Zero-Knowledge Cloud Storage: 10 Providers Compared (2026)

Zero-knowledge cloud storage is storage where the provider holds no keys to your files: encryption happens on your device before upload, so the server only ever holds ciphertext. If that idea is new, what zero-knowledge cloud storage means covers the mechanics, how to verify a provider's claim, and what encryption does not hide.

Short answer (updated 17 October 2026): eight of the ten providers below encrypt every file on your device by default — ShieldFive, Proton Drive, Tresorit, Sync.com, MEGA, Internxt, NordLocker and Filen. pCloud and Icedrive encrypt end-to-end only inside a separate paid folder. ShieldFive is the only one of the ten that protects stored file keys with post-quantum key exchange (ML-KEM-1024) by default — Internxt applies Kyber-512 to account keys only — and its Lifetime Vault — 2 TB for €199 paid once — is the lowest one-time 2 TB price we could verify on 17 October 2026 (pCloud: €499 plus €150 for its encryption add-on at regular prices; Internxt: €435; Icedrive: €599). Lifetime cloud storage compared covers every pay-once plan, including what happened to Filen's.

This page answers the next question instead: which of these providers should you pick, and on what axis does each one win. Ten are compared below on the properties that actually separate them.

Zero-knowledge cloud storage providers at a glance

None of the ten can be self-hosted; if that is a requirement, look at open-source software you run yourself, such as Nextcloud with end-to-end encryption enabled, rather than a hosted service. The detailed tables below add jurisdiction, ciphers, post-quantum status and audits.

What "zero-knowledge by default" actually means

Two products can both advertise "zero-knowledge" and protect very different amounts of your data.

• Zero-knowledge for every file means each file is encrypted on your device before it leaves, on every plan, with the filename and folder structure encrypted too. Proton Drive, Tresorit, Sync.com, MEGA, Internxt and Filen work this way; ShieldFive and NordLocker also encrypt every file by default.
• Zero-knowledge as an opt-in folder means the account is server-side encrypted by default — the provider holds the keys and can technically read your files — and end-to-end encryption applies only to a separate, usually paid, folder you have to remember to use. pCloud (the Crypto add-on) and Icedrive (the Encrypted folder) work this way. Files outside that folder are not zero-knowledge, and free tiers often get none.

That distinction — default versus opt-in — matters more than any marketing line, because it decides what happens to the files you upload without thinking about it. The comparison below treats it as the first axis, not a footnote.

Top picks, each on one axis

No single product is "best" for everyone — the honest answer is that each one wins on a specific axis:

• ShieldFive — best for post-quantum encryption by default (ML-KEM-1024 on web and Android), and for collecting files from clients who don't need an account
• Sync.com — best all-rounder: audited, zero-knowledge by default, strong value
• Proton Drive — best if you want an audited privacy suite (Mail, VPN, Calendar, Drive)
• Tresorit — best for enterprise compliance and per-region data residency
• pCloud — best for lifetime pricing and lowest long-run cost per terabyte
• Internxt — best low-cost, open-source option with some post-quantum protection (Kyber-512 on account keys)
• MEGA — best for a large free tier and published client source
• Icedrive — best budget pick with a polished virtual drive
• NordLocker — best if you already live in the Nord ecosystem
• Filen — best fully open-source clients for developers (CLI, SDK, rclone)

ShieldFive publishes this page, so it holds its own entry to the same evidence standard as every rival: each competitor's genuine strengths are conceded, ShieldFive's own tradeoffs are stated plainly further down, and every claim is sourced to public documentation as of 22 September 2026, with free tiers and prices re-read on 4 October 2026. The aim is a comparison you can act on, not a sales page.

How these were compared

Providers are assessed on seven properties that change your actual exposure, not on interface polish:

1. Jurisdiction — the legal home of the company and where encrypted data physically sits.
2. Zero-knowledge scope — every file by default, or an opt-in folder.
3. Encryption — the file-content cipher and key exchange.
4. Post-quantum — whether stored files are protected against "harvest now, decrypt later," and at what strength.
5. Open source — whether you can read the code that encrypts your files.
6. Independent audit — whether a third party has examined the product.
7. Free tier and price — in the price table below, at the regular rate rather than first-year discounts.

