Encrypted Cloud Storage - The Complete Guide

This article is dedicated to those who are planning or already using encrypted cloud storage for their data. First, let's explain what the widely used term "cloud" means nowadays. Cloud is nothing but a type of storage that we know from our computers, with the difference that it is located on the internet in a data center. And what is it good for? It's good because the data we store there is then accessible from anywhere with an internet connection.

In this article, I will describe encrypted cloud storage solutions from pCloud and Internxt, and how to encrypt data in the cloud. And why encrypt data in the cloud additionally? I write about this in my other articles too - it's about digital privacy. This way, you have the assurance that no one but you has access to your data.

Encrypted Cloud Storage Providers: pCloud, Internxt and Google Drive

pCloud

pCloud is based in Switzerland (with data centers in the EU and the USA - you can choose EU). They currently have approximately 24 million customers. Payment for their storage is either monthly, annual, or lifetime. You can access the cloud through an app available on Windows, macOS, Linux, and Android.

pCloud also offers an optional paid add-on called pCloud Crypto. When you purchase it, you get a "client-side" encrypted folder on the server. Data is encrypted on your device and the encrypted version is uploaded to the cloud server. If you lose your key, you permanently lose your data - that's the price of the zero-knowledge model. For data outside of pCloud Crypto, it can only be recovered with a pCloud Recovery Key if you lose your password. You receive this key during pCloud registration and must store it carefully. Without it, data on the server cannot be recovered.

Internxt

Internxt is based in Spain (EU) and is fully GDPR compliant. European legislation offers much stronger privacy protection than American law.

While Google Drive and pCloud are closed-source software, Internxt is open-source. This means that independent developers and security experts can examine the code at any time and verify that the service actually does what it claims (and that there are no hidden backdoors). Their desktop, mobile, and web applications are on GitHub. For the privacy-focused community, this is a huge advantage.

All files are encrypted on your device before uploading. Internxt doesn't know your password and has no access to your files. If you forget your password, your data is lost - exactly the same as with pCloud Crypto. Files are not stored on one massive server but are split and stored on different servers around the world. If one server goes down, you don't lose your data. This also makes physical attacks on servers more difficult.

Google Cloud

I'll also mention Google Cloud here, as many people certainly ask about it. Google Drive is not cheaper in the long run. Although Google Drive may seem cheap monthly, it's a subscription that you pay forever. Once you stop paying, you lose your storage. pCloud and Internxt offer Lifetime plans.

Google is a company that collects behavioral patterns and creates user profiles even from encrypted data. pCloud and Internxt are primarily storage companies - their business model is not based on profiling users. Last but not least, it's also about jurisdiction and legal protection under which the company falls (USA vs. EU/Switzerland).

Google Drive also falls under American laws (CLOUD Act, Patriot Act). American authorities can request your data from Google (even if they only see encrypted files) and Google must hand them over, often without you even knowing about it.

Comparison of Cloud Solutions

If the arguments above have convinced you to go with pCloud and you want to create a cloud account, the link is below. The Lifetime plan ensures cloud storage for life. You get enough space for regular backup of documents, photos, and videos. And as I mentioned above - I recommend storing your pCloud Recovery Key in a safe place right during registration.

If the arguments above have interested you in Internxt and you want to switch to their plan, the link to create an account is below. Internxt offers Lifetime licenses, so you pay once and don't have to worry about monthly subscriptions. And unlike pCloud, you don't need a Recovery Key - but you must store your account password very carefully. Internxt is fully zero-knowledge, so if you forget your password, your data is permanently lost. No email recovery, no customer support, no backdoors. That's the price of true privacy.

Due to the very strict settings of the Internxt client, I was unable to configure Cryptomator to encrypt the storage.

Encryption Software

In this chapter, we will describe the properties and suitability of encryption software. But first, how about the cloud? Do we even need to encrypt data when it's already encrypted in the cloud (Internxt and pCloud Crypto)? Honestly, if we're a bit paranoid, 100% certainty comes only when we encrypt the data ourselves in local storage before sending it to the cloud.

There are several solutions that work on the principle of encrypting data locally and then syncing it with the cloud. Here are the main alternatives:

1. VeraCrypt (Best for local encryption)

VeraCrypt creates virtual encrypted disks or containers, but is not ideal for cloud synchronization.

Why not for cloud:

• VeraCrypt packs all data into one large file (container).
• When you change one file inside, the entire container must be re-uploaded.
• If you open the same container on a laptop and smartphone, you risk conflicts, data loss, or corruption.

