DEV Community

Mohd Anas
Mohd Anas Subscriber

Posted on

Best zero-knowledge cloud storage in 2026

Zero-Knowledge Storage in 2026

A comparison written by someone who builds one—including the parts where mine loses.

Google Drive, Dropbox, OneDrive, and iCloud all encrypt your files. They also hold the keys.

That stops a burglar in a datacentre. It doesn't stop the company, anyone who can compel the company, or anyone who breaks into it.

Zero-knowledge storage is the narrower model: encryption happens on your device before upload, and the provider never holds a key that can decrypt your data.

Not a policy—an architecture.

A company that wanted to hand over your files couldn't produce anything readable because it never had the keys in the first place.

Here are eight tools that actually do that, and how they differ.

1. Vault Desk — Best for Sharing You Can Verify

When you share an encrypted file, the server tells your client which public key belongs to the recipient.

If the server quietly substitutes a key it controls, it can read that file invisibly. The encryption still works perfectly—it was simply encrypted for the wrong person.

Vault Desk publishes recipient keys in an append-only Key Transparency log, making any key substitution detectable.

It also uses OPAQUE for login, meaning your password is never transmitted in any usable form and there's no password database to steal.

Filenames and folders are encrypted too, and you can self-host the entire stack.

Trade-off

  • New product
  • No published security audit yet

If an independent audit is your requirement, Proton Drive or Tresorit are safer choices today.

Highlights

2. Proton Drive — The All-Round Pick

If you want one recommendation without spending hours researching, this is it.

Swiss company.

Zero-knowledge encryption by default.

Encrypted filenames and metadata.

Open-source clients.

Published security audits.

The underrated advantage is that Proton also provides Mail, Calendar, VPN, and Password Manager.

That means your email isn't controlled by the same company that stores your files.

When people lose access to a cloud account, they often lose access to the email needed to appeal it.

Trade-off

  • Free tier only reaches 5 GB after onboarding steps
  • Linux has web and CLI, but no native desktop app

Highlights

3. Tresorit — Best for Compliance

If procurement departments are involved, this is the strongest option.

  • ISO 27001
  • Independent audits by Computest and Ernst & Young
  • Admin recovery of file versions
  • Owned by Swiss Post

A particularly interesting data point:

A 2024 ETH Zurich study tested five major end-to-end encrypted providers against a hostile server.

Tresorit resisted the attacks best, while the other four showed weaknesses around metadata manipulation or file injection.

Trade-off

  • Most expensive service here
  • Proprietary client
  • Only 3 GB free

Highlights

4. Filen — Best Open Source Drive

German company.

GDPR-covered.

AES-256-GCM encryption with RSA-OAEP.

Client code is public on GitHub.

10 GB free—double what most privacy-first providers offer.

A good choice if you prefer reading code over trusting marketing.

Trade-off

  • Smaller company
  • Shorter track record
  • Audit programme isn't as extensive as Proton or Tresorit

Highlights

5. Sync.com — Best Storage per Dollar

Zero-knowledge encryption by default.

Excellent version history.

Solid collaboration tools.

Probably the best terabyte-per-dollar value in the category.

If you have a lot of data but don't want to pay a large privacy premium, start here.

Trade-off

Canada is part of the Five Eyes intelligence alliance.

The server still can't decrypt your files, but some people include jurisdiction in their threat model.

Highlights

6. MEGA — Biggest Free Tier

20 GB free.

End-to-end encrypted by default.

No credit card required.

Based in New Zealand.

Nothing else in this comparison comes close on free storage.

Trade-off

  • Transfer limits on free accounts
  • Long and somewhat complicated corporate history

Worth reading about before committing important data.

Highlights

7. Cryptomator — Best if You're Staying with Google Drive


Cryptomator isn't cloud storage.

It's an encryption layer.

It creates an encrypted vault inside Google Drive, Dropbox, OneDrive, or any other sync folder.

Everything—including filenames—is encrypted before syncing.

Open source.

Audited.

Free on desktop.

Most people aren't moving ten years of files to a different provider this weekend.

Cryptomator gives you most of the benefits without changing cloud providers.

Trade-off

You're the administrator now.

  • No encrypted sharing
  • No web access
  • Nobody can recover anything if you lose your keys
  • Mobile apps are paid

Highlights

8. pCloud — Excellent Drive, One Important Caveat

As cloud storage, pCloud is genuinely excellent.

Fast.

Good media handling.

Lifetime plans that become attractive over several years.

It ranks last here for one architectural reason.

Zero-knowledge encryption only applies inside the paid Crypto Folder.

Everything outside that folder is encrypted with keys pCloud controls.

Trade-off

Encryption you have to remember to enable is encryption people forget to use.

Especially at 11 PM when you're in a hurry.

Highlights

Where Mine Loses

I build Vault Desk, so here are the weaknesses.

  • No published security audit.

    • Proton and Tresorit have one.
    • We don't.
    • If audits are your requirement, trust that over everything else here.

  • Mid-sized free tier.

    • MEGA: 20 GB
    • Filen: 10 GB
    • Vault Desk: 5 GB

  • Fewer features.

    • No desktop sync
    • No office suite
    • No collaborative editing

It's a vault, not a workspace.

  • Shorter track record.

Tresorit has been around since 2011.

Longevity is a security property.

Where We Think We Win

  • Key Transparency lets you verify recipient keys instead of trusting the server.
  • OPAQUE removes password databases entirely.
  • Filenames are encrypted on every plan—including the free one.
  • You can self-host if you don't want to trust us at all.

How to Pick

One recommendation, no research?

→ Proton Drive

Sharing sensitive files outside your organisation?

→ Vault Desk

That's the problem we built for.

Need compliance and audits?

→ Tresorit

Want to inspect the code yourself?

→ Filen or Cryptomator

Need lots of storage without spending much?

→ Sync.com

Or MEGA if free storage is the priority.

Already committed to Google Drive?

→ Use Cryptomator on top of it.

Whatever you choose, two things matter more than the provider itself:

  1. Keep a second backup somewhere else.
  2. Don't let the company storing your files also control the email address you'd need to recover your account.

Frequently Asked Questions

What happens if I forget my password?

Nobody can reset it.

Your password derives your encryption key.

Every provider listed here gives you a recovery key during setup.

Lose both, and the data is gone permanently—for everyone, including the provider.

Print the recovery key.

Don't store it inside the vault it unlocks.

Does encryption make storage slower?

Not really.

Modern encryption algorithms are usually faster than your internet connection can upload data.

The real trade-offs are elsewhere:

  • No server-side document search
  • No cloud-generated thumbnails
  • No real-time collaborative editing

That's the price of a server that cannot read your files.

Final Thought

The useful question was never whether a company promises not to read your files.

It's whether it could, if it wanted to—or if someone forced it to.

Every tool in this list is designed so the answer is no.

Pick the one you'll actually keep using.

Top comments (0)