On two of these axes — a completed third-party audit and a fully open application — several rivals are ahead of ShieldFive today, and the table shows it. But on a third, verifiable open cryptography, ShieldFive offers what the audited-but-closed products cannot: encryption code you can actually read and check. We'd rather show you all three than write a page that only flatters the vendor that published it.

Zero-knowledge cloud storage compared

Written by Cho García, founder of ShieldFive. Every provider claim in the table below was checked against that vendor's own public documentation as of 22 September 2026.

Disclosure: ShieldFive publishes this comparison and appears in it. Its encryption format differs between clients, its web app is served by ShieldFive so that code is trusted on each visit, and it has no completed external audit. The audit column below says so rather than hiding it.

Figures reflect each vendor's public documentation as of 22 September 2026 and are updated as products change. Free-tier sizes and prices move frequently — verify current terms on each vendor's site.

Free tiers and prices

Prices below are the regular rate per month on yearly billing, read from each vendor's own pricing page on 22 September 2026, with Proton, Sync.com and Filen re-read on 4 October 2026, the pCloud and Icedrive prices plus every one-time price re-read on 13 October 2026, and the pCloud and Icedrive lifetime prices, Icedrive yearly, Sync.com, Filen and the Proton, Internxt and NordLocker free tiers re-read again on 14 October 2026, and the pCloud, Internxt and Icedrive one-time prices plus the MEGA, Icedrive and Filen free tiers re-read on 17 October 2026 (EUR where the page showed it). Several vendors show a first-year discount that renews higher; the renewal price is used here, because that is what you pay from year two.

Plans are not identical: MEGA bundles a VPN and password manager, Internxt a VPN and antivirus, Proton Duo is for two people, and pCloud's zero-knowledge folder costs extra on top of the storage price. Prices change often, and taxes are shown differently from vendor to vendor — confirm at checkout.

Free zero-knowledge cloud storage

Eight of the ten have a free plan that is end-to-end encrypted from the first upload: MEGA (20 GB), Filen (10 GiB), ShieldFive (10 GB), Sync.com and Proton Drive (5 GB each), Tresorit and NordLocker (3 GB each) and Internxt (1 GB). Icedrive's 10 GB and pCloud's up to 10 GB free tiers are not end-to-end encrypted. Inactivity rules, file limits and what happens when you stop paying are in free zero-knowledge cloud storage compared.

Best zero-knowledge cloud storage for personal use

For personal files — photos, scans of IDs, tax records, medical letters — the deciding questions are simpler than for a business: is every file encrypted by default, are there apps for the devices you use, and what does it cost over five years rather than one.

• You want the widest app coverage today: Proton Drive, Sync.com, Tresorit, MEGA, Internxt and Filen all have desktop and mobile apps. ShieldFive is web plus Android, with no iOS app or desktop sync client yet.
• You want to pay once: compare one-time prices for encrypted storage, not headline storage. pCloud's 2 TB lifetime is €499 plus €150 for the encryption add-on at regular prices; Internxt's 2 TB lifetime is €435; Icedrive's 2 TB lifetime is €599; ShieldFive's Lifetime Vault is 2 TB for €199 with every file encrypted by default. Filen no longer sells lifetime plans; see lifetime cloud storage compared.
• You keep files for decades: post-quantum protection matters most for data that has to stay private for a long time, which is the case ShieldFive's ML-KEM-1024 default is built for. Post-quantum encrypted cloud storage explains when that matters and when it does not.

