[opensourcedex]

cryfs is a free, open source file management & sync project written in Rust and released under LGPL-3.0. It has 2,304 GitHub stars, 170 forks and 154 open issues, and was last pushed 22 hours ago. On this registry it ranks #20 of 26 tracked projects in File Management & Sync, with 5 head-to-head comparisons available.

What is cryfs?

CryFS is a FUSE-based cryptographic filesystem written in Rust that encrypts a vault directory so it can be stored safely in cloud services such as Dropbox, iCloud, or OneDrive, and it is intended for Linux users who want their file contents, file sizes, directory structure, and metadata hidden from the storage provider rather than encrypted one file at a time.

What it is

CryFS presents an encrypted directory as a normal mounted filesystem through FUSE. Files placed in the mount point are transparently encrypted and written into a backing vault directory, which can then be synced by any cloud storage client. The project lives in the FUSE filesystem ecosystem and is distributed under the LGPL-3.0 licence, with its documentation and download instructions hosted at https://www.cryfs.org.

The concrete problem it solves is metadata leakage. Other encryption tools encrypt files individually, which leaves file sizes, the shape of the directory tree, and associated metadata visible to whoever holds the storage. CryFS encrypts in a way that also hides file sizes, directory structure, and metadata, giving a higher level of security for data that leaves the machine. CryFS 2.0 is a complete rewrite from scratch in Rust, bringing improved memory safety, and it keeps filesystem compatibility with CryFS 1.0 rather than replacing it outright.

Key capabilities

  • Encrypts files for cloud storage services including Dropbox, iCloud, and OneDrive while hiding file sizes, directory structure, and metadata.
  • Supports the XChaCha20 and AES ciphers in the 2.0 rewrite, with XChaCha20 as the default inherited from 1.0.
  • Filesystems are fully forward and backward compatible between CryFS 1.0 and 2.0 for XChaCha20 and AES-256-GCM vaults, and integrity checks using block versioning are fully compatible.
  • Configurable scrypt parameters when creating new file systems, along with updated default scrypt parameters for better security.
  • Human-readable duration formats for --unmount-idle, such as 5m or 1h30m, and explicit block size units such as --blocksize 16KiB.
  • Flexible logging through the --log argument, for example --log file:/path/to/file.log.
  • FUSE mount options are passed directly with -o, so cryfs vaultdir mountdir -o allow_other replaces the older double-dash syntax, and the accepted option list is restricted to options known to work well with CryFS.

Who uses it and how

  • Linux users who keep a vault inside a folder synced by Dropbox, iCloud, or OneDrive and want the provider to see only opaque encrypted blocks.
  • Existing CryFS 1.0 users with vaults created using the XChaCha20 default or AES-256-GCM, who can open those vaults with the 2.0 build and continue working.
  • Users whose threat model includes metadata analysis rather than only content disclosure, since directory structure and file sizes are hidden as well.
  • Testers and contributors running the alpha build for evaluation and reporting issues through the GitHub issue tracker.

Getting started

CryFS 2.0 is built from source: install the Rust toolchain from https://rustup.rs, then the build dependencies, which are build-essential pkg-config libssl-dev on Ubuntu/Debian, fuse3-devel on Fedora, and fuse3 on Arch. Stable CryFS 1.0 remains available, with installation instructions at https://www.cryfs.org/#download.

How it compares

The facts provided name no comparable encryption filesystem, so CryFS stands alone in this registry. It is the only listed tool whose stated purpose is a cryptographic filesystem for cloud storage rather than a general file management or sync utility.

When to use it — and when not to

CryFS 2.0 is experimental software with an explicit warning that data will be lost and that it must not be used for anything important, so anyone needing a dependable vault should install the stable 1.0 release instead. The rewrite supports Linux only, leaves macOS untested, does not support Windows, and cannot open CryFS 1.0 vaults created with ciphers such as Twofish or Serpent, so anyone holding vaults with those ciphers must stay on 1.0. Self-hosters also carry the operational load of building from source and running a FUSE mount on each machine that needs access.

project readme (upstream, from github) — read inline

CryFS 2.0 (Alpha)

⚠️ ALPHA VERSION WARNING ⚠️

CryFS 2.0-alpha is experimental software. You WILL lose your data. Do not use it for anything important.

For stable CryFS, please use CryFS 1.0. You can find installation instructions for the stable version here.

CryFS 2.0 is in an alpha stage that has not undergone extensive testing. Use it only for testing purposes and please report any issues in the GitHub issue tracker.

What is CryFS?

CryFS encrypts your files so you can safely store them in cloud storage services like Dropbox, iCloud, or OneDrive. Unlike other encryption tools that encrypt files individually, CryFS encrypts your files in a way that also hides file sizes, directory structure, and metadata, providing a higher level of security.

Learn more at https://www.cryfs.org

What's New in CryFS 2.0?

CryFS 2.0 is a complete rewrite from scratch in Rust, bringing improved memory safety. This version is currently in alpha and represents a major evolution of the project.

Key Changes

To ensure compatiblity with CryFS 1.0, CryFS 2.0 does not add any features that would make the filesystem incompatible with Cryfs 1.0. New breaking changes are planned for future versions after CryFS 2.0 is stable. However, there are a few minor differences between CryFS 1.0 and 2.0.

