Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor?

Because there is no alternative for OS X and iOS.

  • as @Mark touched upon, we don't really have any more information than you. how would we know if it's backdoored, if it's not free and open source software?
    – strugee
    Jul 21, 2014 at 1:19
  • 1
    I'm using SpiderOak, their encryption method seems pretty secure (and is well documented), and it runs on OSX and iOS.
    – mdeous
    Jul 21, 2014 at 1:23
  • 3
    The fact that it's closed source should raise a red flag. So no, you probably shouldn't trust this software.
    – Expedient
    Jul 21, 2014 at 3:18
  • encfs can be used on OSX why ins't that an option? maketecheasier.com/install-encfs-mac
    – YoMismo
    Jul 21, 2014 at 11:05
  • Here are the things I worry about with BoxCryptor: Not open source, and no audit. Encryption is not authenticated. However, perhaps dropbox provides some kind of integrity check? I don't know. Just be aware that possibly your ciphertext could be modified by an attacker that has access to your files. So, you will have to make your own judgment call as to how much you trust the company. (I posted this as an answer, but apparently it doesn't qualify. I question if this has "an answer")
    – DrEntropy
    May 27, 2015 at 19:30

2 Answers 2


That's a judgment call you'll have to make for yourself, but their technical overview has what I consider a huge red flag:

Which data is stored on the Boxcryptor Key Server

Private RSA key (encrypted with the user's password)

The fact that your private key is stored on their server, even if it's encrypted with your password, greatly weakens security. It means that, at best, the security is as strong as your password, rather than being as strong as the underlying encryption.


The storage of the encrypted private key on their servers mentioned by Mark is optional - you can choose to use the local account and distribute the keys yourself.

  • 1
    Done. The EncFS compatibility is there only for the Boxcryptor Classic, which is still available, but unfortunately not supported anymore.
    – numo68
    Jan 3, 2016 at 13:32
  • Have an upvote :-)
    – Rory Alsop
    Jan 3, 2016 at 14:06
  • 1
    Sad that boxcryptor classic is dead. I'll be moving on to something else.
    – Jus12
    Mar 26, 2016 at 11:20
  • @Jus12: What did you move to now? Cloudfogger? I know it's not supported anymore, but I don't think it needs many major updates regarding security - I mean encfs is an pretty old algorithm and as far as it was already implemented correctly, no need to update it. Only feature wise it would be nice.
    – tim
    May 28, 2016 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .