[ENCRYPT FILES BEFORE UPLOADING TO THE CLOUD]

Your cloud provider encrypts your files — with keys it holds. Here is how to hold the key yourself.

Google Drive, Dropbox and OneDrive all say they encrypt your files, and they do — but with keys they control. That protects against a stolen hard drive in their data centre, not against the provider itself, a court order served on it, a breach of your account, or a sharing link that ends up in the wrong hands.

If you encrypt a file before it is uploaded, the cloud only ever stores ciphertext. This is called client-side or end-to-end encryption, and it is easy to add.

[THREE WAYS, DEPENDING ON WHAT YOU STORE]

  • A few files, occasionally — tax returns, scans of ID documents, contracts. Encrypt each one with a password, in the browser or with 7-Zip (AES-256), and upload the encrypted copy. Nothing to install.
  • A whole folder you keep in sync — use Cryptomator, which is free and open source. It creates an encrypted "vault" inside your Drive or Dropbox folder and shows it as a normal drive on your computer. Files are encrypted one by one, so syncing stays fast.
  • Everything, without thinking about it — switch to a provider that encrypts end to end by design: Proton Drive, Tresorit, or Apple iCloud with Advanced Data Protection turned on.

[WHAT YOU GIVE UP]

  • Previews and search. The provider cannot show thumbnails, index text or open the file in its online editor, because it cannot read it.
  • Collaboration. Google Docs-style simultaneous editing does not work on encrypted files. Encrypt finished documents, not drafts you edit together.
  • Password recovery. The provider cannot reset your encryption password. Lose it and the files are gone — store it in a password manager.

[GOOD HABITS]

  • Check the decryption before deleting the original. Decrypt the uploaded copy once to make sure you have the right password.
  • Mind the version history. If an unencrypted version was synced earlier, the provider keeps old versions for 30 days or more. Delete the file and empty the version history and trash.
  • Keep the file name neutral. The name of an encrypted file is still visible to the provider.
  • Secure the account anyway. Two-factor authentication on the cloud account protects everything that is not encrypted.

[FREQUENTLY ASKED QUESTIONS]

Doesn't Google Drive already encrypt my files?

Yes, at rest and in transit, but with keys Google manages. Google can technically access the content, and so can anyone who gets into your account. Encrypting before upload means only someone with your password can read it.

Can I still open encrypted files on my phone?

Yes. A file encrypted on CryptFile.Online can be downloaded from the cloud app and decrypted in the phone's browser. Cryptomator also has Android and iOS apps.

Is it worth encrypting everything?

Usually not. Encrypt what would hurt if it leaked — identity documents, financial and medical records, private photos, credentials — and keep everyday documents convenient.