How to Encrypt Files Before Uploading to OneDrive or Google Drive

OneDrive and Google Drive encrypt your files, but they keep the keys. If you want documents in the cloud that only you can read, encrypt them before they are uploaded.

In short

Provider encryption doesn't help against a hacked account, shared links or the provider itself.
OneDrive Personal Vault is an extra lock, not end-to-end encryption. Personal Google Drive has no password-protected folders.
Encrypt on your PC: a Cryptic Disk container in the sync folder. The cloud only gets encrypted data.
Rules: keep the container on the PC, one computer at a time, unmount before switching.

What cloud encryption protects, and what it doesn’t

Cloud services encrypt data in transit and usually on their servers, with keys the provider manages. That stops intercepted traffic and stolen data center disks, but not this:

Account takeover A leaked or phished password, or a session left open on someone else's PC: whoever signs in sees all your files decrypted.

Shared links Whoever has the link has the file. Links get forwarded, saved in chats and forgotten.

The provider and legal requests With the keys, the provider can technically decrypt your files, for example to comply with a lawful request.

The copy on your PC The sync folder sits on your disk unencrypted unless the disk itself is encrypted.

Fine for holiday photos. For passport scans, contracts, medical records, tax papers and client archives, encrypt the files yourself.

What OneDrive and Google Drive offer

OneDrive Personal Vault

What you get

A protected folder that opens after an extra identity check
Locks again after a period of inactivity
No file limit with Microsoft 365

Limits

Not end-to-end encryption: Microsoft holds the keys
Limited number of files on free plans

Google Drive

A personal account has no password-protected folders. Client-side encryption exists only in some Google Workspace editions for organizations, set up by an administrator.

And Dropbox?

Dropbox has password-protected links and end-to-end encryption for team folders on some business plans. Dropbox Vault was retired in March 2025. More, with two ways to encrypt it, in How to Encrypt a Dropbox Folder.

Client-side encryption: a Cryptic Disk container in your sync folder

Keep sensitive files in an encrypted container, a single file inside the sync folder. Cryptic Disk mounts it as a drive in File Explorer after you enter the password and encrypts files on the fly. The cloud only gets a file that looks like random data, with no markers by default, so nobody can even prove it is a container (features). It works with any app that syncs a folder: OneDrive, Google Drive, iCloud for Windows, Dropbox and others.

How to set it up

Install Cryptic Disk on every PC

Download Cryptic Disk to every Windows PC where you need the files; a portable copy works too. Click "Create Encrypted Container..." in the main window.

The Cryptic Disk main window with the "Create Encrypted Container..." link

Put the container in the cloud folder

For example C:\Users\Name\OneDrive\Documents\Private.dat. Size: enough for your files with some reserve, no more (see the rules below).

The first page of the wizard: container file path and size

Set a long password

A passphrase of several random words works well: How long should a password be.

The wizard page for the password and key files

Save the header backup outside the cloud

Save the encryption key backup (header) the wizard offers, for example to a USB stick. It is protected by the password valid when you saved it: it helps if the header is damaged or you forget a later new password, not if you forget the only one.

The last page of the wizard with the header backup link

Move your files in

Mount the container, move the sensitive files into it and delete the unencrypted copies from the cloud folder. Empty the cloud's recycle bin on the website too, or the copies stay there.

A mounted encrypted container shown as a drive in File Explorer

Unmount when you are done

The cloud app then uploads the changed file.

Every page of the wizard: How to Create an Encrypted Container.

Rules for a container in the cloud

Keep the container on the PC Cloud apps can show files that live only online. In OneDrive, right-click the container and choose "Always keep on this device". In Google Drive for desktop, switch My Drive to mirroring or make the container available offline.

Let the cloud see the change In the container properties, turn off restoring the last modification time of the container file, or the sync app may not notice the change. After the first session, check that the file was uploaded.

One computer at a time If two PCs change the container, the service can't merge them and keeps a conflicting copy.

Unmount before you switch PCs Unmount, wait until syncing has finished, then open it on the other computer.

Don't make it huge For the cloud it is one big file: a change can mean uploading much of it or all of it again. Several containers by project are easier.

No phone or browser access Cryptic Disk works only on Windows. Keep files you need on your phone outside the container.

Never mount the container to a folder inside the cloud folder. Cryptic Disk can mount to an empty folder instead of a drive letter; inside the sync folder, the cloud would upload the decrypted files.

Version history still works, but for the whole container: you can restore the entire container to an earlier version.

Other options, honestly

Password-protected archive For one-off sharing: 7-Zip with AES-256 (in 7z, tick "Encrypt file names" to hide them too), the password sent another way. Clumsy every day, and decrypted copies stay in Downloads. Avoid weak old ZipCrypto.

OneDrive Personal Vault A check when you open it. Suits you if you need phone access and trust the provider.

BitLocker or Device encryption Protects the copy on your PC while it is off, not the files on the provider's servers.

Tips

Turn on two-factor authentication: it also protects the files you don’t encrypt.
Don’t keep the container password in the same cloud. Use a password manager for web accounts and a long, easy-to-type passphrase for the container.
Remove shared links you no longer need.

Sync is not a backup. If the container is damaged or deleted, syncing spreads that to every PC. Keep a separate copy of important files.

FAQ

Does OneDrive or Google Drive encrypt my files?

Yes, in transit and on their servers. But the provider holds the keys, so anyone who signs in to your account can read them.

Can I password-protect a folder in Google Drive?

Not in a personal account. Keep the files in an encrypted container inside your Google Drive folder instead.

Is OneDrive Personal Vault end-to-end encrypted?

No. It asks for an extra check when you open it, but Microsoft keeps the keys.

Can I open the encrypted files on my phone?

No. A Cryptic Disk container opens only on a Windows PC running the program, installed or portable. The cloud and the mobile app show just one container file.

What happens if my cloud account is hacked?

The attacker sees your ordinary files, but the container is unreadable without the password. Change your account password right away and turn on two-factor authentication.

Try Cryptic Disk free for 30 days

No limitations during the trial. Windows 11, 10, 8.1, 8, 7, Vista and XP.

Free Trial Pricing & Buy