How to Encrypt a Dropbox Folder with Client-Side Encryption

How to Encrypt a Dropbox Folder with Client-Side Encryption

You can’t put a password on an ordinary folder in Dropbox. Dropbox encrypts your files on its servers, but it keeps the keys, so anyone who gets into your account sees everything. For a folder only you can open, encrypt the files on your PC before Dropbox uploads them.

In short
  • No folder passwords: Dropbox protects shared links with a password, not folders in your account.
  • Dropbox Vault is gone since March 4, 2025. End-to-end encryption exists only for team folders on Advanced, Business Plus and Enterprise.
  • Method 1, any plan: an encrypted Cryptic Disk container in your Dropbox folder. Dropbox stores only encrypted data.
  • Method 2: the whole Dropbox folder on an encrypted drive. Protects the copy on your PC, not the files on Dropbox servers.

As of October 2026:

Standard encryption on Dropbox servers All plans: TLS in transit, 256-bit AES at rest. Dropbox holds the keys: this stops stolen data center disks, not someone in your account, Dropbox itself or a legal request to it.
Password-protected shared links Per the Dropbox help center: Professional, Essentials and all team plans (Standard, Business, Advanced, Business Plus, Enterprise), not Basic or Plus. Password, expiration date, no downloads. Protects the link, not your folder.
Dropbox Vault: discontinued in 2025 A PIN-locked folder on Plus, Family and Professional, not end-to-end encrypted (keys held by Dropbox). Discontinued on March 4, 2025: Vault folders became ordinary folders without a PIN.
End-to-end encrypted team folders Since 2024 on Advanced (Business Plus) and Enterprise. An admin turns it on and saves a recovery key; Dropbox can't read the files. Team folders only; no shared links, file requests, previews or content search.

Used Vault? Check that folder: its files are now as open as everything else in your account.

For personal accounts and other team plans, the one reliable way to an encrypted Dropbox folder is client-side encryption that you control.

Dropbox end-to-end encryption vs client-side encryption with Cryptic Disk

  Dropbox encrypted team folders Cryptic Disk container
Plans Advanced / Business Plus, Enterprise Any, including free Basic
Set up by A team admin You
File names Visible to Dropbox Hidden in the container
Copy on your PC Not encrypted Encrypted while unmounted
Access Desktop app, web, mobile browser; not the mobile app Windows PCs with Cryptic Disk
Working together Team, with member management You share file and password; one PC at a time
Lost password Admin’s recovery key No back door: data is lost

A team on Advanced or Enterprise editing encrypted files together is better served by Dropbox’s team folders. For a personal account, a smaller plan or files only you open, a container is simpler, and it also hides file names and protects the local copy.

Method 1: client-side encryption with a container in your Dropbox folder

An encrypted container is one file that Cryptic Disk mounts as a virtual drive after you enter the password; everything on that drive is encrypted on the fly. Dropbox syncs a file that looks like random data.

Install Cryptic Disk

On every Windows PC where you need the files. The installer can also extract a portable copy to a folder or USB stick.

Create the container inside Dropbox

Click "Create an encrypted container". On the first wizard page, set a path in your Dropbox folder, for example C:\Users\Name\Dropbox\Private.dat, and a size with some reserve.

The Cryptic Disk wizard: choosing the path and size of the encrypted container file
Set a long password

Keep the default encryption settings. A passphrase of several random words is easy to type and hard to guess.

Save the header backup outside Dropbox

For example on a USB stick at home. It helps if the header gets damaged or you forget a later password, but it stays protected by the password valid when you saved it: keep that one too.

Mount, work, unmount

Enter the password, pick a drive letter and work as usual. Then unmount from the main window or the tray icon, and Dropbox uploads the changed container.

In the container properties on each PC, turn off restoring the last modification time of the container file: otherwise Dropbox may not notice the change. After the first session, check in Dropbox that the file was uploaded.

Every wizard page is explained in How to Create an Encrypted Container.

Practical notes

One PC at a time If two PCs change the container, Dropbox can't merge them and keeps a conflicted copy.
Unmount before you switch Wait until Dropbox shows everything is up to date, then mount on the other PC.
Keep it reasonably small A huge container is slow to upload and sync. One per project or topic is fine.
Available offline With online-only files, keep the container as a normal file on your disk.
Windows only Files inside don't open in the Dropbox mobile app or on dropbox.com.
Version history works For the whole container: roll it back to an earlier version if needed.

