Dropbox vs Sync.com: Who Holds the Keys to Your Files
Published October 20, 2026· By Juan Martinez
Dropbox holds the keys to your files and is ahead on features and price per TB. Sync.com encrypts on your device but keeps a key copy unless you turn it off.
Dropbox vs Sync.com is a comparison for someone who uses Dropbox for personal files, shared folders or a small team and wants a service that works the same way but keeps the encryption keys away from the company. Both sync a folder on your computer with the cloud, both share files by link, and both have apps for Windows, macOS, Android and iPhone.
The difference is who can open your files. Dropbox encrypts them on its servers with keys it holds, and its terms say it “accesses, stores, and scans” what you store. Sync.com says it encrypts files and file names on your device before upload. But on paid plans Sync keeps a copy of your account key for email password reset unless you turn that off, and several of its features process files on its servers.
Sync.com is rated 5.4 and Dropbox 5.1. The small gap hides large ones. Sync is ahead on Encryption & Key Custody (5.0 against 2.5) and Trust & Transparency (4.0 against 3.0). Dropbox is ahead on Features & Sync (8.0 against 6.5), Usability & Platforms (8.5 against 6.5) and Price & Value (7.0 against 6.0).
| Dropbox | Sync.com | |
|---|---|---|
| Rating | 5.1 | 5.4 |
| Who Holds the Keys | Provider holds the keys | Depends on a setting |
| End-to-End Encryption | Only on the Advanced, Business Plus and Enterprise team plans, file contents only | Files and file names by default, in Sync's description; some features work outside it |
| Password Reset by Email | Always, files kept | On by default on paid plans, keeps a key copy; can be turned off |
| Security Audit | None found | None found |
| Data Breach | ✅ | ❌ |
| Linux Desktop Sync | ✅ | ❌ (WebDAV only) |
| Per TB (per month) | $5.00 | $5.60 |
| Jurisdiction | United States | Canada |
Want to compare every field side by side? Open the full comparison table.
What Dropbox encrypts, and who holds the keys
Dropbox splits each file into blocks and encrypts every block with 256-bit AES on its servers; the apps send files over TLS. This encryption at rest protects your files if a disk is stolen from a data center. It does not protect them from Dropbox: the file keys are created and stored inside Dropbox’s own infrastructure. That is key custody by the provider.
Because Dropbox holds the keys, its servers open your files to make previews and thumbnails, recognize text in scans, index files for search and check content against its rules with hash matching and human review. File names and types sit in a separate database that Dropbox reads, and Dropbox also records file sizes, upload times and the people you share with. There is no metadata encryption.
Dropbox does sell end-to-end encryption, but only to teams. Encrypted team folders come with the Advanced, Business Plus and Enterprise plans, and Advanced starts at three users. Only team admins can create these folders, file names and other metadata stay readable to Dropbox, and shared links, previews, search, the Dropbox AI features and the mobile app do not work inside them. On Basic and Plus, the plans for one person, no setting moves the keys to you.
What Sync.com encrypts, and the key copy it keeps
Sync says its desktop, mobile and web apps encrypt each file and its name on your device with 256-bit AES before upload. File size, file type, creation time and, in shared folders, the person who created a file are not encrypted, according to a 2024 study by ETH Zurich cryptographers. Sync describes the service as zero-knowledge; that is its own word, and no published audit has checked it.
On paid plans, email password reset is switched on by default. It keeps a copy of your account encryption key on a separate Sync server, a form of key escrow, and gives Sync’s automated systems temporary access to that key. Sync’s own terms say that while the setting is on, your account is “not configured on a strictly zero-knowledge basis”. So a Dropbox user who moves to a paid Sync plan and changes nothing gets a provider-side copy of the key from day one. You can turn email reset off in the Privacy Center, Sync’s settings page for these features, by entering your current password; that deletes the stored copy. On the free plan the box that turns it on is unticked at sign-up.
