How to create a Cryptomator pCloud vault:
Our Privacy Setup Guide (2026)

---

Your files are in the cloud. Someone else holds the key. Or is there better way?

That is the actual situation with most cloud storage, pCloud included. Not a conspiracy. Not scaremongering. It’s the architecture. When your files sit on a provider’s servers, that provider holds the encryption keys. A court order, a legal request, or a sufficiently persuasive bit of legal paperwork means your holiday photos, your client contracts, your passport scan, all become readable by people you have never met. That is why Cryptomator pCloud setups have become the practical default for anyone serious about cloud privacy.

pCloud is genuinely one of the better options. TLS in transit, server-side encryption at rest, data centre choices in both the US and Switzerland. For most day-to-day use, it is more than fine.

Fine and private are different things.

If you want verifiable, nobody-but-you privacy, your files need to be encrypted before they leave your device. What arrives at pCloud’s servers should be unreadable scramble that pCloud itself cannot decode. That is exactly what this guide sets up.

The tool is Cryptomator. Free on desktop, open-source, ten minutes to configure. By the end of this, you will have a working encrypted vault inside pCloud that you control completely.

---

What Is a Cryptomator pCloud Vault?

---

Cryptomator is a free, open-source encryption tool that creates a password-protected vault on your device. Every file you drop into that vault is encrypted automatically before it syncs anywhere. When you want to use your files, you unlock the vault with your password and it mounts as a normal drive in your file manager, exactly like a USB stick or a network share.

Cryptomator pCloud combines open-source encryption with reliable cloud storage, giving you the best of both worlds.

The encryption happens on your machine. Not on a Cryptomator server (there is no Cryptomator server involved in the process), not at pCloud’s end. On your device. Before anything moves.

According to the official Cryptomator security architecture documentation, each vault carries two separate 256-bit masterkeys: an encryption masterkey and a MAC masterkey, generated by a cryptographically secure pseudorandom number generator. File content is encrypted using AES-256 in either SIV_GCM or SIV_CTRMAC mode (the cipher combo is specified in the vault configuration file).

File names are encrypted using AES-SIV, which means the file names themselves are hidden from pCloud, not just the contents. Your password is never transmitted anywhere. Instead, it locally derives a Key Encryption Key via scrypt, a deliberately slow and memory-intensive function designed to make brute-force attacks expensive. Both masterkeys are then wrapped using AES Key Wrap (RFC 3394) and stored in a masterkey.cryptomator file in your vault’s root directory.

In practical terms: pCloud receives a folder of cryptographically randomised data. No filenames. No readable structure. No way to identify what any of it contains.

Cryptomator was independently security audited in 2017, with the AES-SIV library separately reviewed by security researcher Tim McLean. The full source code is publicly available on GitHub for ongoing community scrutiny. You do not have to take their marketing at face value. You can read the code yourself, or check what security researchers have written about it. Worth noting for 2026: Cryptomator published a post-quantum cryptography roadmap in July 2025, outlining how the project plans to adopt quantum-resistant algorithms as that threat landscape matures. That kind of forward planning from an open-source project is not nothing.

The Electronic Frontier Foundation’s Surveillance Self-Defense guides consistently recommend client-side encryption tools for exactly this reason: when you cannot control the server, you control the encryption instead.

What Cryptomator costs: Free on Windows, macOS, and Linux desktop. The Android and iOS apps are a one-time paid purchase, not a subscription.

---

Cryptomater pCloud setup – What You Need Before Starting

No command line. No developer account. No prior experience with encryption.

• A pCloud account (free or paid, both work)
• The pCloud Drive desktop app installed and signed in
• Cryptomator downloaded and installed
• A strong vault password and somewhere safe to store it (a password manager, a physical safe, somewhere offline)
• About ten minutes

That is genuinely the full list. If you do not have a pCloud account yet, sort that first.

pCloud Lifetime Deal: pay once, store forever. Lifetime plans start at approximately £199 for 500GB (currently around £100 off the regular price). Grab your pCloud Lifetime Deal here before the offer changes.

---

Part 1: Cryptomator pCloud Desktop Setup

This Cryptomator pCloud desktop setup takes about five minutes across all three operating systems.

Cryptomator runs on Windows, macOS, and Linux. The official documentation covers all three at docs.cryptomator.org/desktop/setup.

Windows:

1. Download the .exe installer from cryptomator.org/downloads
2. Run the installer and follow the steps
3. Open Cryptomator from your Start menu

Cryptomator uses WinFsp as its virtual filesystem driver on Windows. If WinFsp is not already on your machine, the Cryptomator installer handles it automatically.

macOS:

1. Download the .dmg from the macOS downloads page
2. Open it, accept the licence, drag Cryptomator into Applications
3. If Gatekeeper blocks it, allow it via System Settings > Privacy & Security

Cryptomator uses macFUSE on macOS. Without it, Cryptomator falls back to a WebDAV loopback connection, which works but is noticeably slower. Install macFUSE separately from osxfuse.github.io before launching Cryptomator and you will not notice any performance drag at all.

