Skip to content

Installation

Krywerk consists of the desktop app (for everyone who uses encrypted folders) and – only for team folders – the key server Krywerk Server, which IT administration runs once for the whole organization.

All packages are available on the releases page, together with SHA256SUMS.txt (checksums) and the software bill of materials (SBOM).

Not signed yet

The packages of version 0.9 are not yet signed with a certificate. Windows (SmartScreen) and macOS (Gatekeeper) therefore show a warning on first launch. The sections below describe how to open the app anyway. Verify the checksum first:

Get-FileHash .\Krywerk_0.9.0_x64-setup.exe -Algorithm SHA256

sha256sum -c SHA256SUMS.txt --ignore-missing

Desktop app

Windows 10 and 11

  1. Run Krywerk_<version>_x64-setup.exe and confirm the administrator prompt. The installer brings everything along: it installs WinFsp (which provides the drives) if it is missing, and on Windows 10 the WebView2 component for the window if needed.
  2. If you see “Windows protected your PC”: More info › Run anyway (the pre-release is not signed yet).
  3. Start Krywerk from the Start menu.

Uninstall: Settings › Apps › Krywerk. WinFsp stays installed because other programs use it too; remove it separately if needed.

Rollout by IT (multiple computers): Krywerk_<version>_x64-setup.exe /S installs silently for all users of the computer, including WinFsp.

macOS

  1. Install FUSE-T: https://www.fuse-t.org or brew install macos-fuse-t/homebrew-cask/fuse-t. FUSE-T does not need a kernel extension.
  2. Open Krywerk_<version>_macos-arm64.zip and drag Krywerk.app into the Applications folder.
  3. On first launch: right-click Krywerk.app › Open › Open. On macOS 15 you may need System Settings › Privacy & Security › Open Anyway.

The packages are built for Apple silicon Macs (M1 and newer). Intel Macs: build from source (see below).

Linux

sudo apt install ./Krywerk_<version>_amd64.deb

Installs the app, krywerk-mount, krywerk-recover and krywerk-hub, and pulls in libfuse 3, WebKitGTK and AppIndicator.

chmod +x Krywerk_<version>_amd64.AppImage
./Krywerk_<version>_amd64.AppImage

Requires your distribution’s libfuse 3 (fuse3).

# Arch: sudo pacman -S --needed base-devel fuse3 webkit2gtk-4.1 libayatana-appindicator
# Debian/Ubuntu: sudo apt install build-essential pkg-config libfuse3-dev fuse3 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev
git clone https://github.com/mzilinski/krywerk && cd krywerk
crates/kw-app/linux/install.sh          # into ~/.local, with a start menu entry

To remove: crates/kw-app/linux/install.sh --uninstall.

Remembering passwords requires a keyring in the session (KWallet or GNOME Keyring). On GNOME, the system tray icon only appears with the extension AppIndicator and KStatusNotifierItem Support.

Command line only

The archives krywerk-cli_<version>_<platform> contain krywerk-mount (drive), krywerk-hub (manage team folders), krywerk-recover (Boxcryptor files without a drive) and krywerk-server. Unpack them and put them on your PATH; get help with <program> --help.

Krywerk Server

Only needed for team folders. Covered in detail in Running Krywerk Server; here is an overview of the options:

Option For Guide
Docker Compose with Caddy (automatic TLS) production, recommended Operation › Installation with Docker
… additionally with your own Keycloak sign-in via Microsoft 365 (Entra ID) Operation › With your own Keycloak
systemd without Docker existing reverse proxy Operation › Without Docker
docker-compose.yml in the repository trying it out, development below

The ready-made image for each version: ghcr.io/mzilinski/krywerk-server:<version>.

Trying it out

git clone https://github.com/mzilinski/krywerk && cd krywerk
cp .env.example .env              # enter the issuer of your identity provider
docker compose up -d --build
curl http://127.0.0.1:8380/health # → ok

All settings: Configuration.

Building from source

Requirements: Rust (stable, at least the rust-version from Cargo.toml), a C compiler, pkg-config and the system’s drive driver (WinFsp with developer files, FUSE-T or libfuse3-dev), plus WebKitGTK 4.1 and AppIndicator on Linux.

make build      # all programs into target/release/
make test       # tests
make help       # all targets