Cryptomator Release Notes

For a comprehensive view of changes, read the CHANGELOG.

Security Fixes 🚨

• Cryptomator Hub: Fixed possible man-in-the-middle attack with tampered vault config (#4179, CVE-2026-32303)
• Disallow unencrypted http connections to hub by default (CVE-2026-32309)
• Fixed loading of masterkey file from arbitrary paths (#4180, CVE-2026-32310)
• Fixed not-configured plugin directory does not disable plugin search (#4176)

What's New 🎉

• Cryptomator Hub: Trust on first use when unlocking a Hub vault (#4179)

Bugfixes 🐛

• Fixed Finder window opens twice when revealing vault on macOS (#4177)
• Fixed app does not start due to secret service detection failure on Linux (#4175)

Other Changes 📎

• Pin version of appimagetool(#4181)
• Updated translations
• Updated dependencies:
  • org.cryptomator:integrations-api from 1.8.0-beta1 to 1.8.0
  • org.cryptomator:integrations-linux from 1.7.0-beta4 to 1.7.0
  • org.cryptomator:integrations-mac from 1.5.0-beta3 to 1.5.0
• Full Changelog: 1.19.0...1.19.1
• 📜 List of closed issues and pull requests is available here
• 💾 SHA-256 checksums of release artifacts:
  • c995daa2acd813e1a975d540a1af0dff57700e56c1c541e203117172829dd382 .\cryptomator_1.19.1-0ppa1_amd64.deb
  • 05af34b8c6430d4e033f029eb20071ec718e529715f15e41f91230665d146849 .\cryptomator-1.19.1-aarch64.AppImage
  • c208184d36b1570e00c2929b3b230679191235742385e883863135ee67e9c581 .\Cryptomator-1.19.1-arm64.dmg
  • 14e3273f02268c6abf9a9962dbf35a01f45f4dd75ea90973af3827fcf88b96cb .\Cryptomator-1.19.1-x64.dmg
  • 08beab0e625339aa8525339388a1317987dc0f2f70d114737cbaf66d0ce62a1a .\Cryptomator-1.19.1-x64.exe
  • 77ff121b725938bc05efaa842cfd7db2bbe0f32ca76c93b98c65b225d226d7fd .\Cryptomator-1.19.1-x64.msi
  • 6acfccb9368731a96c375a1ec26666c93fd5735c03d200b9bf37d6e290a18116 .\cryptomator-1.19.1-x86_64.AppImage

Tip

• You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

Happy Birthday, Cryptomator! 🎉

Today, Cryptomator Turns 10. What once began as a small idea has become a tool trusted by millions of people worldwide to keep their data private in an increasingly connected world.
For a comprehensive view of changes, read the CHANGELOG.

Security Fixes (Possibly breaking) 🚨

• Disable loading of plugins by default (#4136): Custom plugins are not loaded by default anymore. To allow loading of plugins, specify the plugin directory in the admin config.
• Disable loading of user defined config for Windows installer in #4132: User defined app startup configs are not loaded anymore. Use the admin config instead.
• Fixed leaking of cleartext paths into application log (GHSA-j83j-mwhc-rcgw)

What's New 🎉

• Self-Update Mechanism (#3948)
• Implemented .dmg update mechanism
• Implemented Flatpak update mechanism
• App notifications (#4069)
• Mark files in-use for Hub vaults (#4078)
• Accessibility: Adjust app to be used with a screen reader (#547)
• Show Archived Vault Dialog on unlock when Hub returns 410 (#4081)
• Support automatic app theme selection according to OS theme on Linux (#4027)
• Admin configuration: Allow overwriting certain app properties by external config file (#4105)
• New keychain backend using secret service API for Linux (#4025) by @purejava
• Liquid Glass icon for macOS (#4166)

Bugfixes 🐛

• Fixed password reset/show recovery possible for vaults without masterkey file (#4120)
• Fixed restore vault config failed due to selecting a directory instead of file (#4141)

