Skip to content

Cryptomator vault format 8 (Krywerk's modern mode)

Summarized on 2026-10-12 from the official documentation and the MIT-licensed source code (cryptolib/cryptofs). Basis for kw-format. Sources at the end.

Files in the vault root folder

  • vault.cryptomator – JWT, signed with HMAC (HS256; HS384/HS512 are accepted), key = encryption master key ‖ MAC master key (64 bytes). Header: kid = "masterkeyfile:masterkey.cryptomator", typ = "JWT", alg = "HS256". Payload: format = 8, shorteningThreshold = 220, jti = random UUID, cipherCombo = "SIV_GCM".
  • masterkey.cryptomator – JSON: version (999, deprecated), scryptSalt (Base64), scryptCostParam (32768), scryptBlockSize (8), primaryMasterKey and hmacMasterKey (32 bytes each, wrapped with AES Key Wrap RFC 3394 under the KEK), versionMac = HMAC-SHA256(MAC master key, version as uint32 big-endian). KEK = scrypt(password UTF-8, salt, N, r, p = 1, 32 bytes).
  • d/ – data folder.

Folders

  • Folder ID: root = "", otherwise a random ASCII string ≤ 36 characters (UUID).
  • dirIdHash = Base32(SHA-1(AES-SIV(encKey, macKey, UTF-8(dirId)))) (RFC 4648, 32 characters).
  • Physical folder: d/ + first 2 characters + / + remaining 30 characters. All folders are stored flat.
  • A folder entry is a folder <name>.c9r containing the file dir.c9r, which holds the folder ID in plaintext (UTF-8).
  • Optionally dirid.c9r in the physical folder: the folder's own ID, encrypted like a file (recovery aid, not a security feature).

Names

  • Plaintext name → Unicode NFC → UTF-8 → AES-SIV (RFC 5297; call encrypt(encKey, macKey, …) = S2V/CMAC with the MAC key, CTR with the enc key) with associated data = UTF-8 of the parent folder ID → Base64url with padding → extension .c9r.
  • If the name including .c9r is longer than 220 characters: folder Base64url(SHA-1(UTF-8(long name))) + ".c9s" with name.c9s (long name as UTF-8) and – for files – contents.c9r, for folders dir.c9r, for symlinks symlink.c9r.

File content

  • Header (68 bytes): nonce (12) ‖ AES-256-GCM(master key enc, nonce, no AAD)(payload 40 bytes) ‖ tag (16). Payload = 8 bytes 0xFF (reserved, formerly the file size) ‖ content key (32 bytes, random).
  • Content in blocks of 32 KiB plaintext; block = nonce (12, random) ‖ AES-256-GCM(content key) (plaintext) ‖ tag (16), i.e. up to 32,768 + 28 bytes. AAD = block number (uint64 big-endian) ‖ header nonce. Only the last block may be shorter. Empty file = header only.

Sources

  • https://docs.cryptomator.org/en/latest/security/architecture/ (vault configuration, master key file)
  • https://docs.cryptomator.org/security/vault/ (header, content, folders, names, shortening, dirid.c9r)
  • cryptolib v2/FileNameCryptorImpl.java, FileContentCryptorImpl.java, FileHeaderCryptorImpl.java
  • cryptofs common/Constants.java, LongFileNameProvider.java, CryptoPathMapper.java, DirectoryIdLoader.java, DirectoryIdBackup.java