New Features:

  • Configurable scrypt parameters when creating new file systems
  • Updated default scrypt parameters for better security
  • Human-readable duration format for --unmount-idle (e.g., 5m, 1h30m)
  • More explicit units for --blocksize (e.g., 16KiB)
  • More flexible logging with --log argument (e.g., --log file:/path/to/file.log)

Breaking Changes:

  • Command line options have changed (see Command Line Changes below)
  • Limited cipher support: only XChaCha20 and AES are available
  • Reduced platform support: only Linux is currently supported

Platform Support

Platform Status
Linux ✅ Working
macOS ❓ Untested (may or may not work)
Windows ❌ Not yet supported

Compatibility with CryFS 1.0

Filesystem Compatibility

File systems are fully forward and backward compatible between CryFS 1.0 and 2.0, with important caveats:

✅ Compatible:

  • File systems created with XChaCha20 cipher (the default in 1.0 and 2.0)
  • File systems created with AES-256-GCM cipher
  • Integrity checks using block versioning are fully compatible

⚠️ Partially Compatible:

  • Local state files: The filesystem ID verification (protection against filesystem replacement attacks) uses separate local state files in 1.0 vs 2.0. Both versions perform this check, but they don't sync with each other.

❌ Incompatible:

  • File systems created with other ciphers (e.g., Twofish, Serpent) are not accessible in CryFS 2.0
  • There are no plans to add all ciphers from CryFS 1.0 to the Rust version because many are outdated and don't have an implementaton that can be called from Rust easily.

Command Line Changes

The following command line arguments have changed:

1.0 Syntax 2.0 Syntax Notes
--unmount-idle 10 --unmount-idle 10m Now requires unit: 5m, 1h30m, etc.
--blocksize 16384 --blocksize 16KiB Now requires unit: 16KiB, 1MiB, etc.
--logfile /path/to/file.log --log file:/path/to/file.log More generic logging format
cryfs vaultdir mountdir -- -o allow_other cryfs vaultdir mountdir -o allow_other Double-dash syntax removed

The list of supported FUSE options that can be passed in with -o is now limited to options that are known to work well with CryFS. See cryfs --help for the complete list.

Installation

Linux

Building from Source

Prerequisites:

  • Rust toolchain (install from rustup.rs)
  • Build dependencies
    • Ubuntu/Debian: sudo apt install build-essential pkg-config libssl-dev
    • Fedora: sudo dnf install fuse3-devel
    • Arch: sudo pacman -S fuse3

Build and Install:

git clone https://github.com/cryfs/cryfs
cd cryfs
cargo build --release
sudo cp target/release/cryfs /usr/local/bin/

macOS

Not yet tested. May work if you have macFUSE installed, but no guarantees.

Windows

Windows support is not yet available in CryFS 2.0.

Usage

Creating a New Encrypted Filesystem

cryfs /path/to/encrypted/storage /path/to/mountpoint

You'll be prompted to create a password. CryFS will create its encrypted storage in the first directory and mount the decrypted filesystem at the mountpoint.

Mounting an Existing Filesystem

Use the same command:

cryfs /path/to/encrypted/storage /path/to/mountpoint

You'll be prompted for your password.

Unmounting

fusermount -u /path/to/mountpoint

Or on macOS:

umount /path/to/mountpoint

Advanced Options

# Auto-unmount after 30 minutes of inactivity
cryfs /path/to/encrypted /path/to/mount --unmount-idle 30m

# Allow other users to access the filesystem
cryfs /path/to/encrypted /path/to/mount -o allow_other

# Log to a file
cryfs /path/to/encrypted /path/to/mount --log file:/tmp/cryfs.log

# Show all available options
cryfs --help

Graphical User Interfaces

CryFS can be used through GUI applications:

  • SiriKali
  • Plasma Vault (included in KDE Plasma 5.11+)

Note: GUI compatibility with CryFS 2.0 has not been tested yet.

Known Issues

Performance

CryFS 2.0-alpha is currently slower than 1.0 due to lack of optimizations. Performance improvements are planned for future releases.

Stability

As alpha software, expect bugs and potential data loss. Known risks include:

  • Filesystem corruption if the process is interrupted during writes
  • Data loss if the disk runs out of space during write operations
  • Corruption if the filesystem is accessed from multiple devices simultaneously without proper synchronization

Recovery

There is currently no filesystem recovery tool for corrupted CryFS filesystems. Back up your data regularly.

Security Notes

Password Changes

If your password is compromised, creating a new filesystem and migrating your data is strongly recommended, as CryFS does not support secure password rotation.

Cipher Selection

CryFS 2.0 supports:

  • XChaCha20-Poly1305 (default, recommended)
  • AES-256-GCM

XChaCha20 is the recommended cipher for new filesystems due to its strong security properties and performance characteristics.

Scrypt Parameters

CryFS 2.0 allows you to configure scrypt parameters when creating a new filesystem, allowing you to adjust the time/memory tradeoffs for password derivation based on your security needs.

Larger parameters are more secure but mean the filesystem will be slower to mount, and devices with low memory might not be able to open it at all. There is no performance impact on filesystem operations after it was mounted, only the initial mounting is affected.

If you want to use a filesystem from devices with very low memory, lowering the scrypt parameters can help.

Contributing

Contributions are welcome! Please:

  1. Check the issue tracker for known bugs and feature requests
  2. Test CryFS 2.0 and report any bugs you find
  3. Submit pull requests with improvements

Since this is alpha software, testing and bug reports are especially valuable.

If you use AI tools when contributing, please read our AI Use Policy first.

License

CryFS is licensed under the LGPL v3. See the LICENSE file for details.

Links

Frequently asked questions

Is cryfs free to use?

cryfs is open source under the LGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does cryfs do?

Cryptographic filesystem for the cloud

What is cryfs written in?

cryfs is primarily written in Rust. Its source is publicly available at https://github.com/cryfs/cryfs, and it has 2,304 GitHub stars.