Other Changes 📎

• Disable user defined app start config on Windows (#4132)
• Disable plugin loading by default (#4136)
• Use JDK 25 (#4031)
• Update JavaFX to 25.0.2 (#4145)
• Updated translations
• Fix typo in comment by @sunnyraindy in #4036
• Fix a11y for no-graphics buttons in main window by @tamaracha in #4055
• Updated dependencies
  • ch.qos.logback:* from 1.5.19 to 1.5.32
  • com.fasterxml.jackson.core:jackson-databind from 2.20.0 to 2.21.1
  • com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.20.0 to 2.21.1
  • com.github.ben-manes.caffeine:caffeine from 3.2.2 to 3.2.3
  • com.google.dagger:* from 2.57.2 to 2.59.2
  • org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0
  • org.cryptomator:cryptofs from 2.9.0 to 2.10.0
  • org.cryptomator:cryptolib from 2.2.1 to 2.2.2
  • org.cryptomator:fuse-nio-adapter from 5.1.0 to 6.0.1
  • org.cryptomator:integrations-api from 1.7.0 to 1.8.0-beta1
  • org.cryptomator:integrations-linux from 1.6.1 to 1.7.0-beta4
  • org.cryptomator:integrations-mac from 1.4.1 to 1.5.0-beta3
  • org.cryptomator:integrations-win from 1.5.1 to 1.6.0
  • org.cryptomator:webdav-nio-adapter from 3.0.0 to 3.0.1
  • org.cryptomator:webdav-nio-adapter-servlet to 1.2.12
• New Contributors
  • @sunnyraindy made their first contribution in #4036
  • @tamaracha made their first contribution in #4055

Full Changelog: 1.18.1...1.19.0

📜 List of closed issues and pull requests is available here

💾 SHA-256 checksums of release artifacts:

9b4a125b89fbebad1f2c0ec8fc8942d8d065a5a05318aee002d31373825a1fda cryptomator_1.19.0-0ppa1_amd64.deb
3198965add9b6f01952572a0a5be46602f117ac4a3a7d638b3bb057b50f637e7 cryptomator-1.19.0-aarch64.AppImage
f4cc20ba7b8befa8deed0f6fc495e39843228e8dbe48c7314e8fa0b06ad6a162 Cryptomator-1.19.0-arm64.dmg
3ba6011fe50574ee356c0e0f1a869afdd48f3e8059a679175ae8cb87c965475d Cryptomator-1.19.0-x64.dmg
5cd1701a56ee197325a24611908b00064fa4552903ab34756189ddf687007428 Cryptomator-1.19.0-x64.exe
48f0906ffdcd89c802299a49fdfbe63d367c308dc34879efd3d14c634111cea5 Cryptomator-1.19.0-x64.msi
42bb500d5257f34a2ee220ada58ab49c28861492dd22183fb77c692ba39f11e6 cryptomator-1.19.0-x86_64.AppImage

Tip
You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

What's Changed to 1.19.0-beta2

What's New 🎉

• Add Liquid Glass icon for macOS 26 and remove DockTilePlugin workaround by @tobihagemann in #4166

Bugfixes 🐛

• Fixed revealing filesystem directory opens internet browser by @infeo in #4165
• Fixed leaking of cleartextpaths into log files (GHSA-j83j-mwhc-rcgw)
• Fixed WinFsp not detected when access to reg tool is denied (#4121)

Other Changes 📎

• CI: Build arch package by @infeo in #4139
• CI: Build cryptomator-bin package before creating PR. by @infeo in #4149
• harden curl downloads on CI by @infeo in #4158
• Bump the github-actions group with 3 updates by @dependabot[bot] in #4162
• Bump the maven-build-plugins group across 1 directory with 8 updates by @dependabot[bot] in #4151
• Bump the java-test-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #4079
• Bump the java-production-dependencies group with 8 updates by @dependabot[bot] in #4152
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 in the maven-build-plugins group by @dependabot[bot] in #4167

Full Changelog: 1.19.0-beta2...1.19.0-rc1

💾 SHA-256 checksums of release artifacts:

• 45cb2788e54395773c9929b299d938589e71a0ff0ce550188254d2e6a637e4e0 cryptomator_1.18.0+1.19.0~rc1-0ppa1_amd64.deb
• 0f7e7cad61f0d1a87da024caaf40254b73befe936d4f5dd901bd3ff45f4d8d58 cryptomator-1.19.0-rc1-aarch64.AppImage
• 472e9fcee14d1ad5b8806e96b85de53f9b6dd0c8a16242e98e0ef8a154d9bd2d Cryptomator-1.19.0-rc1-arm64.dmg
• 7bb1cbca7edee181e8ff5583659af2cc43652bcd7332b74783121dbb59e32ebe Cryptomator-1.19.0-rc1-x64.dmg
• f3598488a264087cc3a177e294cf005c079f7bcb3dfc1660413f169823c45b31 Cryptomator-1.19.0-rc1-x64.exe
• e732b9d490dd36f8bd8031958a4e4daab8671953a45ef94db957c3dfcb51a32a Cryptomator-1.19.0-rc1-x64.msi
• 4249734968e8e8df9e48fc82aa6a22e1b7fa06a579fff2897898a43868add13f cryptomator-1.19.0-rc1-x86_64.AppImage

Tip

You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

What's Changed

For a comprehensive view of changes, read the CHANGELOG.