When to use:

• For local encryption of entire disks or partitions.
• To create a single fixed archive that you upload to the cloud as a whole.

2. Rclone (Best for advanced users)

Rclone is a command-line utility for syncing with cloud providers with built-in encryption.

Advantages:

• Supports more than 40 cloud services (Google Drive, Dropbox, OneDrive, S3, etc.).
• Offers encryption of both files and file names.
• Doesn't need proprietary clients for cloud synchronization.
• Hash-based integrity checks.

Disadvantages:

• Command-line only (no GUI).
• Requires technical knowledge.

3. gocryptfs (Faster alternative)

gocryptfs is an open-source encryption file system that encrypts individual files (similar to Cryptomator).

Advantages:

• Faster than Cryptomator (users report startup time reduction from 50 seconds to 6 seconds).
• Encrypts individual files, making it suitable for cloud synchronization.

Disadvantages:

• Smaller community and less user-friendly than Cryptomator.
• Limited platform support.

4. EncFS (Older alternative)

EncFS is an open-source file encryption for Linux.

Issues:

• Security audits reveal outdated cryptographic practices.
• Uses the same key for encryption and authentication.
• Not recommended for new installations.

5. Cryptomator (Best for encrypted cloud storage)

Cryptomator was designed specifically for encrypted cloud storage.

1. Per-file encryption: When you change one file, only that one is uploaded, not the entire container.
2. AES-256 encryption: Sufficient for secure cloud storage.
3. Open-source: No backdoors, code audited by Cure53.
4. Cross-platform: Works on Windows, macOS, Linux, iOS, and Android.
5. Free: Desktop version is free and open-source.

Table 1: Comparison of encryption tools

Based on the above, I chose Cryptomator as the encryption software. In the practical part of this article, I will cover the description of functionality, installation, and configuration of Cryptomator on Windows 11.

How Cryptomator Works

Cryptomator doesn't work by creating one large container (like VeraCrypt). Instead, it works as a transparent encryption layer between you and pCloud (hereafter referred to as Cloud).

Installation and operation on PC:

1. Install Cryptomator and create a new vault in c:\test
2. Install the pCloud client and set the sync folder to c:\test
3. The new vault will be mapped as a virtual disk, e.g., X:
4. Save data to X: and it will be encrypted on the fly and automatically uploaded through the cloud client's synchronization

Warning: Always save data through the virtual disk X:, never directly to c:\test! Otherwise, data would be uploaded to the cloud unencrypted.

Specific example

Imagine you have a file cryptomator_manual.pdf:

Without Cryptomator:

You → Cloud server
cryptomator_manual.pdf → cryptomator_manual.pdf
(Cloud sees the content, can index it)

With Cryptomator:

You → Cryptomator → Cloud server
cryptomator_manual.pdf → [encryption] → f8a3b2c9d1e7...pdf
(Cloud sees only an encrypted blob, doesn't know what it is)

What exactly Cryptomator does

1. Creates a virtual disk

When you unlock the vault, a new disk appears in the system (e.g., X:). It looks and works like a normal disk - you can copy files there, delete them, create folders.

2. Encrypts each file separately

When you save a file to the virtual disk, Cryptomator:

1. Reads the file
2. Encrypts it with AES-256
3. Writes the encrypted file to the target folder (e.g., pCloud/Cryptomator Vault/)

3. Encrypts file names too

This is important. When you save cryptomator_manual.pdf, it won't be stored in the Cloud as cryptomator_manual.pdf, but as something like f8a3b2c9d1e7f4a2.pdf. The Cloud doesn't know the file name.

4. Encrypts folder structure too

Even folder names are encrypted. The Cloud only sees:

/Cryptomator Vault/
  /d5a1e7b9c3f2.../
    /a8b2c7d4e1f6.../
      f8a3b2c9d1e7...pdf
      b3c1d9e7a2f5...docx

5. Stores the key locally

The master encryption key is stored as a file called masterkey.cryptomator inside the vault. This file is itself encrypted with your password. Without your password, the key cannot be decrypted.

How does it look in practice?