How to choose: six checks

If you are evaluating any provider, including one not on this list, these six questions separate genuine zero-knowledge from marketing:

1. Is every file encrypted on your device before upload, or only an opt-in folder? An opt-in folder means everything else is readable by the provider.
2. Are filenames and folder structure encrypted too, or just contents? Metadata leaks a surprising amount — who you work with, what a matter is called, when activity happened.
3. Can you read or verify the cryptography? An open client, or at minimum an open crypto core with published test vectors, lets you check the claim instead of trusting it.
4. Has an independent third party examined it? A completed audit or certification is evidence the vendor cannot produce for itself.
5. Does the jurisdiction match your requirement? EU, Swiss, Canadian (Five Eyes), UK (part of the intelligence-sharing alliances) and Panamanian are not interchangeable for a compliance-driven buyer.
6. Does it protect against "harvest now, decrypt later"? Only post-quantum key exchange applied at upload closes that window — it cannot be retrofitted onto data an adversary already holds.

Checks 3 and 4 are the ones where the answers cut against ShieldFive as often as for it: ShieldFive passes check 3 (open crypto core) but fails check 4 (no completed audit), while Sync, Proton, Tresorit, pCloud and Internxt pass check 4. Run the framework honestly and it points different ways for different buyers — which is the point.

ShieldFive — best for post-quantum encryption by default

ShieldFive encrypts files on the device before upload. Your password never reaches its servers: the browser turns it into a separate login value with Argon2id and sends only that, and the key that opens your vault is derived separately and stays on your device. The web app's code is delivered by ShieldFive, so the client served on each visit remains part of the trust model; this is not an absolute guarantee that the provider could never decrypt files. Web and Android uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback; Android reads both formats. See the security overview for the trust boundary and client differences.

On assurance, ShieldFive makes a specific and defensible trade: it has not yet completed a third-party audit — that work is planned — but it is one of the few products here whose encryption you can read, with an open crypto core, a public spec and published test vectors. That is evidence the audited-but-closed rivals cannot offer. The full tradeoffs are set out below. If you are a firm rather than an individual — an accounting practice collecting confidential client documents, say — ShieldFive also runs a request-and-upload workflow built for that job, covered on the secure file sharing for accountants page.

Proton Drive — best audited privacy suite

Proton Drive is a mature, end-to-end encrypted product from a company with a real privacy track record. Its clients are open source, it has completed external audits, it encrypts filenames and folder structure, and it comes with Mail, VPN and Calendar under one account. Where it is worth reading the fine print: Proton Drive's storage is classical OpenPGP (Curve25519). Proton's post-quantum encryption, launched in May 2026, ships in Proton Mail, and is opt-in even there — a reader can easily assume stored Drive files are quantum-safe when they are not. The company is Swiss; its security page lists data centres in Switzerland and Germany. Proton also holds ISO 27001 and SOC 2 Type II. One gap for firms: Proton Drive has no upload-only request link, so a client without an account can only send you files through a link that also lets them see and edit the folder. Full detail: Proton Drive alternative.

Tresorit — best for enterprise compliance

Tresorit applies zero-knowledge across its whole platform, is backed by Swiss Post, and carries the certifications procurement teams ask for: ISO/IEC 27001:2022 and Common Criteria EAL4+. It offers data residency in twelve regions (EU, UK, Switzerland, US, Canada, Singapore, UAE and Brazil), selectable per user, and enterprise administration that a newer product cannot match. On post-quantum, Tresorit describes a gradual migration (a February 2026 post names hybrid ML-KEM-1024, the same parameter set ShieldFive uses) — in progress, and not yet in its live service. It does not publish its client source. Full detail: Tresorit alternative.