Two more limits apply whatever the key setting. The Privacy Center lists features that do not work end to end: previews of Office, OpenDocument, Photoshop and other formats in the web panel, audio and video streaming, editing in Microsoft’s online editor, faster web downloads of files over 100 MB, and links without Enhanced privacy. Sync’s terms say some of them may be on by default and do not list which. And the ETH Zurich study found that Sync’s apps do not check that the keys the server sends them are genuine, so a server under an attacker’s control could swap in its own key and read every file uploaded afterwards. Sync has publicly confirmed a fix only for a separate link leak found in the same study.
If you forget the password
With Dropbox, a forgotten password costs an email. Dropbox sends a reset link to your address, and your files are still there afterwards because Dropbox holds the keys. The flip side of this account recovery is that whoever takes over your email inbox can reach your files unless two-factor authentication is on. Dropbox offers it on every plan, with codes by text message or an authenticator app, security keys, passkeys and backup codes.
With Sync, the cost depends on the email reset setting. With it on, the reset works like Dropbox’s and you keep your files. With it off, you can change the password only from the Sync desktop app on a computer that is still signed in. Without such a computer, Sync’s only option is to delete the account with every file in it. Turning off the key copy makes sense only if you keep your password somewhere safe and keep the desktop app installed. Sync’s two-factor authentication sends codes by email or an authenticator app and gives single-use backup codes.
Sharing and links
On Dropbox, sharing runs through its servers, so a shared folder or link has the same protection as the rest of the account: Dropbox can read it. Dropbox Transfer on Plus sends files of up to 50 GB to people without a Dropbox account, and Standard adds password-protected links.
On Sync, a shared folder hands other Sync users the folder key, encrypted with their public key, so it stays end to end. A link stays end to end only when Enhanced privacy is switched on for it, which also turns off streaming, extended previews and editing for that link. Without it, the link is encrypted only in transit and Sync can process the file on its servers. Link passwords work on every plan. The free plan allows three active links with up to 20 downloads per link per day; expiry dates, download limits and view-only links need Solo 5TB or a team plan.
Features, editing and sync
Dropbox has the fuller toolset. Its desktop sync app runs on Windows, macOS and Linux, although Dropbox says the Linux app is changing. A single file can be up to 2 TB. Google Docs, Sheets and Slides and Microsoft Office files open from Dropbox in those companies’ editors, and Dropbox Paper documents are stored and rendered on Dropbox’s servers. Dropbox’s AI features run on outside models from OpenAI and Anthropic. Paid plans have no device limit; the free plan connects at most three devices.
Sync’s desktop app runs on Windows and macOS only; on Linux there is a WebDAV server for other tools, not a sync app. CloudFiles leaves files in the cloud until you open them, Vault keeps files in the cloud without syncing them to your computers, and the mobile apps upload camera photos. The apps have no file size limit. Every plan, including the unlimited one, connects at most 5 computers and phones.
Collaborative editing leaves end-to-end encryption on both. On Dropbox, whoever runs the editor can read the document. On Sync, Edit in Office opens Word, Excel and PowerPoint files in Microsoft’s online editor, which Sync says is encrypted but not end to end, so Microsoft’s servers see the document while you edit it. Switching off the Microsoft editor in Sync’s Privacy Center keeps Office files out of it.
File versioning favours Sync. Earlier versions and deleted files can be restored for 90 days on Personal 1TB, 180 days on Solo 5TB and 365 days on Personal Unlimited, and they do not count toward your storage. Dropbox keeps them for 30 days on Basic and Plus, 180 days on Standard and 365 days on Advanced, and does not cover Google Docs, Paper docs or Office Online files.
Audits, data use and incidents
Neither publishes the code of its apps or servers; both are closed source. Neither has a published security audit of its encryption. What each publishes are reports it commissioned on how it runs its systems. Dropbox lists ISO/IEC 27001 and related certificates and SOC 2 reports for the year to 30 September 2025, with penetration test reports given only on request. Sync publishes a SOC 3 report in which the accounting firm Sensiba concluded that Sync’s statement about its 2024 security controls was fairly stated, and claims SOC 2 Type 1 compliance. None of these reports says whether the company can read your files.