Possibly Breaking Changes ⚠️

• Disable loading of plugins by default(#4136): Custom plugins are not loaded by default anymore. To allow loading of plugins, specify the plugin directory in the admin config.
• Disable loading of user defined config for Windows installer by @infeo in #4132: User defined app startup configs as documented here are not loaded anymore. To overwrite some properties, use the admin config.

Other Changes 📎

• Show dedicated “Archived Vault” screen on unlock when Hub returns 410 by @mindmonk in #4081
• Improve accessibility for core functionality by @infeo in #4103
• Move recovery I/O to background thread by @mindmonk in #4106
• Bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #4124
• Admin Config by @infeo in #4105
• Disable recovery key actions in Vault Password options when masterkey is missing by @mindmonk in #4120
• Use JavaFX built ins to adapt to OS color scheme by @infeo in #4134
• Bump the java-production-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #4143
• New keychain backend SecretService for Linux by @purejava in #4025
• Bump javafx to version 25.0.2 by @infeo in #4145
• Recovery Key Validation – Enable wrapped labels and replace filler text to stabilize layout by @mindmonk in #4123
• Fixed failed vault config recovery due to picking wrong filesystem node (#4141 )

Full Changelog: 1.19.0-beta1...1.19.0-beta2

💾 SHA-256 checksums of release artifacts:
95725dcec2117814d89a853923c0092c5ab76129e82cc416aa0aebe1fe7719c6 cryptomator_1.18.0+1.19.0~beta2-0ppa1_amd64.deb
1019a1883a7bc194e2eeef07fc01b5eafa2a5cf7568bb4da86fdfab48b6ff821 cryptomator-1.19.0-beta2-aarch64.AppImage
c44cea4e97d4c794228890885d57a3d740f5526689a5215c9f64079ab06d7419 Cryptomator-1.19.0-beta2-arm64.dmg
9d794bfd3e5c465e36fb098487709a1dfc3c6015b6d5b51538dae230af4789b3 Cryptomator-1.19.0-beta2-x64.dmg
8b44ddb3d53fcb0c71a45f37eca4b9f67802fafde21381b25e119a0ee578e4bb Cryptomator-1.19.0-beta2-x64.exe
d10a71cdcf05e05d74642af9702077befff7c510fd746f1ac0c512a42b2a6d55 Cryptomator-1.19.0-beta2-x64.msi
3ddf132283ee02fc7eeec3e3e288b5e50abb72ae6ae657a1c8e81c33cc48261f cryptomator-1.19.0-beta2-x86_64.AppImage

Tip
You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

Note

Hotfix release to prevent broken update checker or failing Cryptomator Hub vault unlocks

Bugfixes 🐛

• Fixed failing HTTPS connections on Windows (#4156)

Full Changelog: 1.18.0...1.18.1

📜 List of closed issues is available here

SHA-256 checksums of release artifacts:

• b156a911563e1c9477954efaaaf3b9be0ca5545d5c6ad9f434ceee9fe0da739f Cryptomator-1.18.1-x64.exe
• 491fdba6a5e45e47fb7ac6f437b8f749b95ee6f58997b854ac7072a7ff45310e Cryptomator-1.18.1-x64.msi

As usual, the GPG signatures can be checked using our public key 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

What's New

• App Notifications: Get notified about important information in your vault (#4069)
• Files in use: Hub vaults mark opened files as "used" and sent notification on open request (#4078)
• Accessibility: Add labels and text for Graphic-only elements (#4064, #4066 and by @tamaracha #4055)
• Other Changes 📎
  • Removed test code for update checker
  • Bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #4073
  • Switch to JDK 25 for building
• New Contributors
  • @tamaracha made their first contribution in #4055
• The important changes can be found in our CHANGELOG.md.
• 📜 List of closed issues and pull requests is available here
• All Changes: 1.19.0-alpha2...1.19.0-beta1
• 💾 SHA-256 checksums of release artifacts:
  • ed7a80b645bb0cde3303281cb6b8bcdcfc9d0d46f1d94839ee75d74033ecf520 .\cryptomator_1.18.0+1.19.0.beta1-0ppa1_amd64.deb
  • 178faec33c6f0327ce746cd543c2180ca945d31eaa88ff5efb85c5430f23f848 .\cryptomator-1.19.0-beta1-aarch64.AppImage
  • b0262eb4ab17a520278ddf76b83d157c4f95e02fbe76ef6b5468f7147e283c78 .\Cryptomator-1.19.0-beta1-arm64.dmg
  • 4d75a24fd23212344766a8af18f26ce5045343546737c4c5e84517f115a0ed11 .\Cryptomator-1.19.0-beta1-x64.dmg
  • b04470782c251a82906776683d9fff2bf639a905cfead39c3131a83efbf6e296 .\Cryptomator-1.19.0-beta1-x64.exe
  • 2551e29a4470cb7267e17fdacc8cfce0b3aad60e758dbe016b7fb80f56e5c5d3 .\Cryptomator-1.19.0-beta1-x64.msi
  • 0a48b50a0fb1b00292ee46d0e011cfaf3dafb65da8b6023eb3ecdf44f1013220 .\cryptomator-1.19.0-beta1-x86_64.AppImage

Tip

• You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

Note

This prerelease version has a tampered update check that will always report an update to the latest stable version being available. This is intended behaviour that allows testing of the newly introduced self-update mechanism.

