Cryptomator mounts a vault the host cannot open

The Cryptomator homepage is two cards. Left: You, a robot, a cloud. "Encrypt personal documents, photos, and work files in any cloud." Download Free. Right: a team, a gold key, Cryptomator Hub. "Collaborate securely using centralized access management and zero-knowledge encryption." Start Free Trial. Read only the headlines and you bought a European Dropbox.

You did not.

Scroll to how it works. Their line, not ours:

To start with Cryptomator, you assign a password for a folder - we call it a vault - within your cloud. That is all. No complicated key creation, no registration, no configuration!

— cryptomator.org

Unlock it and you get a virtual drive, "just like a USB flash drive." Drag a file onto that drive and Cryptomator encrypts it on the way through. AES, 256-bit, files and filenames. Their punchline:

If someone looks into the folder in your cloud, they cannot draw any conclusions about your data.

— cryptomator.org

The host never mounts it

Skymatic GmbH in Bonn ships the apps. The plot is the drive. You keep Dropbox, Google Drive, OneDrive, iCloud, Nextcloud, or whatever already holds the folder. Cryptomator sits on the device: WinFsp on Windows, macFUSE on a Mac, FUSE on Linux, WebDAV as a last-resort loopback if those are missing. There are no plaintext copies waiting on disk. Every read and write through the virtual volume is encrypted on the fly. Desktop 1.19.3 shipped on 29 June 2026.

That is why it is not Tresorit. Tresorit is encrypted storage you log into. Cryptomator is a vault you drop onto storage you already pay for. Lose the vault password and Skymatic cannot open it for you. That is the product working. It is also why a share link that opens in a stranger's browser is the wrong ask. The other person needs Cryptomator, or they are looking at noise.

Free on the desktop. Write access costs a platform.

Pricing on 3 September 2026, Managed, monthly: Individual is Free for personal use — unlimited vaults, any supported cloud, full desktop. Optional upgrades sit under that card. Dark mode on desktop from €29.99, the supporter certificate; it does not cover a phone. Full write access on Android is €29.99, once. iOS is another €29.99. Free mobile is read-only. A licence on one store is not a licence on the other. There is no bundle. Android can skip the gatekeeper: APK or F-Droid, paid on their site. iOS cannot.

Hub Standard, on that same monthly toggle, is $15.00 excl. VAT per seat per month, with a 30-day trial and no card. Flip to Yearly and the card reads $12.00, save 20%. A seat is a person who can open a vault, not every account in your directory. Paid Hub includes mobile write without buying the app. Community is free, five seats, self-hosted only. Paid plans do not throw in those five seats. Managed Hub and Keycloak sit in an ISO/IEC 27001:2022 data centre in the EU. Self-host and the uptime is yours.

Hub brokers keys. It does not hold them.

A shared vault password is a group chat with a secret. Hub is the other shape. You assign people and groups. They unlock through their account, not a passphrase someone pasted into Slack. The docs call Hub a key broker. The FAQ on the pricing page is shorter:

No, Cryptomator Hub only adds zero-knowledge key management to Cryptomator. And Cryptomator takes care of encrypting your files on your device. We recommend you to store your vaults on a cloud storage of your choice.

— cryptomator.org/pricing, Do you offer cloud storage?

Their security write-up is colder. Vault keys travel as encrypted tokens. The Hub never sees them in cleartext. Compromise the Hub instance and you still cannot read the folder. The chain on a device is private key, then user key, then vault key. Add a laptop and only the user key is wrapped for that machine. You do not re-encrypt every vault. Files stay in your cloud. Hub never touches the bytes.

If you wanted a German-hosted encrypted drive with sharing links and a recovery desk, you are in the wrong shop. If the job is a vault on storage you already have, and you can live with a password nobody else can reset, start with the listing, then read Pricing next to the Hub FAQ. The homepage will show you Download Free. The drive is what you are buying.

New to the EuroMakers Journal? Start with how the Journal works.