Never mount it to a folder inside Dropbox. If you mount the container to an empty folder instead of a drive letter, keep that folder outside Dropbox, or Dropbox uploads the decrypted files.

Method 2: move the whole Dropbox folder to an encrypted drive

The original method of this guide: Dropbox keeps its folder on an encrypted container or drive. A stolen laptop or another user of this PC can’t read the files while the drive is unmounted, and they stay available on your phone and the web.

Dropbox still uploads ordinary, unencrypted files. On its servers they have only Dropbox's own encryption.

Before you start: create an encrypted container or encrypt a volume with room for everything Dropbox syncs, NTFS, and let Dropbox finish syncing. The Dropbox screenshots are from an older version: newer ones keep the folder location in the preferences section about syncing.

Mount the encrypted container

Right-click the container in Cryptic Disk, choose "Mount Container...", enter the password and pick a free letter, here "P:". Dropbox will look for its folder there.

Mount window with the drive letter P: selected
Move the Dropbox folder to drive P:

Dropbox tray icon, gear icon, "Preferences...". At the folder location click "Move...", select "P:", click "OK" and confirm. Dropbox creates a Dropbox folder there and moves all files.

Choosing the encrypted drive P: as the new Dropbox folder location
Turn off Dropbox autostart

Dropbox must not start before the drive is mounted. Clear "Start Dropbox on system startup" and click "OK".

Dropbox preferences with the startup option turned off
Always mount to the same letter

Right-click the mounted container, "Properties...", enter the password. On the "Basic" tab enable "Save mount settings for this volume" and select "P:". Hot keys can be set here too.

Encrypted Volume Properties: saved mount settings with drive letter P:
Add an action after mounting

"Actions" tab, "After mounting" subtab, "Add", "Run program...".

Actions tab: adding the Run program action
Enter the path to Dropbox.exe

Here it is in AppData; newer versions are usually under Program Files (see the Dropbox shortcut's target). To test, exit Dropbox and click "Run". Then "OK" in both windows.

Run programs window with the path to Dropbox.exe

Day to day: mount the drive with your password, and Dropbox starts and syncs. To close access, exit Dropbox from its tray menu and unmount. If Dropbox ever starts first, it won't find its folder: exit it, mount, start it again.

Which method to choose

Method 1: container in Dropbox Neither Dropbox nor anyone in your account should read the files: only encrypted data leaves your PC. Or combine: everyday files as usual, sensitive ones in a container.
Method 2: folder on an encrypted drive You protect the laptop's local copy and need the files on your phone and the web. If BitLocker or Windows Device encryption already protects the system drive while the PC is off, Method 2 adds a separate password.

The same works for OneDrive, Google Drive and other clouds: How to encrypt files before uploading them to the cloud.

FAQ

Can you password-protect a folder in Dropbox?

Not an ordinary folder. Professional, Essentials and team plans can password-protect shared links, and Dropbox Vault with its PIN was discontinued in March 2025. For a folder that opens only with your password, use an encrypted container (Method 1).

Is Dropbox end-to-end encrypted?

Not by default: Dropbox holds the keys, so someone who signs in to your account sees your files. End-to-end encryption exists only for team folders on Advanced, Business Plus and Enterprise. Elsewhere, encrypting files yourself before upload gives comparable protection.

What happened to Dropbox Vault?

Dropbox discontinued Vault on March 4, 2025, and Vault folders became ordinary folders without a PIN. Vault was never end-to-end encrypted.

What happens if I forget the container password?

Dropbox can’t help: it has only the encrypted file. A header backup helps only with the password valid when you saved it. If you forget the only password, the data is lost: there is no back door.

Can I open the encrypted files on my phone?

No. Container files open only on a Windows PC with Cryptic Disk, installed or portable. With Method 2 the files on Dropbox servers stay unencrypted, so the mobile app still shows them.

Try Cryptic Disk free for 30 days

No limitations during the trial. Works with any Dropbox plan, including free Basic.

Free Trial Pricing & Buy