# Cryptomator: Free Open Source Cloud Encryption Tool Source: https://www.youtube.com/watch?v=gALeE4ut5Y8 Recap page: https://rapidrecap.app/video/gALeE4ut5Y8 Generated: 2026-01-16T08:35:06.416+00:00 --- ## Quick Overview The video demonstrates how to set up and use Cryptomator Hub, a self-hosted, open-source platform for client-side encryption of files stored in any cloud service, highlighting its free individual version and paid team options, and concluding with a successful vault creation and team member invitation process. **Key Points:** - Cryptomator allows users to secure and encrypt sensitive data in any cloud service using client-side encryption, ensuring only the user holds the decryption key. - The platform offers a free, self-hosted 'Community' plan for individuals with up to 5 seats, and paid tiers starting at €12.00 per seat/month for teams via Cryptomator Hub. - The setup process involves deploying Cryptomator Hub on a provider like Netcup (using Docker Compose in the demo) via Elestio, which automates installation, configuration, and maintenance. - After service deployment (01:27), the user receives an email with access details, including a unique Account Key required for authorizing new devices (01:47). - A new vault named "Top Secret" is created (02:55) using the Hub interface, generating a crucial Recovery Key that must be saved securely (03:06). - Team sharing is managed via the Keycloak interface (06:18), where the owner can add users (e.g., "janedoe") and assign roles like 'admin' (06:57). ![Screenshot at 00:05: The initial screen of the Cryptomator website emphasizes protecting privacy in any cloud service, showing options for individuals and teams.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-00-05.jpg) **Context:** This video serves as a tutorial demonstrating the deployment and initial configuration of Cryptomator Hub, an open-source, client-side encryption solution for cloud storage, using Elestio as the deployment platform and Keycloak as the identity provider for user management. ## Detailed Analysis The tutorial begins by introducing Cryptomator as an open-source tool for digital self-defense, securing cloud data with client-side encryption (00:00). The presenter highlights that most cloud providers only encrypt data during transmission or keep decryption keys, but Cryptomator ensures only the user retains the key (00:10). The video then navigates to the pricing page, showing a free self-hosted community plan for individuals and paid options starting at €12.00 per seat/month for teams (00:32). The deployment is executed via Elestio, a platform that manages the deployment of open-source software. The presenter selects Cryptomator Hub, chooses Netcup as the provider, selects the 'nbg' region in Germany, and picks the MEDIUM-2C-4G service plan (01:08). After configuring admin details and selecting the Level 1 Basic Support plan (which is included/free) (01:15), the service deployment begins (01:25). Upon completion, an email confirms the service is ready, providing a URL, username, and a secure method to retrieve the password (01:27). The user then logs into Cryptomator Hub, where they receive a unique Account Key necessary to authorize the current device (01:47). After securing the key, the user navigates to the Vaults section (02:07) and creates a new vault named "Top Secret" for Elestio files (02:25). During vault creation, a critical Recovery Key is generated, which the user is strongly advised to copy and store securely, as losing it means losing access to the vault (03:05). Once the vault is created, the user unlocks it locally, revealing the encrypted contents—a folder structure containing cryptographically obscured files (03:33). Finally, the video switches to the Keycloak interface, which manages user roles for Cryptomator Hub (06:18). The presenter navigates to Users, creates a new user named 'janedoe' (06:35), and assigns them the 'admin' realm role (06:57), demonstrating how team access is managed with granular permissions. ### Cryptomator Overview & Pricing - Protects cloud data via client-side encryption - Offers free self-hosted community plan and paid tiers starting at €12.00/seat/month for Hub - Key principle: user holds the decryption key ### Deployment via Elestio - Demonstrates deploying Cryptomator Hub on Netcup using Docker Compose - Requires selecting provider, region (Nuremberg), and service plan (MEDIUM-2C-4G) - Initial setup requires an Account Key for device authorization ### Vault Creation & Security - New vault named "Top Secret" is created in the Hub interface - Generates a critical Recovery Key that must be saved offline to prevent permanent data loss - Unlocking the vault reveals encrypted, unreadable files locally (05:19) ### Team Management via Keycloak - Keycloak acts as the Identity Provider for Hub user management - Users can be added (e.g., 'janedoe') and assigned specific Realm roles (e.g., 'admin') - Owner retains control and can manage access permissions for all team members ![Screenshot at 00:05: The Cryptomator homepage highlighting the core function: protecting privacy in any cloud service like Nextcloud.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-00-05.jpg) ![Screenshot at 00:33: The pricing plans comparison showing the Free \(Self-Hosted\) tier for individuals and the paid Standard/Enterprise tiers for teams.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-00-33.jpg) ![Screenshot at 01:47: The crucial step where the user receives and must securely save their unique Account Key to authorize new devices for Cryptomator Hub access.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-01-47.jpg) ![Screenshot at 03:04: The Recovery Key generation screen, emphasizing the importance of saving this key for emergency vault access.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-03-04.jpg) ![Screenshot at 04:39: The New Device registration prompt within the Cryptomator client, requiring the Account Key obtained from the Hub to authorize the local machine.](https://ss.rapidrecap.app/screens/gALeE4ut5Y8/00-04-39.jpg)