Linux:

The easiest route is the AppImage from the Linux downloads page. Download, make it executable, run it. Cryptomator is also available via Flatpak, PPA, and AUR if you prefer a package manager. Linux uses the system FUSE driver, which is available on virtually all major distributions.

---

Part 2: pCloud Drive app for Cryptomator pCloud

The pCloud Drive app is the cleanest foundation for any Cryptomator pCloud workflow. For the smoothest Cryptomator setup, use the pCloud Drive desktop app. It mounts your pCloud storage as a local drive in your file manager, which gives Cryptomator a straightforward local path to point at. No fiddling with WebDAV at this stage, no manual sync configuration.

If pCloud Drive is not installed yet, download it from pcloud.com, sign in, and your cloud storage will appear as a drive. It takes about two minutes. Once it is running and your storage is mounted, you are ready for the main event.

---

Part 3: Create Your Cryptomator pCloud Vault

This is the step that matters. You are creating an encrypted vault folder that lives inside your pCloud account. Every file you put in it gets encrypted before pCloud ever sees it.

1. Open Cryptomator
2. Click the + button at the bottom left and select Create New Vault
3. Give it a name. Something recognisable but not obvious. “Work Files” is perfectly fine
4. When asked to choose a location, navigate to your pCloud Drive folder and select it as the destination
5. Set a strong, memorable password. This is the only barrier between your files and anyone who is not you
6. Tick the option to generate a recovery key and store it somewhere secure and offline. A printed copy in a physically safe place is not a bad idea
7. Click Create Vault

Cryptomator creates three things in your pCloud Drive folder: a vault.cryptomator configuration file (a signed JWT that identifies the vault and specifies the cipher combo), a masterkey.cryptomator file (containing the scrypt-wrapped masterkeys), and a d/ directory containing all the encrypted file data. Do not rename these, move them manually, or open them directly. Everything you do with your files happens through the Cryptomator virtual drive, not by touching these raw files.

---

Part 4: Using Your Cryptomator pCloud Vault

1. Select your vault in the Cryptomator app
2. Click Unlock Vault
3. Enter your password
4. Cryptomator mounts the vault as a virtual drive in your file manager
5. That is your Cryptomator pCloud vault in daily operation.

From here, it behaves like any other folder. Drag files in, save directly to it, open files from it in any app. The encryption runs in the background on every file you add. The sync to pCloud runs automatically via pCloud Drive. You never manually touch the encryption process after setup.

When you are done, lock the vault from within Cryptomator or let it lock automatically. The virtual drive disappears and only the encrypted scramble remains visible in your pCloud storage.

---

Part 5: Cryptomater pCloud Vault Options Worth Knowing

Each vault has its own settings panel, accessible via the gear icon in Cryptomator when the vault is locked.

• Idle lock timer: The vault locks itself after a set period of inactivity. Genuinely essential for shared machines or a laptop you take to coffee shops
• Auto-unlock on startup: If you are the sole user on a trusted home machine, Cryptomator can unlock the vault automatically when it launches. Not recommended on shared or portable hardware
• Reveal Drive after unlock: Opens the mounted vault in your file manager automatically on unlock. Saves a few clicks every day
• Custom mount point: Assign a specific drive letter (Windows) or folder path (macOS/Linux) so the vault always appears in the same place, making it easier to reference from other apps

---

Part 6: Cryptomator pCloud Mobile Access

Cryptomator pCloud mobile access works differently but is entirely capable for documents on the go.

Cryptomator for Android is available on the Google Play Store, F-Droid, the Cryptomator APK Store, and Accrescent. The Play Store version is the recommended route for most Android users. Note: the Android app is a one-time paid purchase, not free like the desktop version.

To access your existing pCloud vault on Android:

1. Install Cryptomator from your preferred source
2. Open the app and tap Add Vault, then Open Existing Vault
3. Select pCloud as the cloud storage provider (native pCloud integration is available in the Play Store and APK Store variants)
4. Authenticate with your pCloud account when prompted
5. Navigate to the folder where your vault lives and select the vault.cryptomator file
6. Enter your vault password

On mobile, Cryptomator does not mount the vault as a separate drive the way it does on desktop. You browse files through the Cryptomator app itself and open them directly in other installed apps. It is well-suited for accessing documents, PDFs, notes, and images on the go. For bulk file management, the desktop setup is the better experience.

