gocryptfs is an encrypted overlay filesystem written in Go that provides transparent encryption for files and directories using FUSE.
The tool solves the problem of securing sensitive data at rest by creating an encrypted layer between applications and storage. It works by mounting an encrypted directory as a virtual filesystem, automatically encrypting data on write and decrypting on read. The project was inspired by EncFS but addresses its security vulnerabilities while maintaining good performance. It uses AES-GCM for authenticated encryption and is built on the go-fuse FUSE library.
Linux is the primary platform where gocryptfs works natively. macOS support exists at beta quality, with most functionality working but occasional issues possible. For Windows users, an independent C++ reimplementation is available. The tool suits anyone needing transparent encryption for local storage without modifying applications, and is appropriate for protecting important data that requires regular backups and secure key management. The project recommends keeping a copy of the master key in a safe location to allow data recovery if the configuration file is damaged or the password is lost.
The project has undergone extensive testing including its own test suite, stress tests that run indefinitely, and porting of xfstests to FUSE, where it passes generic tests with one exception. Security has been formally audited. The codebase is written in Go and compiles from source with Go 1.13 or higher, with precompiled binaries available for x86_64 Linux systems and packages available in major Linux distributions.
