Encrypted S3 with Cryptomator + FUSE-T (macOS)

This guide connects a Mac to an S3-compatible object store (Garage) and keeps everything end-to-end encrypted with Cryptomator, so the server only ever stores ciphertext — not even the storage admin can read your files. On macOS we do it without a kernel extension, using FUSE-T instead of macFUSE.

It looks simple but has a couple of sharp edges (notably a Homebrew packaging quirk), so the steps below are deliberately complete.

How the pieces fit #

There are three independent layers. Keeping them straight is the key to not getting confused:

  ┌─ Garage bucket (remote) ──── stores ENCRYPTED blobs only
  │
  ├─ rclone mount ───────────── surfaces the bucket as a local folder
  │                             e.g. ~/garage-ciphertext   (still ciphertext!)
  │
  └─ Cryptomator vault ──────── encrypts/decrypts; presents a DECRYPTED drive
                                e.g. /Volumes/MyVault       (put files HERE)

• rclone turns the remote bucket into a normal folder on disk.
• Cryptomator stores an encrypted vault inside that folder and gives you a decrypted view to work in.
• FUSE-T is what lets both of those mount as drives on macOS without a kext.

The single most important rule: the rclone folder (~/garage-ciphertext) is the raw bucket. Anything you drop there directly is stored unencrypted. Only put files inside the unlocked Cryptomator vault (under /Volumes). That’s the layer that encrypts.

What you need from whoever runs the server #

• Endpoint URL — e.g. https://s3.example.com
• Region — Garage’s is commonly garage (match whatever the server is configured for)
• Bucket name — your personal bucket
• Access Key ID and Secret Access Key

Your data’s real protection is the Cryptomator vault password you choose below — it never leaves your Mac and the server never sees it. The S3 key only unlocks the bucket of ciphertext.

1. Install the tools #

brew install rclone
brew install macos-fuse-t/homebrew-cask/fuse-t
brew install --cask cryptomator

2. The Homebrew rclone gotcha (read this) #

Homebrew’s rclone is built without FUSE mount support on macOS. If you try rclone mount, you get:

Fatal error: failed to mount FUSE fs: rclone mount is not supported on MacOS
when rclone is installed via Homebrew. Please install the rclone binaries
available at https://rclone.org/downloads/ instead ...

Two ways forward:

• Easiest (recommended): use rclone nfsmount instead of rclone mount. It’s a different, kextless code path (rclone runs its own local NFS server) that works with the Homebrew build and needs no extra software. This guide uses it.
• If you specifically want FUSE-T driving the bucket mount: install the official rclone binary from rclone.org/downloads (not Homebrew’s) and use rclone mount. FUSE-T then backs that mount.

Either way, FUSE-T still does the headline job — Cryptomator’s decrypted drive in step 5.

3. Configure rclone #

Create ~/.config/rclone/rclone.conf (replace the placeholders):

[garage]
type = s3
provider = Other
access_key_id = <ACCESS_KEY_ID>
secret_access_key = <SECRET_ACCESS_KEY>
endpoint = https://s3.example.com
region = garage
force_path_style = true
no_check_bucket = true

force_path_style = true matters: Garage is usually deployed without a wildcard domain, so clients must use path-style addressing (endpoint/bucket, not bucket.endpoint). Then lock the file down and test:

chmod 600 ~/.config/rclone/rclone.conf
rclone lsf garage:YOUR-BUCKET      # empty bucket prints nothing; exit code 0 = success

4. Mount the bucket #

mkdir -p ~/garage-ciphertext
rclone nfsmount garage:YOUR-BUCKET ~/garage-ciphertext \
  --vfs-cache-mode full \
  --dir-cache-time 10s

• --vfs-cache-mode full is important — it gives Cryptomator the read/write consistency it expects from a real disk (without it, you can hit “file disappears after write” bugs on macOS).
• The first mount may trigger a macOS prompt: "…would like to access files on a network volume." Approve it (or enable it later under System Settings → Privacy & Security → Files & Folders) — otherwise the folder looks empty.
• This command runs in the foreground. Add --daemon to background it, or set up persistence (step 6).

(If you went the official-rclone + FUSE-T route from step 2, use rclone mount with the same flags instead.)

5. Set up Cryptomator (this is where FUSE-T shines) #

1. Open Cryptomator → gear icon (Preferences) → Virtual Drive → Volume Type → FUSE-T. This is the kextless way Cryptomator presents your decrypted drive.
2. Add Vault → Create New Vault, give it a name.
3. For the storage location, choose Custom and point it inside ~/garage-ciphertext (in the file picker, press ⌘⇧G and type ~/garage-ciphertext).
4. Set a strong vault password and save the recovery key it offers. This password is the real encryption key — it’s unrecoverable if lost.
5. Unlock. A decrypted drive appears under /Volumes. Work in that drive; the encrypted blobs land in ~/garage-ciphertext and sync to the bucket automatically.

If you’ve been testing by copying files straight into ~/garage-ciphertext, move them into the unlocked vault now and delete the originals from the bucket root — until they’re in the vault, they’re stored unencrypted.

6. Keep it mounted across logins (optional) #

The step-4 mount lasts until you log out. To auto-mount on login, install a launchd LaunchAgent. Save this as ~/Library/LaunchAgents/local.garage-mount.plist (replace YOU and YOUR-BUCKET):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>local.garage-mount</string>
  <key>ProgramArguments</key><array>
    <string>/opt/homebrew/bin/rclone</string><string>nfsmount</string>
    <string>garage:YOUR-BUCKET</string><string>/Users/YOU/garage-ciphertext</string>
    <string>--vfs-cache-mode</string><string>full</string>
    <string>--dir-cache-time</string><string>10s</string>
  </array>
  <key>EnvironmentVariables</key><dict>
    <key>HOME</key><string>/Users/YOU</string>
    <key>PATH</key><string>/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
  </dict>
  <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
  <key>ThrottleInterval</key><integer>30</integer>
</dict></plist>

launchctl load -w ~/Library/LaunchAgents/local.garage-mount.plist   # enable
launchctl unload -w ~/Library/LaunchAgents/local.garage-mount.plist # disable

Load it only when the mount point is free (unmount any manual mount first). Or skip persistence entirely and just remount on demand with the --daemon flag.

Troubleshooting #

FUSE-T support in Cryptomator is officially marked “experimental” but works well in practice (volume-type docs).

Other platforms #

• Linux: same idea with stock libfuse — rclone mount the bucket, then use Cryptomator’s FUSE volume type.
• Windows: install WinFsp, use Cryptomator’s WinFsp volume type, and surface the bucket with rclone (or a GUI client).
• GUI, any OS: Mountain Duck (paid) mounts S3 and opens Cryptomator vaults in one app; Cyberduck (free) browses + opens vaults without mounting.