Still on pCloud’s free tier? The Lifetime Deal removes the monthly fee question entirely. 2TB for a one-time payment of approximately £399. See all pCloud Lifetime Deal options here.

---

Part 7: Cryptomator pCloud integration via WebDAV (Advanced Users)

Your Cryptomator pCloud vault is now ready for immediate use.

For users who want to connect Cryptomator to pCloud without the desktop app, on a NAS, a headless Linux server, or any setup requiring a direct WebDAV connection, pCloud supports WebDAV natively as documented in the pCloud help centre.

Setting	US Region	EU Region
Server URL	https://webdav.pcloud.com	https://ewebdav.pcloud.com
Port	443	443
Username	Your pCloud email	Your pCloud email
Password	Your pCloud password	Your pCloud password

Mount pCloud as a WebDAV network drive in your operating system first, then point your Cryptomator vault location at that mounted drive.

A couple of honest notes on WebDAV from pCloud’s own documentation: WebDAV works well for regular document access and smaller file transfers. pCloud notes it is not recommended for large-scale backup operations and can experience interruptions under heavy transfer load. For a vault primarily containing documents, notes, and smaller files, it is entirely usable. For large video files or bulk data operations, pCloud Drive is the more stable choice.

If you have two-factor authentication enabled on your pCloud account, you will receive a “new login attempt” confirmation email the first time WebDAV connects. Confirm it and subsequent sessions proceed without prompts.

One thing worth clarifying: pCloud’s own Crypto Folder feature is not compatible with WebDAV. This does not affect the Cryptomator setup described here, since we are using Cryptomator rather than pCloud’s built-in encryption product. But it is useful to know if you are exploring both options.

---

Is pCloud’s Built-in Encryption Enough?

pCloud offers its own client-side encryption product called pCloud Encryption (sometimes called the Crypto Folder). It adds an extra encryption layer at the client level and is available as an add-on to pCloud’s paid plans.

There is one meaningful difference worth being direct about. pCloud Encryption is proprietary and closed-source. You are trusting pCloud’s implementation without being able to verify it independently.

Cryptomator is fully open-source. The 2017 security audit is public. The code is on GitHub. Security researchers can read it. That is the entire basis of why the privacy community trusts it. No trust required on faith, just on evidence.

For users happy to stay within pCloud’s ecosystem and wanting a practical encryption layer, pCloud Encryption is convenient. For anyone who wants verifiable, auditable, open-source zero-knowledge encryption they can inspect and confirm themselves, Cryptomator is the stronger choice. The two can technically coexist on the same account, applied to different folders. But there is no meaningful reason to use both. Pick Cryptomator, set it up once.

The distinction between client-side encryption and zero-knowledge encryption is also worth understanding clearly. For a thorough grounding on the cryptographic concept itself, the Wikipedia entry on zero-knowledge proof is a solid starting point that explains why “zero-knowledge” means something specific and verifiable, rather than just a marketing phrase.

---

What About Proton Drive?

Proton Drive is a strong option for pairing with Cryptomator, particularly for users already in the Proton ecosystem. It brings native end-to-end encryption by default. See the full Proton Drive vs pCloud 2026 comparison here. That combination deserves its own dedicated guide.

That combination deserves its own dedicated guide, and it is coming. In the meantime: Proton Drive Plus which is currently 77% off here, or included in the Proton Unlimited – Reader exclusive: 34% off which includes 500GB Proton Drive plus it includes Proton Mail, VPN, Calendar, Pass, with your Proton Drive storage into one subscription.

---

Cryptomater pCloud – Common Issues and Quick Fixes

Vault shows in Cryptomator but files are not syncing to pCloud:
Check that pCloud Drive is running in the background and actively signed in. If it has disconnected or paused syncing, Cryptomator has no way to push encrypted files to the cloud. Then review the pCloud Drive system tray icon for sync warnings.

Cryptomator is slow to unlock or files take a long time to open (macOS):
Install macFUSE from osxfuse.github.io. Without it, Cryptomator falls back to a WebDAV loopback server, which is noticeably slower than the native FUSE filesystem. One install sorts this permanently.

Forgot the vault password:
If you generated a recovery key when creating the vault, use it to set a new password. If you did not generate a recovery key, access to the vault is permanently and irrecoverably lost. Cryptomator is zero-knowledge by design. No back door. No support ticket that helps. Generate a recovery key for every vault you create and store it physically somewhere safe.

pCloud Drive is not showing the vault contents after unlocking:
Confirm the vault was created inside the pCloud Drive mount point, not a different folder on your machine. If the vault folder sits outside pCloud’s synced directory, the encrypted files are local only and are not uploading.