What's New 🎉

• Implement new update API by @purejava in #3948
• Self-Update feature for .dmg files
• Self-Update feature for Flatpak
• Added a CHANGELOG

Other Changes 📎

• chore: fix typo in comment by @sunnyraindy in #4036
• JDK 25 by @overheadhunter in #4031

New Contributors

• @sunnyraindy made their first contribution in #4036

Full Changelog: 1.18.0...1.19.0-alpha2

Feel free to also read our CHANGELOG.md.

Tip

You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

Caution

The update check in this build is broken, please use alpha2 for testing.

What's New

• Implement new update API by @purejava in #3948
• Self-Update feature for .dmg files
• Self-Update feature for Flatpak
• Added a CHANGELOG

Other Changes

• chore: fix typo in comment by @sunnyraindy in #4036
• JDK 25 by @overheadhunter in #4031

New Contributors

• @sunnyraindy made their first contribution in #4036

Full Changelog

1.18.0...1.19.0-alpha1

Feel free to also read our CHANGELOG.md.

Tip

• You can verify the GPG signature of all assets using our public key: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem

What's New 🎉

Feature: Recovery of vault config files (#3821): If your vault config files ever get lost, you can recreate them with the vault specific recovery key!

Windows: Use new signing certificates (#4038, #3943)

Cache last known path when creating vaults (#3669)

Bugfixes 🐛

Fixed wrong icon shape in macOS 26 Tahoe (#3990)

Fixed macFUSE not detected on macOS 26 (#3982)

Fixed extreme size of log files on Windows (#3925)

Fixed app crash when using the keychain on macOS (#3932)

Fixed leftover quickaccess entries on KDE are not removed/reused (#3883)

Fixed: On macOS shortcut doesn’t close some dialogs by @Panjr in #4026

Other Changes 📎

Update to JavaFX 25 (#4013)

Add share option in context menu (#4008)

Add debug launcher for Windows (#2666)

Windows Smart Screen accept installer (#3994)

For Windows package managers add option to disable update checks (#3961)

Adjust Windows installer build (#3968)

Specify nonexisting crash log dir to fall back to default by @dhruvbajpai29 in #3951

Security: Pin CI Actions version (#4015)

Fix typos by @pxwanglu in #3960

Updated translations (#3931, #4009, #4016)

Dependency updates:

• Updated com.nimbusds:nimbus-jose-jwt from version 9.37.3 to 10.5
• Updated ch.qos.logback:logback-core from 1.5.18 to 1.5.19
• Updated ch.qos.logback:logback-classic from 1.5.18 to 1.5.19
• Updated org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0
• Updated com.google.dagger:dagger from 2.57.1 to 2.57.2

New Contributors

• @pxwanglu made their first contribution in #3960
• @dhruvbajpai29 made their first contribution in #395
• @Panjr made their first contribution in #4026

Full Changelog: 1.17.1...1.18.0

📜 List of closed issues is available here

💾 SHA-256 checksums of release artifacts:

• 9fcb87e21ef563820930fdc42daff6d0c9c1b1d7b8b6e8ab6d47c8d7fdee625d .\cryptomator_1.18.0-0ppa1_amd64.deb
• 12e66beaa6cf27a8931e384808cb316859db5322530de6690ea7f6ee6485b482 .\cryptomator-1.18.0-aarch64.AppImage
• 1416c189da2890a234452a23d6d566e7eba4d79babf18423edc656344c676d13 .\Cryptomator-1.18.0-arm64.dmg
• b8b28bf17ad03864dd0ce3f5894ae1384f3b10d6423f580fabda4ad11ab1b79a .\Cryptomator-1.18.0-x64.dmg
• f5981c3ac18f12088ee17e61a2136d0701631a09bffa88a926b4c7d61584af4d .\Cryptomator-1.18.0-x64.exe
• 9f7d959427046114607083e2f05108a804fd6151fc39ad76520b6c1fb64f32a8 .\Cryptomator-1.18.0-x64.msi
• a75365252bf511875a1beccbd684b82d94166841dc6437f05c2ebb261350e780 .\cryptomator-1.18.0-x86_64.AppImage

As usual, the GPG signatures can be checked using our public key 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235.

Original source Report a problem