PrivacyNotes
Zero-knowledge notes, tasks, files, passwords and journal secured by a single 12-word recovery phrase, with no email or password required. The crypto core and database schema are published for audit. No subscription model.
Private alternatives to WinZip, BitLocker, vetted against our public criteria.
Grouped by threat level
Zero-knowledge notes, tasks, files, passwords and journal secured by a single 12-word recovery phrase, with no email or password required. The crypto core and database schema are published for audit. No subscription model.
A free, fully client-side file encryptor that runs in your browser. Drop in any file, set or generate a passphrase, and it seals the result into its own .vrn format. Nothing is ever uploaded, and it works offline.
It can create a virtual encrypted disk that works just like a regular disk but within a file. It can also encrypt a partition or the entire storage device with pre-boot…
Cryptomator encrypts your data quickly and easily. Afterwards you upload them protected to a cloud service.
LUKS (Linux Unified Key Setup) is the standard disk-encryption specification for Linux, implemented by the cryptsetup utility. It provides a header format and key-slot system on top of the dm-crypt kernel module, supporting multiple decryption passphrases per volume.
GnuPG (GNU Privacy Guard) is the free, GPL-licensed implementation of the OpenPGP standard. A command-line tool for Linux, macOS, and Windows, it encrypts and signs files and email, and manages public-key directories.
OpenKeychain is an OpenPGP implementation for Android. It manages your keys and those of your contacts, and integrates with K-9 Mail and FairEmail for end-to-end encrypted email on Android devices.
Gpg4win is the official Windows installer for GnuPG, bundling the Kleopatra certificate manager and GpgOL for Outlook integration. It provides OpenPGP and S/MIME encryption for files and email on Windows.
Kryptor is a free, open-source file encryption and signing CLI for Windows, Linux, and macOS. It uses modern primitives via libsodium (XChaCha20-Poly1305, Argon2id, Ed25519) with no configuration options and encrypts file names optionally.
Tomb is an open-source Linux CLI tool that creates and manages encrypted volumes using dm-crypt and LUKS. It wraps the standard kernel encryption stack in a simple shell script, with optional steganographic key hiding and FIDO2 support.
GnuPG allows you to encrypt and sign your data and communications. Following are download links for different platforms. Mac: GPG Suite . OpenKeychain for Android: Google Play…
No matches for those filters.
| Tool | Scope | Based in | Cost |
|---|---|---|---|
| | Files | · | Free |
| | Files | Switzerland | Freemium |
| | Container | France | Free |
| | Files | Germany | Freemium |
| Disk | Czechia | Free |
| | Files | Germany | Free |
| | Files | Germany | Free |
| | Files | Germany | Free |
| Files | · | Free |
| Container | Netherlands | Free |
| Files | · | Freemium |
| | Files | · | Free |
| | Files | · | Free |
| | Disk | United States | Free |
| | Disk | United States | · |
Encryption is what turns a stolen laptop or a breached cloud account into a pile of useless gibberish. These tools let you encrypt files and folders yourself, so the protection travels with the data wherever it goes rather than depending on whatever service happens to be holding it. From full-volume encryption that locks an entire disk to single-file lockers for one document, pick the one that fits what you are protecting and where it is headed.
A password prompt and real encryption are not the same thing, and conflating them is where people get caught out. Locking a document with a password in an everyday file utility often relies on a weak, decades-old scheme that recovery tools crack quickly, and some “protected” formats barely scramble the data at all. There is no setting that upgrades a weak format into a strong one; the algorithm is baked into the format itself. Genuine protection means a tool built around a modern, reviewed cipher, where the password actually gates strong encryption. That is the line every pick on this page sits on.
Different needs call for different designs, and naming yours first narrows the field fast. Whole-volume encryption protects an entire disk or container, ideal for a laptop that could be lost or seized, which is what VeraCrypt is built for. File-level tools encrypt individual files or folders, perfect for adding a layer before something hits the cloud, which is exactly what Cryptomator does. Lightweight single-file encryptors are best for protecting one file to send to someone. Use the one that matches what you are protecting rather than forcing a single tool to cover every case.
Every tool here is measured against our public listing criteria: open-source code that has been independently reviewed, strong modern algorithms rather than vague “military-grade” claims, and a clear, documented format so your files are never hostage to one app. We weigh cross-platform support, since an encrypted file is only useful if it opens where you need it, and an active project, since a cipher needs maintenance. We are cautious with closed products you cannot inspect. We only list encryption we would trust with our own files.
Begin with openness, because cryptography you cannot inspect is cryptography you cannot trust; prefer code that has been independently reviewed. Confirm the tool uses a strong, modern algorithm and, just as important, a documented format, so your data is portable and not locked to one program forever. Check that it runs on every platform where you will need to open the file. And treat key handling as part of the tool: a clear recovery story and a sensible passphrase workflow matter as much as the cipher, since most real-world failures are lost keys, not broken math.
Yes, and the reasoning is the opposite of intuition. With most software, you trust the vendor to have built it well. With cryptography, secrecy is a liability: an algorithm is only considered sound after experts have publicly attacked it and failed, which can only happen when the code and the design are open. A closed “military-grade” product asks you to trust a claim no one outside the company can verify. The open, reviewed tools here have survived exactly the scrutiny that closed products avoid, which is why they are the safer bet.
Decide what you are protecting first: a whole laptop, files headed to the cloud, or a single file for someone else. Install the matching tool, encrypt a test file, then confirm it opens on every device you use before you rely on it. Then store your passphrase in a password manager and back up any recovery key, since a lost key is the one failure encryption cannot save you from. If you just need to lock a single file quickly, our own Encrypt tool runs entirely in your browser, encrypts with modern primitives, never uploads anything, and the code is open for anyone to check. For files headed to the cloud, pair encryption with encrypted cloud storage so the protection travels with the data.