Features
What Krywerk does – and what ends up on your computer, on the server and with the cloud provider.
Drive
- Encrypted folder as a drive
- On Windows with its own drive letter, on macOS and Linux under ~/Krywerk. Every program can work with it.
- Any storage location
- OneDrive, Google Drive, Dropbox, Nextcloud, iCloud Drive, network shares (SMB, NFS) or a USB stick.
- Mount automatically
- Drives with a remembered password are ready right after you sign in to your computer.
- Context menu
- In Explorer, Finder, Dolphin or Nautilus: encrypt names or convert to the modern format.
Personal vaults
- Open format
- Cryptomator format 8: contents with AES-256-GCM, names with AES-SIV, password with scrypt. Also readable with the Cryptomator apps for Android, iOS and Linux.
- Remember password
- In the operating system’s key store: Windows account, macOS Keychain, KWallet or GNOME Keyring.
Team folders
- No shared password
- Sign in with your organization account (e.g. Microsoft 365). Everyone gets the key encrypted for themselves.
- People and groups
- Add, mark as manager, remove – in the app or in the web administration.
- Verify identity
- Compare key fingerprints before granting access – protection against substituted keys.
- Recovery key
- 44 words to print. Opens the team folder even without the server.
- Emergency access
- A council approves with two-person sign-off when no manager is available.
- Renew key
- After someone leaves: a new key for the folder while everyone else keeps working.
Krywerk Server
- Self-hosted
- One executable with SQLite, as a Docker image or systemd service. No license limits.
- Compatible
- Speaks the Cryptomator Hub protocol – the official Cryptomator apps work with it too.
- Web administration
- People, groups, team folders, emergency requests and an audit log of all admin actions with CSV export.
- Operations
- Health check, online backup, verification and restore, automatic database migrations.
Moving from Boxcryptor
- Keep opening
- Boxcryptor folders with key file and password as a drive – without the discontinued service.
- Convert step by step
- Old folder and new vault appear as one drive. New files go to the new format right away, the rest at the push of a button.
What is stored where
| Your computer | Settings, remembered passwords in the system key store, a log without contents. |
|---|---|
| Krywerk Server | Names, email addresses, groups, access and encrypted keys – never files or decrypted keys. |
| Cloud provider | Only encrypted files with encrypted names; the number and approximate size remain visible. |
| Krywerk project | Nothing. No telemetry, no accounts, no update checks. |