Choose cloud storage that can't read your files

Most cloud storage encrypts your files, but the provider keeps a copy of the key. That means the company can technically read your files, scan them, or hand them over if compelled. Zero-knowledge storage removes the provider from that equation: only you hold the key. This guide explains the difference and compares the main options available in July 2026, so you can decide what fits your needs.

What “zero-knowledge” actually means

Nearly all cloud services encrypt files “at rest” and “in transit,” but they hold the decryption keys, so they can access your data when they choose. Zero-knowledge (also called end-to-end encrypted) storage works differently: your files are encrypted on your device before upload, using a key derived from your password that never leaves your control. The provider stores only scrambled data and genuinely cannot read it, which is why the pattern is sometimes described as the provider having “zero knowledge” of your content.

The trade-off is real and worth understanding: if you forget your password and lose any recovery method, no one, including the provider, can recover your files. That is the flip side of nobody else holding the key.

The default services: convenient, but the provider holds the key

• Google Drive and Dropbox encrypt your files on their servers but retain the keys. Both can access file contents, and both scan for certain content and comply with lawful requests. They are convenient and well integrated, but they are not zero-knowledge.
• iCloud (standard) encrypts most data with Apple holding the keys, though a few categories are end-to-end encrypted by default. On its own, standard iCloud is not zero-knowledge for things like photos and iCloud Backup.

This is not a reason to panic. It is a reason to know that with these defaults, the company can read what you store, so anything genuinely private benefits from a zero-knowledge option or from encrypting it yourself first.

iCloud Advanced Data Protection: a built-in upgrade

If you use Apple devices, you may not need to switch services. Advanced Data Protection (ADP) is an opt-in Apple setting that extends end-to-end encryption to most iCloud categories, including iCloud Photos, iCloud Backup, and Notes. With ADP on, Apple can no longer read that data.

To turn it on (as of July 2026): Settings > [your name] > iCloud > Advanced Data Protection > Turn On Advanced Data Protection, then follow the prompts to set up a recovery contact or recovery key. A few things to know:

• You must set up at least one recovery method first, because Apple can no longer reset your access for you.
• Enabling ADP disables access to your data on iCloud.com by default, since the web would be a point where Apple could otherwise decrypt it.
• Some features stay outside ADP: Shared Albums, iWork real-time collaboration, and “anyone with the link” shares are not end-to-end encrypted even with ADP on.

The zero-knowledge specialists

Proton Drive is end-to-end encrypted cloud storage from the maker of Proton Mail, based in Switzerland. It encrypts file contents, file names, and metadata, offers apps on all major platforms, and supports password-protected, expiring share links. It is a strong general-purpose choice, especially if you already use Proton’s other products.

Tresorit is a Swiss-Hungarian, end-to-end encrypted service aimed at individuals and businesses, with a long track record and strong sharing controls. It also runs the free Tresorit Send service for one-off encrypted transfers. It tends to sit at the more business-oriented, higher-priced end.

Ente focuses specifically on photos and videos as an end-to-end encrypted alternative to Google Photos and Apple Photos. It is fully open source, its cryptography has been independently audited (by Cure53, Symbolic Software, and Fallible), it stores data across multiple EU regions, and you can self-host the server if you wish. If your main concern is a private photo library, Ente is purpose-built for it.

Filen is a German zero-knowledge service that uses AES-256 for file contents and encrypts file names and metadata. It is often among the cheaper options, offers a generous free tier, a network drive, and developer tools such as a CLI and SDKs. It is a good value pick for people comfortable with a newer, smaller provider.

How to choose

• All-round privacy with a familiar feel: Proton Drive.
• A private photo and video library specifically: Ente.
• Best value zero-knowledge storage: Filen.
• Business features and mature sharing controls: Tresorit.
• You live in Apple’s ecosystem: turn on iCloud Advanced Data Protection instead of switching.
• You must keep Google Drive or Dropbox: encrypt files yourself with Cryptomator before they sync (see below).

Migration tips

Moving is straightforward if you take it in steps:

1. Start with what matters most. Migrate your most sensitive folder or your photo library first, rather than everything at once.
2. Download, then upload. Export your files from the old service (for photos, use Google Takeout or Apple’s data export) and upload them into the new app. Most zero-knowledge services offer a desktop app that makes this a drag-and-drop.
3. Set up recovery before you rely on it. Save your recovery key or phrase somewhere safe and offline. With zero-knowledge storage, this is the only way back in if you forget your password.
4. Keep a temporary overlap. Leave the old copy in place until you have confirmed everything transferred and opens correctly, then delete it.
5. If you cannot leave a mainstream cloud, use Cryptomator to encrypt files locally before they sync, so Google, Dropbox, or Microsoft only ever store scrambled data. See Share files without handing over the keys.

Remember that zero-knowledge protects stored files, but a file’s own hidden metadata still travels with it. Before uploading photos, consider stripping their hidden data. For more, see the photos hub.