Repolode
Submit
rfjakob

rfjakob/gocryptfs

An encrypted overlay filesystem in Go that mounts a folder of ciphertext as a readable plaintext view via FUSE.

Open-source alternative to:CryptomatorVeraCrypt

View on GitHubWebsite
Stars
4,652
Forks
303
Open issues
67
Last commit
20 days ago

What is it?

gocryptfs keeps your files encrypted on disk and presents them as normal, decrypted files through a mount point. You create an encrypted directory with a single init command, then mount it to a second directory; anything written to the mount is encrypted into the backing folder, and the backing folder can be synced or backed up without exposing plaintext.

It is built on the go-fuse FUSE library and was designed as a successor to EncFS that addresses its security weaknesses. Content is encrypted with AES-GCM by default, with XChaCha20-Poly1305 available as an option for CPUs without AES acceleration, and a reverse mode exposes an encrypted view of a plaintext directory. The project includes fsck, password-change, and a stable CLI ABI for scripting.

Linux is the primary platform, macOS support is described as beta, and Windows users are pointed to a separate C++ reimplementation.

Key features

  • 01Transparently encrypts file contents and file names in a backing directory.
  • 02Mounts through FUSE so existing applications can read and write normally.
  • 03Offers AES-GCM and XChaCha20-Poly1305 content encryption.
  • 04Provides a reverse mode that exposes an encrypted view of a plaintext folder.
  • 05Includes fsck, password change, and a stable CLI interface for scripts.

Use cases

  • Encrypting a local folder that is synced to cloud storage or a NAS.
  • Keeping sensitive documents encrypted at rest on a Linux laptop.
  • Creating encrypted backups that can be copied without exposing plaintext.
  • Calling gocryptfs from scripts or GUI front-ends such as SiriKali.

Quick start

  1. 1

    Install from your distribution's package manager (Debian/Ubuntu)

    apt install gocryptfs
  2. 2

    Create cipher and plain folders

    mkdir cipher plain
  3. 3

    Initialize the encrypted folder

    ./gocryptfs -init cipher
  4. 4

    Mount the encrypted folder as a plaintext view

    ./gocryptfs cipher plain

Things to know

  • Native platform is Linux; macOS support is beta and Windows needs a separate project.
  • The FUSE package from your distribution must be installed for mounting to work.

Topics

#encryption#filesystem#fuse#golang#security#backup#gcm

FAQ

What is gocryptfs?
An encrypted overlay filesystem in Go that mounts a folder of ciphertext as a readable plaintext view via FUSE. gocryptfs keeps your files encrypted on disk and presents them as normal, decrypted files through a mount point. You create an encrypted directory with a single init command, then mount it to a second directory; anything written to the mount is encrypted into the backing folder, and the backing folder can be synced or backed up without exposing plaintext.
Is gocryptfs free to use? What license does it have?
gocryptfs is open source under the MIT license. Check the license terms before using it in commercial products.
Is gocryptfs still maintained?
Actively maintained. The last commit to gocryptfs was on Oct 1, 2026.
What can I use gocryptfs for?
Encrypting a local folder that is synced to cloud storage or a NAS. Keeping sensitive documents encrypted at rest on a Linux laptop. Creating encrypted backups that can be copied without exposing plaintext. Calling gocryptfs from scripts or GUI front-ends such as SiriKali.
How do I install gocryptfs?
Install from your distribution's package manager (Debian/Ubuntu): apt install gocryptfs Create cipher and plain folders: mkdir cipher plain Initialize the encrypted folder: ./gocryptfs -init cipher Mount the encrypted folder as a plaintext view: ./gocryptfs cipher plain
Where can I get gocryptfs?
The source code and installation instructions are on GitHub: https://github.com/rfjakob/gocryptfs

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects