What Google Drive encrypts, and who holds the keys
Google's Drive help page puts the baseline in one sentence: "Data is encrypted in-transit and at-rest." Its encrypted-files page adds the algorithm: "All files uploaded to Drive or created in Docs, Sheets, and Slides are encrypted in transit and at rest with AES256 bit encryption." Both are quoted from Google's pages, checked 2026-10-01.
For some business accounts there is a second option. Google's client-side encryption page describes it as a layer added "in addition to the default encryption that Google Workspace provides", using encryption that "Google servers and third parties can’t decrypt". The same page names the editions that get it: "Supported editions for this feature: Frontline Plus; Enterprise Plus; Education Standard and Education Plus." A personal Google account is not on that list, and Google's pages do not say otherwise.
Whether Google reviews the content of your files is a policy question, covered in Does Google Drive scan your files? This page is about the encryption layer.
OneDrive: the same question
Microsoft's safeguard page says data in transit is protected using TLS. At rest: "Each file is encrypted at rest with a unique AES256 key. These unique keys are encrypted with a set of master keys that are stored in Azure Key Vault." Those master keys are Microsoft's, stored in its own key vault. The same page describes Personal Vault: "OneDrive Personal Vault is a protected area in OneDrive that you can only access with a strong authentication method or a second step of identity verification, such as your fingerprint, face, PIN, or a code sent to you via email or SMS." Microsoft's page does not call Personal Vault end-to-end encryption.
Encrypting before upload
If the provider holding the keys is the problem, the fix is to encrypt the file on your device before it uploads. Three common tools do this, described from their own pages, checked 2026-10-01.
7-Zip makes an encrypted archive. Its site says it offers "Strong AES-256 encryption in 7z and ZIP formats" and derives the key from your password with enough iterations to slow down guessing. You create the archive on your computer, upload the .7z or .zip file, and the provider stores data it cannot read.
Cryptomator makes an encrypted vault: a folder with a password that looks like an ordinary drive while open, with every file encrypted as it lands. Files and filenames are encrypted with AES and a 256 bit key length, and the code is open for anyone to inspect. On Android the app is free to download but read-only: Cryptomator's pricing page says "Cryptomator is free to use on Windows, macOS, Linux, iOS, and Android. However, the free versions on iOS and Android are read-only." Full access on Android is €29.99 on Cryptomator's pricing page and $29.99 on Google Play (checked 2026-10-01).
VeraCrypt makes a container. Its documentation says: "A VeraCrypt file-hosted volume is a normal file, which can reside on any type of storage device. It contains (hosts) a completely independent encrypted virtual disk device." You put files in on your computer, and the container is one file you can upload.
Boxcryptor used to be a common answer here. Dropbox announced it would acquire Boxcryptor's assets on November 29, 2022 and closed the acquisition on December 5, 2022 (Dropbox's announcement). Boxcryptor's own site now shows a shutdown notice: "As of December 31, 2025, Secomba GmbH i.L. has ceased all operational activities. As a result, the operation of Boxcryptor has also been discontinued." (checked 2026-10-01).
The catch: reading what you encrypted
Each of those tools works on the device where you run it. An encrypted archive or vault sitting in the cloud is a file you download first, then open with the same tool. The phone side depends on what each tool offers there: 7-Zip's download page lists Windows, Linux and macOS, with no Android version; VeraCrypt's downloads page lists Windows, macOS and Linux, and no Android; Cryptomator has an Android app, in read-only form unless you buy full access.
For a comic library that matters. Comics kept inside an encrypted archive are one file; you open the archive with its password before you can read a page.
Where Easemic fits, and where it does not
Easemic is a free Android app, currently in invite-only testing, that keeps your comic and manga library in cloud storage you own. When you connect Google Drive, OneDrive or WebDAV, the comics Easemic collects are encrypted on the phone with your password before anything is uploaded. The provider stores data it cannot read. On S3-compatible storage you choose whether to encrypt.
This covers only the comics Easemic collects. If you import your own files from the phone they are never uploaded to storage. If you put files in your cloud storage yourself, Easemic does not encrypt or read them. It is not a general encryption tool for your Google Drive.
For a wider look at storage options, see What is WebDAV, and which drives support it?, What is S3 storage, and do you need AWS for it?, and What’s the cheapest S3-compatible storage for a comic library?
Questions people ask
Is Google Drive end-to-end encrypted?
No. Google says files are encrypted in transit and at rest, and that is Google’s own encryption. Only one Workspace feature is described as encryption Google servers can’t decrypt: client-side encryption, for the editions Google lists. A personal Google account is not among them.
Can Google see my Google Drive files?
Google’s pages say Drive encrypts files in transit and at rest, and that Google processes content to provide services such as search and virus detection. Google manages the encryption. What Google’s policies say about reviewing content is covered in our guide to Drive file scanning.
Is OneDrive encrypted?
Yes, in the same way: Microsoft says OneDrive protects data in transit with TLS and encrypts each file at rest with a unique AES256 key, with the master keys stored in Azure Key Vault. Personal Vault is a protected area that needs a strong sign-in or a second verification step; Microsoft’s page does not call it end-to-end encryption.
Is Cryptomator free on Android?
The Android app is free to download, but the free version is read-only. Cryptomator’s pricing page lists full access on Android at €29.99, and Google Play lists the full version at $29.99 (both checked 2026-10-01).
What is client-side encryption?
Google describes its Workspace client-side encryption as end-to-end encryption that "Google servers and third parties can’t decrypt", and its page lists the editions that get it. The tools above (7-Zip, Cryptomator, VeraCrypt) encrypt the file on your computer; 7-Zip’s archives are AES-256 encrypted, Cryptomator encrypts data as you store it in the vault, and a VeraCrypt container is one encrypted file.
What happened to Boxcryptor?
Dropbox acquired Boxcryptor’s assets in a deal announced on November 29, 2022 and closed on December 5, 2022. Boxcryptor’s site now shows a shutdown notice: operation of Boxcryptor was discontinued as of December 31, 2025.