securefs

What is securefs?

securefs keeps an encrypted backing directory while exposing its contents through a mounted filesystem. Files written through the mount are encrypted, and files read there are decrypted automatically. This suits a folder of documents you want to work with normally while keeping the backing files encrypted, including when those files are synchronized to cloud storage. It is a command-line tool rather than a standalone graphical vault manager.

Create an encrypted directory with the create command, then use mount to make it accessible at a mount point or Windows drive letter. Passwords and key files are supported. The default lite format encrypts names and contents separately but leaves the directory structure visible; full format hides more of the hierarchy at a cost to performance and synchronization convenience. Optional random padding obscures file sizes, with a documented performance cost.

Windows requires WinFsp and the Visual C++ redistributable to be installed separately. The linked package is the publisher’s Windows amd64 ZIP for version 2.0.0, not a bundled dependency installer. The screenshot shows SiriKali, a separately installed graphical frontend, opening a securefs folder on Windows; it does not show a GUI included in this ZIP. The securefs author links SiriKali for information but explicitly says its code has not been vetted by them.

Encryption is not a promise that all local traces disappear: the publisher warns that swap and hibernation files may contain plaintext or keys from memory. Full format also has weaker directory-structure guarantees after abnormal termination. These trade-offs matter when choosing the format and the machine on which to mount sensitive files.

Product images