Sync.com — best all-rounder

Sync.com is end-to-end encrypted by default on every plan, including the 5 GB free one. It has genuine independent attestation (SOC 1/2/3, with a public SOC 3 report covering 2024) and offers HIPAA with a BAA on its Pro plans. The trade-offs: its encryption is entirely classical (AES-256, with no post-quantum work described), its apps are closed source, its detailed encryption whitepaper dates from 2015, and it is Canadian — a Five Eyes jurisdiction, with data stored in Canada; we found no EU storage region on its site. For most buyers who want "audited and zero-knowledge" without further requirements, Sync is the safe pick. Full detail: Sync.com alternative.

pCloud — best for lifetime pricing

pCloud is the value play: distinctive lifetime plans, mature apps, ISO 27001 certification (the 2013 edition; the SOC 2 Type II it cites belongs to its data-centre providers), and its Crypto encryption survived a public $100,000 hacking challenge — run around 2014, so old evidence. The company is Swiss (pCloud International AG) and lets you choose EU (Luxembourg) or US (Dallas) storage. The catch is scope. By default, pCloud storage is server-side AES-256 with pCloud holding the keys — not zero-knowledge. End-to-end encryption is the paid Crypto add-on, applied only to the Crypto folder; free and standard plans get none. pCloud's security page lists "end-to-end encryption" as a general feature, which makes the default easy to misread. If you are disciplined about putting sensitive files in that folder, pCloud is strong on cost. Full detail: pCloud alternative.

Internxt — best low-cost post-quantum option

Internxt is the closest competitor on architecture: EU-based (Spain), zero-knowledge AES-256 with open-source clients, penetration-tested by Securitum, and one of the few incumbents shipping any post-quantum layer — a Kyber-512 hybrid on account and sharing keys, where ShieldFive uses ML-KEM-1024 on stored file keys. For the detail behind that claim, see is Internxt zero-knowledge?; for the head-to-head, Internxt alternative.

MEGA — best free storage and open clients

MEGA earns its reputation: zero-knowledge on every plan, a long track record at scale, a generous 20 GB free tier, and — genuinely — the full client source published for inspection (under MEGA's own licence for most apps; the SDK is BSD), which is a transparency point where MEGA is more open than ShieldFive's closed web application. Weigh against that: file content is encrypted with AES-128 (unbroken, but a smaller key than the AES-256 class), its contract is now with MEGA Privacy Kft under Hungarian law, with data in Japan, Canada or the EU and no region you choose yourself, and there is no post-quantum encryption. It has no formal third-party audit; the most serious independent scrutiny was ETH Zurich's 2022 "Malleable Encryption Goes Awry" research, whose attacks MEGA patched. Full detail: MEGA alternative.

Icedrive — best budget pick

Icedrive is polished, cheap, and offers a virtual-drive mount and one-time lifetime plans. Its encryption is real but scoped: zero-knowledge applies only to files in the separate, paid Encrypted folder, and it uses 256-bit Twofish — a respected but classical cipher — rather than a mainstream AEAD; file and folder names inside that folder are encrypted too. The client is closed source, there is no third-party audit, and it is operated by Ice Privacy Ltd from Gibraltar, a British Overseas Territory outside both the UK and the EU. No post-quantum. Full detail: Icedrive alternative.

NordLocker — best for existing Nord users

NordLocker is a well-resourced, zero-knowledge product from the makers of NordVPN and NordPass, and it is an easy add if you already use the Nord ecosystem. It is classical — AES-256, XChaCha20-Poly1305 and Ed25519; a July 2026 announcement says the architecture is "ready" for post-quantum but it is not switched on — closed source, and provided by nordvpn S.A. under Panamanian law rather than from the EU. No NordLocker-specific security audit is published. If you want one vendor across VPN, password manager and encrypted storage, the integration is the draw. Full detail: NordLocker alternative.

Filen — best open-source clients

Filen is a strong EU option and, in one respect, more open than ShieldFive: its web, desktop and mobile clients are AGPLv3, not just a crypto core. It is German-hosted under GDPR, encrypts metadata (with HMAC-based private search so the server never sees filenames), is inexpensive, and has a real developer lane — CLI, SDKs in TypeScript, Rust and Go, S3/WebDAV, and a backend in official rclone since v1.73 (January 2026). It has no third-party audit yet; Filen says one is planned after its API v4. The clean, datable gap is post-quantum: Filen's own November 2024 Q&A states it has "no plans" for post-quantum, and nothing in its roadmap or updates through mid-2026 changes that, and its file sharing wraps keys with RSA-4096, which Shor's algorithm breaks — so shared-file key exchange is exposed to harvest-now-decrypt-later. On EU residency and open clients, treat Filen as a genuine peer, not a foil. Filen no longer sells lifetime plans; if a one-time payment is what you are looking for, lifetime cloud storage compared lists the pay-once plans still on sale, including ShieldFive's Lifetime Vault — €199 for 2 TB.

