What does Google or Microsoft see in my Drive?

They only see encrypted binary blocks and incomprehensible random file names. Even with physical access to the servers, no one can decrypt your documents without your password.

Can I change the password afterwards?

No. The password is used directly to generate file encryption keys. Changing the password would make existing files unreadable.

Virtual StoragesClient-side encryption

Crypt — Zero-Knowledge Encryption

Encrypt your files and folders on the fly before sending them to any cloud

Download Ultra Explorer

Overview of Crypt — Zero-Knowledge Encryption Integration

Crypt wraps an existing storage and encrypts files, and optionally their names, on your machine before upload. The provider only sees encrypted data.

File contents encrypted with XSalsa20-Poly1305 (NaCl secretbox)
File and folder names encrypted or obfuscated, optionally
Works on top of any of your storages

In-App Configuration Dialog

Capture Crypt — Zero-Knowledge Encryption — Ultra Explorer — Crypt configuration window in Ultra Explorer: selection of source storage, target folder and secure entry of encryption keys.

How to connect Crypt — Zero-Knowledge Encryption in Ultra Explorer

Have existing storage

First configure a classic cloud account (Google Drive, Dropbox, S3...).
Create the Crypt remote

Choose 'Crypt' in the Virtual section.
Target remote folder

Indicate the target location (eg: 'gdrive:SecureFolder').
Set your password

Create a strong password and validate.
Seamless navigation

Open your Crypt remote: you see your files in clear text, whereas on the cloud, they are completely unreadable and encrypted!

Configuration fields

Storage Name

Required

name= Coffre Chiffré

Unique identifier for this storage remote in Ultra Explorer (e.g. gdrive-perso, backup-s3).Default value: Coffre Chiffré

Target Underlying Storage

Required

remote

Required. The cloud or local storage remote that will host the data (e.g. "Google Drive:", "AWS S3:bucket", "NAS:backups").

Folder Path

Optional

path

Absolute path to the directory on your local machine or destination remote.

Configuration Mode

Required

setupMode= new_space

Required. 'new_space' to initialize a new encrypted vault, 'new_leaf' to create a subfolder, or 'existing_space' to unlock an existing rclone crypt vault.Default value: new_space

Password

Required

password

Primary password used to access the service or decrypt data.

Secondary Salt Password

Optional

password2

Optional but strongly recommended. Second passphrase acting as key derivation salt to harden security.

Filename Encryption

Optional

filename_encryption= standard

Optional. 'standard' to completely encrypt filenames, 'obfuscate' to simply mask length, or 'off' to leave plaintext names.Default value: standard

Directory Name Encryption

Optional

directory_name_encryption= true

Optional. Also encrypts directory names and structure to completely conceal the tree hierarchy.Default value: true

Frequently Asked Questions about Crypt — Zero-Knowledge Encryption

They only see encrypted binary blocks and incomprehensible random file names. Even with physical access to the servers, no one can decrypt your documents without your password.
No. The password is used directly to generate file encryption keys. Changing the password would make existing files unreadable.