WebDAV connection keeps timing out:
Check your pCloud account region. If your account is on pCloud’s EU data region, use ewebdav.pcloud.com rather than webdav.pcloud.com. Connecting to the wrong regional server is the most common cause of WebDAV authentication failures.

---

Where to Go From Here

If you use cloud storage for anything you would not want a stranger to read, the answer is yes. Not because pCloud is untrustworthy. Because trusting any cloud provider with your encryption keys is an unnecessary risk when the alternative takes ten minutes and costs nothing on desktop.

Cryptomator plus pCloud gives you reliable, well-supported, genuinely convenient cloud storage with encryption that you and only you control.

pCloud Lifetime Deal Options – Pricing Table (2026)

Plan	Lifetime Price	You Save
500 GB Lifetime	~£199/$199	~£100/$100 off RRP (£299/$299)
2 TB Lifetime	~£399/$399	~£200/$200 off RRP (£599/$599)
10 TB Lifetime	~£1,190	~£700/$700 off RRP (£1,890/$1,890)

The 2TB lifetime deal is the sweet spot for most people. Enough room to store virtually everything with space to grow, and at one-off pricing it pays for itself against any monthly subscription in under four years.

Claim your pCloud Lifetime Deal Discount Offer here.

Proton Drive: If You Want Native End-to-End Encryption Built In

Proton Drive encrypts everything by default at the server level, making it a natural companion to Cryptomator for belt-and-braces privacy.

Proton Drive Plus with a huge 77% off (Current Reader Exclusive Mega Deal) store more, stress less with 200 GB of end-to-end encrypted storage ready for your peace of mind.

Proton Unlimited Plan with 34% discount (Reader Exclusive Offer) which includes 500GB Proton Drive plus Proton Mail, VPN, Calendar and Pass in one plan.

A full Cryptomator and Proton Drive setup guide is coming. Watch this space.

---

Cryptomater pCloud – Frequently Asked Questions (FAQ)

Does Cryptomator work with pCloud?

Yes. Cryptomator works with pCloud via the pCloud Drive desktop app or via WebDAV. You create a vault inside your pCloud Drive folder and Cryptomator handles all encryption automatically before files sync to the cloud.

Is Cryptomator free to use with pCloud?

Cryptomator desktop (Windows, macOS, Linux) is completely free. The Android and iOS apps are a one-time paid purchase. pCloud has both free and paid plans, including lifetime deals that remove the monthly fee entirely.

Does pCloud offer zero-knowledge encryption?

pCloud’s standard storage is server-side encrypted, meaning pCloud holds the encryption keys. Their separate pCloud Encryption product offers client-side encryption but is closed-source and proprietary. Using Cryptomator with pCloud provides open-source, independently reviewed, verifiable zero-knowledge encryption.

Can I use Cryptomator pCloud on my phone?

Yes. Cryptomator has Android and iOS apps with native pCloud integration available in the Google Play Store and APK Store variants. You can access and decrypt vault files directly on mobile.

What are the best encrypted cloud storage options in 2026?

Cryptomator pCloud is our top recommendation for DIY zero-knowledge setups. See the full 2026 best cloud storage for privacy ranking here.

What encryption does Cryptomator use?

Each vault uses two 256-bit masterkeys generated by a cryptographically secure pseudorandom number generator: one for encryption and one for MAC authentication. File content is encrypted using AES-256 in SIV mode (either SIV_GCM or SIV_CTRMAC, specified in the vault config). File names are encrypted using AES-SIV. Your vault password is used locally to derive a Key Encryption Key via scrypt, which wraps the masterkeys using AES Key Wrap (RFC 3394).

What happens if I lose my Cryptomator vault password?

Without a recovery key, access is permanently lost. Cryptomator is zero-knowledge by design. No back door. No account recovery. No support ticket that can help. Always generate and store a recovery key when creating a vault.

Is there a Cryptomator pCloud setup guide for Linux?

Yes, Part 1 of this guide covers Linux installation. Cryptomator is available as an AppImage, Flatpak, via PPA, and on AUR. The vault creation and usage process is identical across all desktop platforms once installed.

What is Cryptomator’s post-quantum cryptography position?

In July 2025, Cryptomator published a post-quantum cryptography roadmap outlining plans to adopt quantum-resistant algorithms as the field matures. Current symmetric algorithms at AES-256 key sizes are considered secure under current computational constraints. The roadmap signals the project is actively planning ahead.

---

Disclosure: This article contains affiliate links to pCloud and Proton. If you purchase via these links, Baizaar.tools earns a small commission at no additional cost to you. All recommendations are based on genuine use and independent research. Cryptomator is not an affiliate. It is recommended because it is the best open-source tool for this job.

Last reviewed: April 2026. Technical claims verified against docs.cryptomator.org/security/architecture and help.pcloud.com.

---