For firms: collecting files from clients who have no account

Accountants, lawyers and advisers searching for zero-knowledge storage usually have a second job in mind: getting documents from clients, not only storing their own. That needs an upload-only link — the client uploads without an account and cannot see anything else in the folder — and the uploads should be encrypted in the client's browser, not only in transit. Checked against each vendor's help centre on 22 September 2026:

If client intake is the reason you are comparing providers, that narrows the field to the three that document browser-side encryption for uploads. ShieldFive's version is built around the request itself — a checklist of what you need, sent as one link, with the files arriving in your firm's inbox — and is covered on secure document collection for firms.

The post-quantum question: who actually ships it

This is the one axis no mainstream review listicle carries, and it is the reason this page exists.

The threat. In "harvest now, decrypt later," an adversary copies your encrypted files today and simply waits — storing the ciphertext until a quantum computer capable of breaking classical key exchange (RSA, Curve25519) exists, then decrypting retroactively. Files with a long confidentiality lifetime — legal records, medical data, source material, trade secrets — are exposed the moment they are uploaded. Post-quantum key exchange applied at upload is the only point where you can close that window. You cannot retrofit it onto data an adversary already holds.

The honest scoreboard, as of 22 September 2026:

• ShieldFive — web hybrid default (ML-KEM-1024/XChaCha20-Poly1305) with AES-GCM fallback; Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats.
• Internxt — hybrid Kyber-512 (level 1), real but the lowest standardized category, protecting account and sharing keys rather than file keys.
• Tresorit — a gradual migration to hybrid ML-KEM-1024, announced February 2026, not yet in its live service.
• Proton — post-quantum in Proton Mail only (May 2026, opt-in); Proton Drive storage remains classical.
• Filen — states "no plans"; share links wrap keys with RSA.
• NordLocker — architecture described as "ready" (July 2026), not switched on.
• Sync.com, MEGA, pCloud, Icedrive — no post-quantum encryption described.

If your threat model does not include an adversary who can store ciphertext for a decade, this axis may not matter to you, and several of the products above are excellent classical choices. If it does, the field narrows sharply — and that is the specific, checkable reason to consider ShieldFive.

Honest tradeoffs

Every product here makes them, and a comparison that hid ShieldFive's would not be worth trusting. Here are ShieldFive's, each with the context that actually matters:

• A third-party audit is planned, not yet completed. Proton, Tresorit, Sync.com, pCloud and Internxt have completed external audits or certifications; ShieldFive has published an internal review instead. The offsetting point is real: ShieldFive's crypto core is open, with a public spec and test vectors, so you can verify the encryption directly — assurance the audited-but-closed products (Sync, Tresorit, pCloud) cannot give you. If a completed audit is a hard procurement requirement today, choose an audited rival; if verifiable code matters more, ShieldFive is ahead.
• The open code is the crypto core, not the whole app. @shieldfive/crypto — the security-critical part, where the encryption actually happens — is fully open under Apache-2.0. MEGA and Filen open their entire client, so on total openness they lead; but the part you most need to be able to trust is the part ShieldFive publishes.
• Focused, not a suite — by design. ShieldFive does encrypted storage and sharing and nothing else. If you want mail, VPN and calendar under one account, Proton is the broader pick; if you want the storage layer done well with nothing pulling focus from it, that focus is the point.
• No real-time collaborative editing or deep server-side search — an inherent property of encrypting everything on your device, shared by every genuine zero-knowledge product on this page, not a ShieldFive-specific gap.