The only outside look at either side’s encryption is the ETH Zurich study of Sync. The researchers wrote to Sync on 23 April 2024 and recorded no answer by 10 October 2024; Sync then told TechTarget it had fixed the link leak and was fast-tracking the other fixes.
Dropbox’s privacy FAQ says it may train models on “your documents and metadata” for search, sorting and summaries, and use machine learning on the content of files to pick users to market paid plans to. Dropbox’s privacy policy describes no way to turn off usage collection, so the telemetry is always on. Sync lets you switch off product analytics in account settings, but its privacy policy allows advertising identifiers and cookies used to target ads.
Dropbox has a long data breach record: a 2011 login bug, a 2012 incident whose list of email addresses and hashed passwords, reported at 68 million accounts, was confirmed real in 2016, a 2022 theft of 130 code repositories from its GitHub, and a 2024 breach of its separate Dropbox Sign service. Sync has no known breach.
Price
Both price in US dollars. For one person who needs 1 to 2 TB, Dropbox is cheaper and bigger: Plus gives 2 TB for $9.99 a month on yearly billing, $119.88 a year, or $11.99 a month. Sync’s Personal 1TB gives 1 TB for $144 a year at the regular price or $16 a month; the first year costs $108, and the plan then renews at $144. Dropbox’s plans page shows the same price in the first year and at renewal.
Per terabyte Dropbox stays cheaper at larger sizes too. Sync’s Solo 5TB costs $336 a year, about $67 per terabyte a year, against about $60 per terabyte a year on Dropbox Plus. Personal Unlimited costs $540 a year with no storage cap, though Sync may slow uploads past 10 TB. Dropbox’s next step is Standard, which starts at 3 TB for the team and costs $15 per user a month on yearly billing, $180 a year for one person. The Sync review covers personal plans only, so this article does not compare team prices.
The free plans: Dropbox Basic gives 2 GB, and Dropbox may close it after 12 months without use. Sync gives 5 GB and may close a free account after six months without use. Sync refunds new purchases in full within 30 days, but a cancelled paid plan closes the account and its files are deleted after 30 days. Dropbox refunds only where the law requires it, for example within 14 days in the European Union.
Who runs each service
Dropbox, Inc. is a public company listed on Nasdaq. Its terms follow California law unless your country’s law requires otherwise. Its production systems run in US data centers. It publishes a transparency report on government requests twice a year. Because Dropbox holds the keys, a valid order can reach the contents of your files.
Sync.com Inc. is an independent company founded in Toronto in 2011. Users outside the US contract with it under Ontario and Canadian law. Files are stored in Canada by default, or in the US for accounts in the US data region, and account data is also kept with service providers in the US. Its privacy policy says it checks that a legal request is valid, hands over only what the law requires and tries to tell you. Whatever the key setting, Sync sees your account details and the unencrypted file details; whether it could hand over the files themselves depends on the key copy and the features described above.
Which one to pick
Read the full Dropbox review if you want the fullest feature set, Linux sync, Google and Office editing from your storage, no device limit on paid plans and 2 TB at the lowest price of the two, and you accept that Dropbox can open everything you store, scan it and use its content for its own features. Turn on two-factor authentication with a security key or passkey, since your email inbox is the way into your files.
Read the full Sync.com review if keeping the keys away from the company is the reason you are leaving Dropbox. Then turn off email password reset in the Privacy Center, keep the desktop app installed and your password stored safely, leave the Microsoft editor and extended previews off, and switch on Enhanced privacy for links. You accept no Linux sync app, a five-device limit, a renewal price a third above the first year, and a server that, according to the ETH Zurich study, could still swap in its own key if attacked.