The short answer: Cryptomator is a good, free, open-source tool. You create a vault in your cloud folder, move files into it, and open it as a virtual drive with a password; Cryptomator Hub adds team sign-in through an identity server. ZapLock takes a different path: it encrypts an existing folder in place, keeps its name and path, and opens it with a ZapQR sign-in, with the key split between your device and our service. Pick Cryptomator for Linux, open source, self-hosting or fully offline use. Pick ZapLock if you want folders to stay where they are and per-person access without running an identity server.
A vault you move into, or the folder you already have
Both keep your files in your own cloud. They differ in where the encrypted files live and how you get back in.
Google Drive/ ├── Clients/ ← copied into the vault └── ClientsVault/ ├── d/ (encrypted) └── vault.cryptomator Unlock with the vault password, then work in the virtual drive it opens.
Files move into a new vault folder, and you work inside a mounted drive. On its own, the password is the key.
Google Drive/ └── Clients/ ← same name, same place ├── zaplock.json ├── recipients/ └── d/ (encrypted) Unlock with your ZapQR sign-in.
The folder keeps its name and path. Each folder's key is split between your device and our service, so we can't open your folders.
ZapLock, Cryptomator and Cryptomator Hub, side by side
Cryptomator on its own is for individuals. Its team product is Cryptomator Hub.
| ZapLock | Cryptomator | Cryptomator Hub | |
|---|---|---|---|
| How it encrypts | The folder you already have, in place | A new vault folder you move files into | Cryptomator vaults, with keys managed by Hub |
| How you work | The folder keeps its name and path | Inside a virtual drive | Inside a virtual drive |
| How you unlock | ZapQR sign-in, plus an optional fingerprint, face, PIN or phone check | Vault password | Sign-in through Hub and your identity provider |
| Access per person | Yes. Personal shares with up to 3 people; Team for a business | No. Everyone uses the vault password | Yes, users and groups |
| When someone leaves | Team: one removal across every team folder | Change the password and give the new one to everyone else | Remove access in Hub |
| Server to run | None. We run the sign-in and key service | None | Managed by Skymatic in an EU data centre, or self-hosted with Keycloak |
| Works fully offline | No. A new unlock waits for our service | Yes, with the password | Not stated on Hub's public pages |
| Platforms | Mac, Windows, iPhone, iPad, Android | Windows, Mac, Linux, iOS, Android | Same apps as Cryptomator |
| Open source | No | Yes | The apps are |
| Price | Free for 1 folder · Personal $49/yr · Team $9/seat/mo, 3 seats min. | Desktop free · writing on iOS or Android is a one-time purchase per platform (€29.99 base price) | Community free for 5 seats, self-hosted · Standard per seat, 3 seats min. · Enterprise from €10,000/yr |
Checked 13 October 2026 from cryptomator.org (pricing, Hub and teams pages). Cryptomator's prices are base EUR prices and vary by region and sale; check theirs before you decide.
How to move a Cryptomator vault to ZapLock
One vault at a time. Keep the old vault until you've checked the new folder opens everywhere you need it.
Install ZapLock and sign in
Get it from the Mac App Store, Microsoft Store, App Store or Google Play, and sign in with a free ZapQR account.
Copy the files out, off the cloud
Unlock the vault in Cryptomator and copy its contents to a local folder that doesn't sync, like one in Documents. That keeps plain copies off your provider's servers.
Lock that folder with ZapLock
Choose the folder in ZapLock and lock it. It keeps its name, and the files inside are encrypted where they sit.
Move it into your cloud
Drag the locked folder into Dropbox, Google Drive, iCloud Drive or OneDrive. Only encrypted files upload. On your other devices, choose Add Existing Vault and pick it.
Retire the old vault
Once the new folder opens everywhere, delete the old vault and the local plain copy. If others need it, share the folder, or use Team for a business.
Old copies: sync services keep version history. If plain copies were ever in your cloud folder, your provider may still hold them. Clear that history through your provider if it matters to you.
Is ZapLock the right switch from Cryptomator?
Switch if you
- Want encrypted folders to keep their name and path, with no virtual drive
- Are tired of sharing and changing vault passwords
- Run a small team and want to remove a leaver from every folder at once
- Want team access without running Keycloak or an identity server
Stay with Cryptomator if you
- Need Linux
- Require open-source software you can audit or build yourself
- Work fully offline and need to open vaults with no network at all
- Want to self-host every part of the system
Cryptomator alternative FAQ
What is the difference between Cryptomator and ZapLock?
Cryptomator creates a vault folder in your cloud storage. You move files into it and work inside it as a virtual drive, unlocked with a password. ZapLock encrypts a folder you already have, where it sits, and opens it with a ZapQR sign-in instead of a password, with each folder's key split between your device and our service. Cryptomator is free and open source and runs on Linux; ZapLock is neither, but needs no vault drive and gives each person their own access.
Is ZapLock open source like Cryptomator?
No. ZapLock's apps aren't open source. If you need to read or audit the code yourself, or build it from source, Cryptomator is the better fit.
Do I need a vault password with ZapLock?
No. A ZapLock folder opens with your free ZapQR sign-in. One half of the folder's key stays on your device and the other half is held by our service, and neither half opens anything alone. You can also require a fingerprint, face, PIN or approval on your phone before a folder opens.
Does ZapLock work offline like Cryptomator?
Not for a new unlock. ZapLock needs our service to release its half of a folder's key, so opening a folder waits until you're back online. Cryptomator opens a vault with just its password, with no network needed. If you often work fully offline, weigh that before switching.
How do I remove someone's access when they leave?
With ZapLock Team, an admin removes the person once and their share of every team folder's key is deleted on our side, so their next attempt to open any team folder is refused. With Cryptomator on its own, access is the vault password, so you change it and give the new one to everyone who stays. Cryptomator Hub adds central user and group management for teams.
Does ZapLock run on Linux?
Not today. ZapLock runs on macOS, Windows, iPhone, iPad and Android. Cryptomator's desktop app runs on Linux, so it's the better fit if you need it there.
How much does ZapLock cost compared with Cryptomator?
ZapLock's Free plan locks one folder for good. Personal is $49 a year on the web, with unlimited folders and sharing with up to 3 people, and Team is $9 per seat a month with a 3-seat minimum. Cryptomator's desktop app is free; writing to vaults on iOS or Android is a one-time purchase per platform, and Cryptomator Hub for teams is priced per seat. See pricing.
Lock your first folder in a minute.
Free for one folder, for good. On Mac, Windows, iPhone, iPad and Android.