is google drive end-to-end encrypted?

google drive is encrypted, but it isn't end-to-end encrypted by default. google says files are encrypted in transit and at rest with aes-256, but google manages the keys, so its systems can decrypt your files. end-to-end protection, where only you hold the keys, needs either google workspace client-side encryption (only in certain business and education editions) or a tool that encrypts files on your mac before they upload.

what google encrypts

• in transit: files moving between your device and google's servers travel over encrypted connections (tls).
• at rest: google's drive help says all files uploaded to drive, or created in docs, sheets and slides, are encrypted at rest with aes-256. google's workspace encryption whitepaper describes stored data being split into chunks, each encrypted with its own key.

this protects you against someone stealing a disk from a data center or tapping the network. it doesn't keep google itself out. google holds the keys, which is what lets drive show previews, search inside files, scan for malware and let you edit docs in the browser.

what end-to-end encryption means

end-to-end (or client-side) encryption means files are encrypted on your device, with a key that never reaches the provider. google stores only scrambled bytes. it can't preview, search or read them, and neither can anyone who gets into your google account without your key.

google workspace client-side encryption

google does offer real client-side encryption, called workspace cse. google describes it as encryption that google's servers and third parties can't decrypt. the catch is who can use it:

• it's listed for frontline plus, enterprise plus, education standard and education plus. personal gmail accounts and smaller workspace plans don't have it.
• an admin has to turn it on and connect a key service, either from a google partner or one the organization runs.
• some features don't work on encrypted files, and google lists limits on what can be done with them.

if your company already pays for one of those editions, ask your admin. for everyone else, encryption has to happen on your own mac.

how to add your own end-to-end encryption

cryptomator

cryptomator is an open-source app for mac, windows, linux, ios and android. you create a "vault" inside a folder that google drive for desktop already syncs, unlock it with a password, and it appears as a drive. files you save there are encrypted one by one, file names included, before drive for desktop uploads them. it works with almost any cloud that syncs a local folder, and it runs on more platforms than most alternatives, which makes it a strong default.

the trade-off is that it rides on top of your sync client. with google drive for desktop in stream mode, opening a big encrypted file still downloads all of it first.

feather drive's optional encryption

feather drive puts google drive and dropbox in finder as a streaming drive, and it has end-to-end encryption you can switch on. the details, from the security page:

• a random 256-bit master key is made on your mac. your passphrase is stretched with argon2id to wrap it, and the unwrapped keys live in the macos keychain.
• a 24-word recovery key wraps a second copy, so you can get back in if you forget the passphrase.
• every file gets its own random key, and contents are encrypted with aes-256-gcm in 4 MiB segments. file and folder names, and the original sizes, are encrypted too; google sees random-looking names.
• because files are encrypted in segments, a video can still open instantly: only the segments the app reads are fetched and decrypted.

what it doesn't protect against: malware on your unlocked mac, or anyone you send a share link to. file sizes and timing are roughly visible to google or dropbox. and if you lose both the passphrase and the recovery key, nobody can recover the files.

its limits: macos 26 or later, google drive and dropbox only, and it only sees files you put in it, not your whole drive. it needs an internet connection to open files, and it's a paid app with a 3-day free trial. cryptomator is the better pick if you need windows, linux or android.

before you encrypt anything

• write down the recovery key and keep it offline. this is the one step people skip and regret.
• encrypt the files that need it: ids, contracts, client work, backups. you lose drive previews and sharing from drive.google.com on encrypted files.
• turn on 2-step verification for your google account anyway. encryption protects contents; it doesn't stop someone deleting files.

related

• how feather drive's encryption works
• how to use google drive in finder on a mac
• google drive for desktop alternatives for mac
• how to open any file from the cloud on a mac without downloading it

common questions

is google drive end-to-end encrypted?

not by default. google encrypts files in transit and at rest, but google holds the keys. true end-to-end protection needs client-side encryption, which google offers only in certain workspace editions, or a tool that encrypts files on your device before upload.

can google see my google drive files?

with standard encryption, google manages the keys, so its systems can decrypt your files, which is how search, previews and virus scans work. files encrypted on your device before upload, with keys you keep, can't be read by google.

does google drive have client-side encryption for personal accounts?

no. google workspace client-side encryption is listed for frontline plus, enterprise plus, education standard and education plus, and an admin has to turn it on and set up a key service.

what happens if i lose my encryption password?

with real end-to-end encryption, nobody can recover the files for you, not google and not the tool's maker. keep the recovery key or password somewhere safe and offline.

can i still preview encrypted files on drive.google.com?

no. google only stores ciphertext, so its previews, search and editors can't read the contents. you open the files through the tool that encrypted them.