Skip to content

4. Using team folders

A team folder is an encrypted folder for several people – for example for a subject group, a committee, or the administration. There is no shared password: anyone with access opens the team folder with their own organization account (for example the school's Microsoft 365 account). Your organization's key server manages the key; the server itself cannot read the files.

One time: connect your organization account

  1. Open ⚙ Settings › Organization account.
  2. Under “Key server address”, enter the address you received from your IT department, for example https://schluessel.schule.example.
  3. Click “Connect organization account”.
  4. Krywerk asks once: “Confirm key server”. Confirm with “Trust and continue” if the address is the one your organization gave you. The second address shown belongs to the identity provider (for example Microsoft).
  5. Krywerk opens a new tab in your default browser with the sign-in page. Sign in there with your organization account. The browser then shows “Sign-in successful”; you can close the tab.
  6. At the top of the Krywerk window you now see, in green, “Organization account: Your Name”.

The first time: set up your account and keep your unlock code safe

If you use team folders for the first time, Krywerk shows “Set up account …”. Click it. Krywerk then shows your unlock code – only this one time.

  • Keep the unlock code in a safe place: “Copy” it into a password manager, or “Save as file …” in a safe location (not in the team folder itself).
  • Check “I have stored the unlock code safely.” and click “Done”.

Krywerk has already unlocked this computer in the process. You need the unlock code for every additional computer – without it you cannot open team folders there.

Unlocking another computer

On another computer, connect your organization account as described above. Krywerk then shows “Unlock device …” (or asks for it the first time you open a team folder). Enter your unlock code – spaces, hyphens, and upper or lower case don't matter.

Signing in after a restart

Krywerk remembers your sign-in until you quit Krywerk. After a restart, the top of the window shows, in yellow, “Organization account: not signed in – Sign in”. Clicking it (or “Sign in now”) opens the sign-in in your browser again.

Opening a shared team folder

To open a team folder, you need two kinds of access:

  1. The files: The folder has to reach your computer – usually the person responsible shares it with you in OneDrive (in OneDrive: “Shared” › folder › “Add shortcut to My files” so that it is synced).
  2. The key: The person responsible adds you in Krywerk and grants you access.

As soon as both are in place, the team folder appears in “My drives” with the label “Team”. Krywerk looks for the folder in OneDrive and other cloud folders by itself.

  • “Open” mounts the team folder as a drive. “Show in Explorer” opens it, “Close” unmounts it.
  • If it says “Folder not found on this device”, the folder is not synced (yet). Check the OneDrive share – or select the folder yourself with “Find folder …”.
  • If Krywerk reports when opening that access has not been granted yet, ask the person responsible to click “Manage” › “Grant access” for this team folder in Krywerk.

Creating and sharing a team folder yourself

  1. On the overview, choose “+ Add” › “Create and share team folder …”.
  2. Where? Choose an empty folder – or a folder in which Krywerk creates a new subfolder (field “New subfolder”). A folder in OneDrive is a good choice for collaboration.
  3. Team folder name – this is how others see it in Krywerk. Empty = the folder's name.
  4. Who? Search for people or groups (name, email, or group) and add them:
  5. “Add” – as a member: can open the team folder and read and edit files.
  6. “Add as manager” – can additionally add and remove people, grant access, show the recovery key, set up emergency access, archive, and renew the key.

With Krywerk Server, people only show up in the search after they have signed in once with Krywerk (or Cryptomator) – so ask new colleagues to connect their organization account first. 5. Click “Create team folder”. 6. Krywerk shows the recovery key – see chapter 5. Print or save it, check “I have stored the recovery key safely.”, and click “Done”. 7. Also share the folder in OneDrive with the same people (right-click › Share). Krywerk only controls who can decrypt the files – OneDrive still distributes them.

Recommendation: Add a second person as a manager and set up emergency access. Otherwise, if you are unavailable, nobody can add people or grant access anymore.

Granting access

Someone newly added to a team folder only receives the key once a manager grants access. This can only be done from the manager's computer, because Krywerk encrypts the key for the new person in the process.

Krywerk points this out to you: - on the overview: “1 person is waiting for access …”, and on the team folder “1 waiting for access”, - in the system tray: in the icon's tooltip and in the entry “Pending access: …” in the right-click menu.

On the team folder, click “Manage”, check the people under “Waiting for access”, and click “Grant access”. For people whose identity has not been confirmed yet (“not verified ⚠”), check first with “Verify identity …” – see chapter 5.

Your fingerprint

Before someone grants you access, they can check whether the key server really gives them your key. You find your fingerprint under ⚙ Settings › Organization account › “Show fingerprint” (eight blocks of digits and the letters A–F). The first time on a computer, Krywerk asks once for your unlock code. Read your fingerprint out to the person asking on the phone or in person – not by email or chat, because those could run through the same channels as the key server.