I'd like to set a single directory inside Dropbox in which files are encrypted on a file-by-file basis.

At the moment, I use a 2Mb Truecrypt container inside my Dropbox which I then have to mount manually, access/change the files within, then unmount manually. At that point, the entire 2Mb uploads to Dropbox. This is a pain for a number of reasons :

  1. Dropbox sync will only occur when the Truecrypt container is unmounted, because Dropbox only syncs files that aren't locked and mounting a container locks it.
  2. A single byte change to one file inside that container results in the whole 2Mb being uploaded again.
  3. It doesn't scale - I was originally using a 10Mb container, but obviously the bigger the container, the longer it takes to sync when it's unmounted.

I was wondering if I can somehow use LUKS to implement file-by-file encryption to get round the "container" issues.

  • Your points #2 and #3 are not correct, Dropbox has a binary diff mechanism -- see dropbox.com/help/8.
    – houbysoft
    Jan 1 '11 at 18:38
  • Then it doesn't work very well, at least with Truecrypt containers. Perhaps a symptom of how Truecrypt saves the files within the container. I've been using this for about 6 weeks now and it's painful. Worse because I'm on cable with a slow upload - I unmount even a 2Mb volume, I'm looking at roughly 3 minutes before Dropbox reports a successful sync.
    – Scaine
    Jan 1 '11 at 19:16
  • Eh, yeah - I'm pretty sure that every byte in a Truecrypt container is re-encoded after close to ensure encryption integrity. Maybe I'm wrong, but it would explain why the binary diff makes so little difference.
    – Scaine
    Jan 1 '11 at 19:18
  • The time it takes is strange, since I have a 250GB Truecrypt drive, and if every byte was rewritten as you suggested, it would take forever to use it, which is not the case currently (I can't notice any speed drop for normal usage). Therefore, I assumed that Truecrypt doesn't rewrite the whole file.
    – houbysoft
    Jan 1 '11 at 20:45
  • 1
    These questions (& answers) should be merged IMO
    – Uli
    Aug 14 '13 at 9:41

I have two methods in place with my Dropbox.

The first is using CryptKeeper Install CryptKeeper. This creates and mounts enc_fs encrypted directories, independent of the Ubuntu implementation of Private.

Instructions by Scaine on using Cryptkeeper are here: How can I do individual file encryption on Dropbox?

CryptKeeper screenshot

The second is symlinking selected directories from ~/.Private into the Dropbox directory. This automatically uploads (and syncs) the encrypted versions of files normally situated in ~/Private. This assumes you have set up the encrypted Private directory! It can also be initially tricky to find the correct one to link.

Ecryptfs screenshot

While neither of these is strictly encryption of a single file, as both use a container of sorts, both methods scale easily as only changed files are uploaded.

  • The first solution doesn't really let me share that data across two PCs easily though does it? I'll take a look at CryptKeeper. Thanks!
    – Scaine
    Jan 1 '11 at 14:41
  • 1
    It does if they're both running Ubuntu! I probably have a slightly odd setup, though, in that I copied my whole /home from one laptop to the other so I had an exact duplicate, with Dropbox syncing my (encrypted) documents and things like .ssh back and forth.
    – Jonathon
    Jan 1 '11 at 14:56
  • CryptKeeper is perfect. I'm going to post additional instructions on how to use it - please copy my answer to yours, then I'll accept your answer. Thanks Jonathon.
    – Scaine
    Jan 1 '11 at 15:00
  • I've now got votes on my answer, so I'll just accept yours and keep mine as a reference.
    – Scaine
    Jan 4 '11 at 9:07
  • I posted a guide which explains how to do cross-platform compatible encryption with encfs for Dropbox here: askubuntu.com/questions/75377/encrypting-data-in-ubuntu-one/…
    – Uli
    Dec 2 '11 at 10:18

As far as I know there will be an integrated encryption mechanism in Dropbox in the future. (I so in feature's requests). In the meantime you may encrypt/decrypt files locally then synchronise them via Dropbox storage.

  • I know that Box.net has had this feature (for Enterprise users) for a while, so likely that Dropbox will add it, but the last update of Dropbox was only a couple of days ago and so sign, so I'm not holding my breath. I'm hoping that someone who knows a bit about LUKS will help - not keen on having to implement per-file encryption manually!
    – Scaine
    Jan 1 '11 at 14:26

Cryptkeeper allows for a per-file encryption folder to be set up as follows :

Install Cryptkeeper :

sudo apt-get install cryptkeeper

Create an encrypted container :

alt text

Left click on the Cryptkeeper icon, then right-click on your new container and delete it (Choose "Delete Encrypted Folder").

Choose "Ok" at the first prompt :

alt text

Then choose "No" at the last prompt :

alt text

Now you'll have a .Private_encfs folder in the directory you specified earlier. Copy this up to Dropbox at the location of your choosing, then simply import that folder from the Cryptkeeper icon. When you import, you'll be asked where you'd like your encrypted data to be mounted. Choose somewhere outside of Dropbox and you'll have a fully encrypted folder integrated into Nautilus into which you can place sensitive files and the encrypted versions of those files will be uploaded to Dropbox automatically.


I use TrueCrypt inside (gigabyte volumes) DropBox and you do not have to upload the whole container every time you change a file. On TrueCrypt GUI there is something called Preserve Time stamp just un tick it (google it) and you will only upload the parts of the container that has changed. Works really well – one thing to keep in mind if you sync with Mac is that if you click on your volume to mount it and you are tempted to select TrueCrypt to be associated with that file Mac will add a resorue fork which Linux Dropbox will refuse to sync. To fix it download FileBuddy on the Mack and use the delete option where you will be offered the option of deleting just the resource fork. Truecrypt has advantages the Cryptkeeper/ecryptfs-util does not have. I think with the Cryptkeeper you may take advantage of the versioning capability of DropBox but I have not tested this.

Best of luck

  • Nice one - useful reference, although I'm now very happy with the Cryptkeeper solution. Can you give examples of where you see Truecrypt have "advantages Cryptkeeper/ecryptfs-util does not have"?
    – Scaine
    Sep 23 '11 at 12:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.