The short version
Most cloud storage means renting space on someone else's servers, where they hold the keys to your files. zcrypt is different. Your files are encrypted on your device, then stored inside free space you already have on accounts you own: GitHub, GitLab, Hugging Face, or Telegram. Only you can read them, you're limited only by your own storage, and it's free and open source.
The rent
The cloud is just someone else's computer
And they're charging you rent to live in it.
Somewhere in the last decade, the tech industry pulled off one of history's great marketing tricks: they convinced billions of people to stop storing files on hardware they own and start paying monthly for the privilege of storing them on hardware that someone else owns.
This is the digital equivalent of renting a storage unit for things you already have room for at home. Except the storage unit also reads your mail, indexes your photo albums, and raises the rent every year.
Cloud storage is a landlord scheme with better PR.
AWS S3 charges $23 per terabyte per month. That's $276 per year for a terabyte of storage. A 4TB hard drive costs $80 on Amazon, the same Amazon. You could buy the physical hardware to store your data four times over for what they charge you in a single year to store it on their servers.
The markup isn't 100%. It isn't 500%. The markup on cloud storage is measured in thousands of percent, and the entire industry has collectively agreed to pretend this is normal.
The loophole
Git storage, the loophole nobody talks about
GitLab gives you 10GB per repo. For free. Hugging Face gives you 100GB per account. GitHub doesn't even publish a hard cap: just stay under a few gigabytes and nobody blinks. These aren't hidden terms buried in legalese, they're published limits (and unwritten norms) that platform teams actively maintain and support.
This isn't a bug. This is a feature. These platforms need generous storage to host large repositories, ML models, and binary assets. They built the infrastructure. They set the limits. We just use them as intended, for storing data.
Every terabyte we store for free is a terabyte AWS can't bill for.
zcrypt takes your files, compresses them with Zstd, encrypts them with AES-256-GCM, splits them into manageable chunks, and stores them as ordinary-looking data in repositories on the platform you connect. To the platform, they look like build artifacts. To you, they're your encrypted files, accessible from anywhere, costing nothing.
Is this safe and durable? Yes. Your data is stored as standard private repository content, exactly the kind of large binary data these platforms are built to host. zcrypt automatically spreads data across repositories and rotates to fresh ones as they fill up, so you stay well within each platform's normal limits. And your files are always retrievable: encrypted chunks are integrity-checked and reassembled when you download.
The maths
Zero-knowledge is not a marketing buzzword
When Dropbox says “we take security seriously,” what they mean is they encrypt your files with keys they control. They can read your files. Their employees can read your files. They scan your files to build search indices. Government subpoenas? They hand over your data because they can.
When we say “zero-knowledge,” we mean the mathematical kind. Your passphrase never leaves your device. We derive encryption keys locally using PBKDF2 with 600,000 iterations. The encrypted data that gets uploaded is indistinguishable from random noise.
We can't read your files. Not because we're polite. Because we literally don't have the keys.
AES-256-GCM provides authenticated encryption, meaning tampering with the ciphertext is detectable. The GCM mode gives you both confidentiality and integrity in a single pass. No separate HMAC step. No room for implementation mistakes.
This isn't security theater. This is the same encryption standard used by intelligence agencies. The difference is we give it to you for free, not for $23/TB/month.
The receipts
Open source, because talk is cheap
Every cloud provider asks you to trust them. Trust their encryption. Trust their access controls. Trust that the engineer with admin access won't peek at your vacation photos.
We don't ask you to trust us. We ask you to read the code.
Every line of zcrypt is open source. The encryption implementation. The chunking algorithm. The upload pipeline. The key derivation. If there's a vulnerability, you'll find it before we do, because you have the same access to the source that we do.
The best security audit is 10,000 strangers reading your code.
The endgame
Storage that costs nothing
A world where personal file storage costs $0 and your data belongs to you.
Revolutionary? No. Obvious? Yes. Done? Finally.
The technology for free, encrypted, distributed storage has existed for years. Git hosting has been free for over a decade. AES-256 has been an open standard since 2001. Zstd compression has been open source since 2016. All zcrypt does is connect the dots that the industry had every incentive to leave disconnected.
Because every dot connected is a revenue stream severed.
They had every incentive to never build this. So we did.
The author
The “we” is mostly one guy
Honestly? Mostly one guy. I'm Wasif Malik, a full-stack engineer who wanted a lot of free storage, couldn't find any that wouldn't read his files, and got annoyed enough to build the alternative instead of just posting about it. zcrypt is mine end to end: the encryption, the upload pipeline, the drive, and this exact page you're reading.
I say “we” out of habit, not to hide behind a logo, and here of all places, that matters. A tool that asks you to trust it with your keys should tell you exactly who wrote the code that holds them. No anonymous founder. No shell company. Just my name, on the record, right here.
Wasif Malik, the one-person company behind zcrypt.