gocryptfs is an encrypted overlay filesystem built on FUSE. Files remain individually encrypted in a backing directory while a mounted filesystem exposes their decrypted contents to applications.
This file-based design differs from whole-device encryption. The encrypted directory can be copied, synchronised or backed up with ordinary file-oriented tools, and the encrypted filesystem grows dynamically as additional files are stored.
This is free and open source software.
Key Features
- Forward mode stores encrypted files on disk while presenting their plaintext contents through a mounted filesystem.
- Uses AES-256-GCM by default for authenticated file-content encryption.
- Uses EME wide-block encryption to protect filenames.
- HKDF derives independent keys for content and filename encryption from the master key.
- Supports XChaCha20-Poly1305 as an alternative content cipher, particularly useful on processors without fast AES acceleration.
- Reverse mode presents a read-only encrypted view of an existing plaintext directory, making it useful for encrypted backups without requiring a second full copy of the data.
- AES-SIV provides deterministic authenticated encryption where required by reverse mode.
- Supports FIDO2 authentication options.
- Can use password files or external password commands for automated workflows.
- Supports hard links, extended attributes, sparse-file operations and other common filesystem facilities.
- Configurable filename-length handling helps with cloud storage services that impose restrictive path limits.
- A filesystem check mode detects several forms of corruption.
- Provides a stable command-line ABI for applications and scripts that integrate gocryptfs.
Website: github.com/rfjakob/gocryptfs
Support:
Developer: Jakob Unterwurzacher
License: MIT License
gocryptfs is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Encrypted FUSE-based file systems | |
|---|---|
| Cryptomator | Multi-platform transparent client-side encryption of files in the cloud |
| gocryptfs | Encrypted overlay filesystem written in Go |
| CryFS | Cryptographic filesystem for the cloud |
| securefs | Authenticated and probabilistic encryption with efficient cloud synchronization |
| EncFS | Encrypted filesystem in user-space |
| rcryptfs | Read and write encrypted repositories using common gocryptfs settings. |
Read our verdict in the software roundup.
| Disk Encryption Tools | |
|---|---|
| VeraCrypt | Strong disk encryption software |
| loop-AES | Encrypt disk partitions, removable media, swap space and other devices |
| dm-crypt | Transparent disk encryption subsystem |
| cryptsetup | Configures encrypted block devices |
| GnuPG | GNU Privacy Guard - implementation of the OpenPGP standard |
| gocryptfs | Encrypted overlay filesystem written in Go |
| Tomb | System for file encryption |
| Shufflecake | Create multiple hidden volumes |
| zuluCrypt | Feature rich solution for hard drive encryption |
| cryptmount | Managing encrypted file systems |
| disk-encryption-tool | Encrypt existing Linux storage without reinstalling the system |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.