Cryptomator vs VeraCrypt: Which Do You Want?

It depends on the problem you’re attempting to solve.

There’s encryption, and then there’s how you organize what you’ve encrypted. While the two tools both encrypt your data, where they differ is how they organize your encrypted data on disk.

The VeraCrypt model

VeraCrypt is what I’ll call a “monolithic” encryption tool. It takes all the files you want to encrypt and places them in a single encrypted file.

You create a special container file (called a vault or volume) using VeraCrypt. You choose how large the volume will be based on the amount of data you want to encrypt. For example, I might have 80GB of data that I want to keep secure, so I might create a 100GB VeraCrypt volume to have a little extra room.

When you create the volume, you assign it a passphrase that encrypts its data. The vault itself, however, is just a large file that, to all appearances, contains random data.

To use the container, you instruct VeraCrypt to “mount” it, specifying the passphrase you set when you created the volume. This creates a virtual disk drive that exposes the encrypted contents of the volume in unencrypted form.

In the example above, drive V: has appeared after mounting the VeraCrypt volume “C:\folder\myvolume.tc”.

The contents of the encrypted container appear as unencrypted files on the V: drive in Windows File Explorer. As long as the container is mounted, the contents are directly accessible to all programs running on your machine. You’ve opened VeraCrypt’s one big encrypted file to access all the individual files inside it.

If you don’t mount or when you dismount the container, all that remains visible is the volume itself — “C:\folder\myvolume.tc” — which appears to contain only random noise.

The Cryptomator model

I call Cryptomator an “incremental” or individual encryption tool. It stores encrypted files as individual encrypted files.

To use a Cryptomator vault, you specify a folder that will contain the encrypted data. The folder itself isn’t encrypted, but rather will contain the individually encrypted files. When you create that vault, you specify a passphrase used to encrypt the data you place into the vault.

Much like VeraCrypt, you “mount” the volume, specifying the passphrase to unlock it. This creates a virtual disk drive that exposes the encrypted contents of the volume in unencrypted form.

In the example above, drive M: has appeared after mounting the Cryptomator volume “C:\secretfolder”. There is no single encrypted container file holding all the files; the files themselves are individually encrypted, and stored within this folder.

The contents of the encrypted container appear as unencrypted files on the M: drive in Windows File Explorer. As long as the container is mounted, the contents are directly accessible to all programs running on your machine.

If you don’t mount or when you dismount the container, all that remains visible are individually encrypted files with random names organized in random sub-folders.1 Each file’s contents appear as random noise, and the filenames and folder structure are completely hidden.

VeraCrypt or Cryptomator?

You can use either encryption program, of course, but there’s a big difference between monolithic and incremental storage.

Let’s say you want to encrypt the data you’re about to place in a cloud storage service like OneDrive or Dropbox.

Using VeraCrypt, you place the monolithic vault somewhere in your PC’s cloud storage folder. Now any time anything changes within the VeraCrypt vault, no matter how small, the entire vault is synchronized to cloud storage (and possibly replicated to other PCs sharing the storage2).

If you make any change to a single file, like “V:\folder\secret-document.docx”, then the entire C:\folder\myvolume.tc vault needs to be uploaded. If that vault is 100GB, even the smallest change requires the entire 100GB to be uploaded.3 This can take a long time.

Using Cryptomator, you specify a folder in your PC’s cloud storage folder as the vault. Any time anything changes within the vault, only the files that were changed need to be uploaded.

For example, if you make a change to a single file, like “M:\folder\secret-document.docx”, then only the encrypted file representing that document — “\secretfolder\randomfolder\randomname” — is uploaded, not everything else.