Encrypted drives

An encrypted drive uses rclone’s Crypt backend. It wraps another drive, or a folder on it, and encrypts every file’s contents and, by default, its name before upload. The storage provider only ever sees encrypted data. CloudMount decrypts on your device as you open files.

Encrypted drives are wrapping drives, which need CloudMount Pro.

On Android, make a vault

A vault is an encrypted drive that CloudMount sets up for you: a generated key, a recovery kit to keep it safe, and a place of its own on the home screen. An encrypted drive you already have can become one.

Create one

1. Add the drive that will hold the encrypted files, such as Google Drive, if you haven’t already.
2. Add a drive and choose Encrypted storage (Android) or Encrypted drive (Windows), or search for Crypt.
3. Set remote to the drive and folder to keep the encrypted files in, such as gdrive:Encrypted. Use a folder of its own: everything in it is expected to be encrypted. Pick the drive from the list, then add the folder after its colon.
4. Choose a password and, ideally, a second password (the salt). Generate password makes strong ones, and CloudMount asks you to confirm you’ve saved them.
5. Save. Use the new encrypted drive for your files; the drive underneath shows only scrambled names.

The encrypted folder is compatible with rclone on any other computer: an rclone crypt remote with the same settings and passwords reads it.

Keep your passwords

Nobody can recover files from an encrypted drive without its passwords, not CloudMount, not the storage provider and not rclone. Store them in a password manager, and export your configuration (see Import and export) as a backup. The passwords in an exported rclone.conf are only obscured, not encrypted, so keep that file safe too.

What it hides, and what it doesn’t

Hidden from the provider	Visible to the provider
File contents	File sizes: slightly larger, and the original size can be worked out
File and folder names (with the default standard name encryption)	How many files and folders there are, and how they’re nested
	When files were changed

With filename_encryption set to off, names stay readable and only the contents are encrypted. obfuscate only scrambles names lightly.

Things to know

• Names get longer. Encrypted names are longer than the originals, and some providers limit name or path length. Very long names may fail to upload. filename_encoding set to base32768 produces shorter names on providers that count characters rather than bytes, such as OneDrive.
• Checksums aren’t available, so CloudMount compares encrypted files by size and date. On Windows, renaming a downloaded file can upload it again.
• Server-side copy and move still work when the drive underneath supports them, because the contents don’t need to be re-encrypted for a move.
• Don’t change settings after saving files. Changing the passwords or name settings makes existing files unreadable through the drive.

rclone’s Crypt page has the full details, including the file format and how keys are derived.