On your computer:

X: (virtual disk - normally visible)
├── Documents/
│   ├── cryptomator_manual.pdf
│   └── contract.docx
└── Photos/
    └── vacation.jpg

Cloud/Cryptomator Vault/ (encrypted)
├── d5a1e7b9c3f2.../
│   ├── f8a3b2c9d1e7...pdf
│   └── b3c1d9e7a2f5...docx
└── a8b2c7d4e1f6.../
    └── c9d1e7b3a2f5...jpg

On the Cloud server:

Cloud only sees:
├── d5a1e7b9c3f2.../
│   ├── f8a3b2c9d1e7...pdf
│   └── b3c1d9e7a2f5...docx
└── a8b2c7d4e1f6.../
    └── c9d1e7b3a2f5...jpg

The Cloud doesn't know:

• What the files are called
• What their contents are
• What the folder structure is

So the Cloud can't see the content or file names - the content is just unreadable binary code. This raises the question: what happens when you connect to the Cloud from another PC? Yes, you really don't have access to your data - you only see the encrypted files mentioned above. So how do you access your data? It's simple.

The procedure on a second PC looks like this:

1. First, download and install the Cloud client on the new PC. Log in with your account and set up synchronization. This will download your vault folder from the cloud to the new PC. At this stage, you'll only see incomprehensible encrypted files in that folder (no photos, no documents).
2. Download and install the Cryptomator application.
3. Open Cryptomator and don't click "New vault", but choose "Open existing vault". Point it to the folder that the pCloud client just downloaded. Cryptomator will recognize the vault.cryptomator file (or previously masterkey.cryptomator), ask you for the vault password, and once you enter it, the vault will unlock.
4. Using the decrypted master key, it unlocks your files and mounts them as a new virtual disk.

What this means for security

• Your password never left your computer. It wasn't sent to pCloud, it wasn't stored anywhere on the server.
• If a hacker gained access to your pCloud account, they would download your data and the key file, but without your password, it's just a pile of meaningless characters.
• The password exists only in your head (or in your password manager).

The only thing you need to remember (or store somewhere) is your vault password.

Why it's better than pCloud Crypto

pCloud offers its own encryption (pCloud Crypto), but it has disadvantages:

Cryptomator - Installation and Configuration

On the first PC, download Cryptomator from their website cryptomator.org/downloads. Run the installation and create a new vault by clicking the "+" button as shown in the image below. Also, select the storage location.

Fig. 1: Selecting new storage

According to Figure 1, select "Create new vault..." to create new storage. Then follow the images below.

Fig. 2: Selecting storage location

Fig. 3: Choosing password and recovery key

Fig. 4: Displaying recovery key

In Figure 4, you can see the recovery key. Store it carefully in case of password loss.

Fig. 5: Unlocking the vault

Fig. 6: Completing installation

Fig. 7: Storage mapped as drive D:

In Figure 7, you can see a large green button saying "Show drive D:". This means the storage has been mapped to drive D:. This is where you'll save data and it will be encrypted.

Download the pCloud client from the pCloud website pcloud.com/download and if you don't have a pCloud account yet, the link to create one is:

After downloading, install the client. During installation, log in to your created account if required.

Fig. 8: Configuring pCloud client

In Figure 8, you can see the pCloud client after installation. In the left panel, select "Sync" and then "Sync folder" at the bottom of the screen. Finally, use the "Change" buttons to select the path to the storage.

Fig. 9: Configured pCloud client

In Figure 9, you can see what a configured pCloud client looks like. If you want to add more storage, just click "Add folder".

That's everything for PC1.

Configuration on the second PC

On the second PC, download the pCloud client from pcloud.com/download.

Fig. 10: Configuring client on second PC

After installation, click the "Sync" button in the left panel and then "Sync folder" at the bottom of the screen.

Fig. 11: Selecting storage location

In Figure 11, we are selecting the pCloud storage location.

Fig. 12: Completed storage location configuration

In Figure 12, you can see the completion of the storage location configuration - select "Start Sync".

Fig. 13: Vault selection

Start the Cryptomator installation and continue according to Figure 13, select "Open Existing vault..."

Fig. 14: Key selection info

In Figure 14, we are selecting the key that was used to encrypt the vault. Select vault.cryptomator, if it's not there, choose masterkey.cryptomator.

Fig. 15: Selecting the key

Fig. 16: Entering the password that encrypts the key

Fig. 17: Mapping storage to drive E:

Now we have the synchronized folder on drive E:.

Conclusion

And we're done. Now we have Cryptomator and the pCloud client installed and configured on both PCs, giving you fully functional encrypted cloud storage. I'll also add that the desktop version of Cryptomator is completely free. Mobile apps for iOS and Android are free to download but only allow reading files. For writing, a one-time license purchase is required directly in the app.

If you're interested in how to spend crypto without the bank knowing, how to separate your identity from your money, read my review of ether.fi Cash Card. Finally, I'll also mention the article Encrypted Email - ProtonMail where I discuss email with a focus on privacy and security.