Create and Use an Encrypted Vault on Android with Cryptomator

Before you start

Cryptomator is a free, open‑source tool that encrypts files locally before they ever reach the cloud. Because the encryption happens on the device, the cloud provider never sees your plaintext data. The tutorial assumes you have a working Android phone (Android 7.0+), an active internet connection, and a cloud storage account (Google Drive, Dropbox, OneDrive, etc.) where you want to keep the encrypted vault.

What you will need:

• Android device with at least 1 GB of free internal storage.
• Google Play Store access (or an APK from the official Cryptomator website).
• A cloud‑storage app already logged in (e.g., Google Drive).
• A memorable, strong password – you will not be able to recover a lost password.

Safety note: Cryptomator never stores your password anywhere. If you forget it, the vault is permanently inaccessible.

Step 1: Install Cryptomator

When the app opens for the first time it will ask for permission to access files. Grant All files access (or the scoped‑storage equivalent) so Cryptomator can read and write the vault contents.

Step 2: Create a new vault

Cryptomator will now generate a hidden .c9r file inside the chosen folder. This file stores the encryption keys and must stay together with the encrypted data files.

Step 3: Add files to the vault

All files you placed inside the virtual drive are now stored encrypted on your device and, because the vault resides in a cloud‑synced folder, they will be uploaded automatically.

Step 4: Verify cloud sync

If the files appear in the cloud, you have a working encrypted backup. You can now access the same vault from any other Android device that has Cryptomator installed – just point it to the same cloud folder and unlock with the same password.

Step 5: Access the vault on a second device (optional)

This cross‑device capability is what makes Cryptomator a practical solution for personal cloud security.

Troubleshooting

1. Vault does not appear in cloud storage

• Make sure the cloud‑sync app has permission to access the folder you chose. On Android 11+ you may need to enable “Allow access to manage all files”.
• Check that the device is connected to the internet and that the sync client is not paused.
• If the folder is on an SD card, verify that the card is formatted with a file system supported by both Android and the cloud app (usually exFAT).

2. Unlock fails with “Invalid password”

• Passwords are case‑sensitive. Double‑check caps lock and any accidental whitespace.
• If you use a password manager, copy‑paste the password to avoid typing errors.
• Cryptomator does not offer password recovery. If you truly cannot remember the password, the only recourse is to delete the vault and start over.

3. Files are not syncing after adding new items

• Some cloud apps (e.g., OneDrive) delay uploads for large files. Give it a few minutes.
• Ensure the vault folder is not marked as “Battery optimization” restricted. Go to Settings > Battery > Battery optimization, find the cloud app, and select “Don’t optimize”.
• Check storage space on the cloud account – a full quota will block further uploads.

4. “Cannot access storage” error on Android 12+

• Android 12 introduced stricter scoped‑storage rules. When prompted, tap “Allow access to all files” and confirm in the system dialog.
• If the prompt does not appear, open Settings > Apps > Cryptomator > Permissions and manually enable “All files access”.

Best‑practice tips

• Use a password manager to store the vault password securely; you will need it on every device.
• Keep a backup of the .c9r file in a separate location (e.g., a USB‑OTG drive). Losing this file plus the password makes recovery impossible.
• Regularly lock the vault when not in use. An unlocked vault leaves decrypted files exposed in the virtual drive.
• Avoid storing the vault in the same cloud folder as other non‑encrypted files. Mixing encrypted and plain files can lead to accidental exposure.
• Test restoration after a major update or after moving to a new device – ensure you can unlock and read files before deleting the original copies.

When to consider alternatives

If you need transparent encryption for apps that do not support the Android Storage Access Framework (e.g., some legacy photo editors), a full‑disk encryption solution or a dedicated encrypted container app like Secure Folder may be more appropriate. Cryptomator excels for personal cloud storage where you want end‑to‑end encryption without root.

With these steps you now have a self‑contained, end‑to‑end encrypted vault on Android, synchronized to the cloud, and usable across multiple devices – all without rooting your phone.