picture or video, it keeps saying lock failed.

[@askleonotenboom]

My *guess* is that a program as a file open on the unlocked volume,

[@RecklessRelapse]

Hi, thank you for the information. I'm not very tech savvy and have a few questions: will the files only be unviewable and fully encrypted when the "lock" function is activated? In other words, when even I can't view the virtual drive is also the only time when attackers will also not be able to view the true data? Also, is there any way to encrypt the files then store them off of my system? Could I even encrypt the files then store them on a cloud service like Google Drive while avoiding them staying on my system? In this video the files remain on your system. I'm storing my photos and video for backups and don't want them on my main SSD. Thank you so much!

[@askleonotenboom]

First: if the vault is "locked" (not mounted) then no, noone can see the true files, only the encrypted blobs. Second: Cryptomator really is designed to be used with services like Dropbox and such that mirror files from your PC to cloud storage. While I expect copying/moving files out elsewhere might be possible, it feels like it would be error prone. If you're looking to that I'd me more tempted to use traditional encrypt tools like zip.

[@NagendraKrishna]

Would anyone be able to help me set up the automatic backup using Google Drive on Cryptomator in Windows?

[@Russell.Jolly.2023]

Cryptomator Hub looks like an impressive tool for teams.

[@osmond_]

Awesome video!

[@mr.boniato6402]

I use it along with Bitwarden to save the security key.

[@fredbennett5285]

Thank you sir !

[@meedily]

But is it secured if you sync it to one drive while it's unlocked on your local machine? What if I just want to leave it unlocked on my machine so I can sync with Chronosync or Pcloud, but I don't want to have to unload it every time?

[@askleonotenboom]

I keep it open all day. The encrypted files are sync'ed as things change.

[@ZoriCalhau]

Cryptomator is very good, I like it a lot but I still prefer CryFS. For me it is superior to Cryptomator.

[@virtualthings9162]

Why Crpytomator is a free software while Boxcrptor is paid subscription. At this point which one is better? When there a FREE VPN and paid one. I need to know before I move on

[@askleonotenboom]

Boxcryptor is no longer an option, to Cryptomator is "better". As to why free software is free ... it varies. askleo.com/people-create-free-software/

[@virtualthings9162]

@@askleonotenboom Great article from you Leo. I appreciate that

[@virtualthings9162]

Hi Leo !!! I got a new question. What is debug mode inside cryptomator? Should I enable it? @@askleonotenboom

[@askleonotenboom]

@@virtualthings9162 I'm not sure. I've not played with it. I suspect you don't need to enable it unless you're trying to track down a problem.

[@sugargliderdude]

is it possible to encrypt a folder on my windows pc and then upload the encrypted folder to my cloud account?

[@askleonotenboom]

Ultimately that's exactly what Cryptomator does. You select a folder to be encrypted, and it does so. That folder can then reside in your BoxCryptor or OneDrive or other service's folder and be synced automatically to the cloud.

[@sugargliderdude]

@@askleonotenboom thanks :)

[@dannid.8115]

Veracrypt vs Cryptomator?

[@askleonotenboom]

Different tools for different purposes. VeraCrypt encrypts entire vaults or disks, whereas CryptoMator encrypts file by file.

[@dannid.8115]

@@askleonotenboom Which one are faster in sync to cloud, with example 3GB Vault of one drive?

[@askleonotenboom]

@@dannid.8115Cryptomator, without a doubt. ANY change will cause the ENTIRE 3GB VeraCrypt vault to need to be updated. Cryptomator encrypts file-by-file thus only changed files need to be uploaded.

[@milanstankovic9435]

Hey Leo, do you know how to recover Google account without password and without phone number? This Google account is very important to me.

[@askleonotenboom]

kzbin.info/www/bejne/qp6ne5p8iNurjbM

[@milanstankovic9435]

@@askleonotenboom thanks

[@portraitonetelo1897]

Hypothetically, the hacker or someone who has managed to get access to your cloud account could just copy the "secure" folder from the cloud and then delete the original cloud copy. Also, then there is ransomware. No doubt, the hacker can't see your data but in this instance, you won't be able to either - maybe, for good. Cryptomator should work on making the "secure" folder delete proof unless, password is provided. Ransomware is something else to contend with too.

[@wykeless]

thats on onedrive not crypomator ...they need to add a feature where you cant delete a files

[@georgebetrian676]

I just want to add my comment here even if it is to a year old answer. Correct, the 'hacker' can delete your cryptomator folder. What can't do is to view the content, that is the important part. That's why I have an external SSD drive encrypted as a backup at home.

[@UKsystems]

Lots and lots of cloud service providers offer ransom protection by having a recycling bin that has an option where it will only delete via expiry

[@MidanRoxy]

Cryptomator is not working all the time, I sent you a message on Ask Leo with a snapshot of the bug which globally said: "Cryptomator didn't expect this to happen. You can look up existing solutions for this error... blah, blah". It is a problem if you can't access your informations for a recovery. Forgive my English as I am French...

[@JackSparrow47038]

Nice

[@epytaffskitchenstink]

can a cryptomator folder be installed on ac el phone?

[@askleonotenboom]

Yes and no. You can install Crytomator on your phone to access a Cryptomator vault stored in OneDrive, Dropbox, or others. But the data is not actually stored on the phone.

[@epytaffskitchenstink]

@@askleonotenboom Thank You for the reply I was about to pay for the Cryptomator app from the play store. I had no luck with Cryptomator in One Drive. As soon as the folders were created I got messages that my account was hacked and I had to un do it so I could use One Drive. Now I'm rethinking One Drive after the Microsoft hack. I guess the Vault isn't secure either. So far I've switched all Outllok to Proton and same with Gmail. Thanks again for reply I watch your videos whenever they come up.