Our verdict: the most established open-source tool for adding zero-knowledge, AES-256 encryption on top of any cloud storage — a safe default when you want to keep your own keys.
Cryptomator adds client-side encryption on top of your existing cloud storage: it puts your files inside password-protected vaults that are encrypted with 256-bit AES before anything syncs, so your cloud provider only ever sees ciphertext. It runs on Windows, macOS, Linux, iOS and Android, and is developed by the German company Skymatic GmbH.
The design is zero-knowledge with no accounts required, and it works with any cloud such as Dropbox, Google Drive, OneDrive or Nextcloud. The desktop apps are free and open source under GPLv3, while the mobile apps are free but read-only until a one-time in-app purchase unlocks write access. Its core cryptography was independently audited by Cure53 (public 2017 report).