Choosing a provider is a risk-tiering decision, not a leaderboard. For an organisation whose binding requirement is a completed audit today, an audited rival is the right call. Evaluate ShieldFive’s served-client trust model, client-specific encryption formats and lack of an external security audit before deciding whether it fits your requirements.

How to try it and migrate

The way to evaluate any of these is in practice. ShieldFive's free tier is 10 GB with no card and is end-to-end encrypted from the first upload — there is no separate folder to remember. Test the workflow on non-critical files first — upload, share with an expiry, revoke — before moving anything that matters. Then migrate by sensitivity: move the highest-confidentiality-lifetime files first (legal, medical, source material, trade secrets), the ones where post-quantum protection or EU residency actually changes your exposure, and leave the rest wherever it already works. If your driver is compliance, the GDPR secure file sharing checklist covers the paperwork side. And if you are leaving a mainstream service rather than choosing between the ten above, the Dropbox alternative for sensitive files and Google Drive alternative for confidential files pages cover that switch directly.

Frequently asked questions

Which cloud storage is truly zero-knowledge by default?

ShieldFive, Proton Drive, Tresorit, Sync.com, MEGA, Internxt, NordLocker and Filen apply zero-knowledge encryption to every file by default. pCloud and Icedrive are not zero-knowledge by default: they encrypt end-to-end only inside an opt-in, usually paid, folder, and their default storage leaves the provider holding the keys.

Does Proton Drive have post-quantum encryption?

Not for stored Drive files as of September 2026. Proton's post-quantum encryption, launched in May 2026, ships in Proton Mail, and is opt-in even there. Proton Drive's storage uses classical OpenPGP (Curve25519). A reader can wrongly assume stored files are quantum-safe, so it is worth checking Proton's current documentation directly.

Which cloud storage uses post-quantum (ML-KEM / Kyber) encryption?

ShieldFive web uploads default to ML-KEM-1024/XChaCha20-Poly1305 with AES-GCM fallback; Android also defaults to the hybrid format, with the same AES-GCM fallback, and reads both formats. Internxt uses hybrid Kyber-512 (level 1) on account and sharing keys, not on file keys. Tresorit describes a gradual migration toward ML-KEM-1024 that is not yet the default. Proton has post-quantum in Mail only. NordLocker describes its architecture as ready but has not switched it on. MEGA, pCloud, Sync.com and Icedrive describe none, and Filen states it has no plans.

Why are Google Drive and Dropbox not in this comparison?

Because they are not zero-knowledge. Google Drive, Dropbox, OneDrive and iCloud (in its standard mode) use server-side encryption where the provider holds the keys and can, in principle, read your files. Apple's optional Advanced Data Protection moves iCloud toward end-to-end encryption for many categories, but the mainstream default for these services is not zero-knowledge.

Is there free zero-knowledge cloud storage?

Yes. MEGA offers 20 GB, Filen 10 GiB, ShieldFive 10 GB, Sync.com and Proton Drive 5 GB, Tresorit and NordLocker 3 GB, and Internxt 1 GB — all zero-knowledge. Icedrive's 10 GB and pCloud's up to 10 GB free tiers are not: their encryption is a paid feature. Figures checked September–October 2026; they change often.

Can a zero-knowledge provider be compelled to hand over my files?

A provider can be compelled to hand over what it holds — but in a genuine zero-knowledge system, what it holds is only ciphertext, and it has no keys to decrypt it. The output of a legal order is therefore cryptographically useless. This is why the "provider cannot read your files" property has to be architectural, not a policy that could later change.

What happens if I lose my password with zero-knowledge storage?

Because the provider holds no keys, it cannot reset your password and restore access the way a conventional service can — that would require key access it deliberately does not have. Genuine zero-knowledge products instead give you a recovery key or code to store safely. The trade-off is real: stronger confidentiality in exchange for you, not the provider, being responsible for recovery.