pCloud is a cloud storage service run by pCloud International AG from Baar, Switzerland, founded in 2013. It sells storage by the month, by the year or for a single lifetime payment, from 500 GB to 10 TB, and gives up to 10 GB free.

Files in pCloud are encrypted on pCloud’s servers with keys that pCloud holds, so pCloud can read them. Encryption on your device, which pCloud calls zero-knowledge, applies only to one folder, the Crypto folder, and on personal plans it is a separate paid add-on. A 2024 study by ETH Zurich cryptographers found that a compromised pCloud server could read files placed in that folder afterwards, and pCloud dismissed the findings as theoretical.

Who Holds the Keys

Key custody at pCloud depends on where a file is stored. Ordinary files are encrypted on pCloud’s servers with keys pCloud holds. The help center confirms that pCloud’s servers can read them: the optional Photos AI feature groups faces in your photos on pCloud’s servers, and pCloud checks the checksums of stored files against lists of known illegal material. What it means for a provider to hold the keys is explained in our article on what a provider can do with files it can read.

The Crypto folder works differently. Files you put in it are encrypted on your device with a separate passphrase, the Crypto Pass, before they are uploaded. The folder comes with pCloud Encryption, an add-on sold separately from storage: $4.99 a month, $49.99 a year or a one-time payment listed at $229 (on 20 October 2026 the page sold it for $150). Business accounts include it. pCloud says the Crypto folder opens in the desktop, mobile and web apps once you enter the Crypto Pass.

The pCloud sync library, which pCloud publishes, describes the scheme as AES-256 in counter mode with HMAC-SHA512 for each file and 4096-bit RSA keys; the ETH Zurich study lists PBKDF2-SHA512 for turning the Crypto Pass into a key. pCloud’s own claim that it cannot read the Crypto folder is the vendor’s statement: no independent audit of the design is published.

What pCloud Can Still See

For files outside the Crypto folder, pCloud can see everything: contents, names, folders, sizes and dates. Inside the Crypto folder, the contents and the names of files and folders are encrypted. pCloud says only you know the type and size of those files, but the ETH Zurich study found that most file details in the Crypto folder are not protected against changes by the server. That is a finding about tampering, not about what pCloud can read. Of the file details, only the names are confirmed encrypted, and no independent source confirms pCloud’s statement about type and size.

Whatever is in the Crypto folder, pCloud sees your email address, IP addresses, browser, device and operating system, and your payment details from the payment processor. The privacy policy describes tracking of how long you stay, which pages you open and how often you use the service, and the privacy options page offers no switch for it, which makes the telemetry always on. With your consent, pCloud also works with advertising and analytics companies to show you offers on other websites.

The web app at my.pcloud.com gets its code from pCloud’s servers each time it loads, so a reader who opens the Crypto folder in the browser trusts that pCloud serves unaltered code on every visit. The desktop and mobile apps are installed once and update like other software.

Attacks Found by ETH Zurich

In 2024 Jonas Hofmann and Kien Tuong Truong of ETH Zurich’s Applied Cryptography Group tested five encrypted storage services against an attacker who controls the provider’s server, and presented the work at the ACM CCS conference. The attacks on pCloud’s Crypto folder were among the most serious in the study. The private key reaches the app encrypted in a way that does not detect tampering, so a compromised server could make the app use a key of its own choosing and read every file uploaded after that. A second attack on the keys that encrypt file names would expose those names in the same way.

The study also showed that such a server could remove parts of a file without the app noticing, swap file names within a folder, move file contents to other files, change file details, and plant files in your Crypto folder that look as if you uploaded them. The study’s attacks assume only a compromised server.

The researchers wrote to pCloud on 23 April 2024 and recorded that, by 10 October 2024, pCloud had not answered several attempts to reach it. In an article published on 20 October 2024, pCloud told BleepingComputer that the findings do not compromise the actual security of your files, that the study described “theoretical attack scenarios”, that some of it contained inaccuracies or was based on “highly unrealistic conditions”, and that it would improve its security if “actionable insights” arose. That statement did not say which, if any, of the flaws it fixed.

Sharing outside the Crypto folder works through links and folder invitations, and pCloud can read the files. Links open in a browser without a pCloud account; passwords and expiry dates for links need a paid plan. A folder invitation needs the other person to have a pCloud account in the same data region.

pCloud documents sharing from the Crypto folder only for Business accounts: the owner invites Business members or teams to a Crypto subfolder and gives new recipients a temporary Crypto Pass through a separate channel. The help pages on links and folder invitations for personal plans do not mention the Crypto folder.

Losing Your Password

A pCloud account has two passwords. The account password can be reset from an email link, and files outside the Crypto folder stay available. The Crypto Pass cannot be reset by pCloud: the terms say pCloud has no access to it, and resetting it in the desktop app deletes the encrypted files. For the Crypto folder, account recovery does not exist, and a forgotten Crypto Pass means those files are gone.

Open Source and Audits

pCloud publishes its sync and filesystem library, pclsync, on GitHub under a BSD-style licence, together with a Linux console client and developer kits. The library contains the encryption code for the Crypto folder. The desktop, mobile and web apps and the server are not published, so the code you actually run cannot be compared with the library, which makes the open source part partial.

No security audit of the Crypto folder or the apps is published. pCloud ran a two-round hacking contest, announced in January 2016: participants got access to a test Crypto folder, and pCloud reports that nobody decrypted it in either round, the second with a $100,000 prize. A contest on a test account does not check what the app does when the server itself is compromised, which is what the ETH Zurich study examined. The security page claims ISO 27001 certification without naming the certification body, and the help center says the EU data center is certified to SOC 2 Type II, a certification of the data center, not of pCloud’s software. There is no known data breach of pCloud.

Ownership and Jurisdiction

pCloud International AG is registered in Baar, Switzerland, and pCloud’s encryption page names Tunio Zafer as founder and CEO; the company does not name its shareholders. The terms are governed by Swiss law, with courts in the Canton of Zürich; users in the EU outside Switzerland can go to their own courts. Switzerland is not part of the Fourteen Eyes intelligence-sharing alliance.

Where your files are stored is a separate choice, made at sign-up: the EU region in Luxembourg or the US region in Dallas, Texas. pCloud’s privacy policy warns that US law may protect privacy less than EU law. Moving to the other region later costs a one-time $19.99. The privacy policy says pCloud hands over data in response to a subpoena, a court order or other legal process. For files outside the Crypto folder that includes their contents.

Sync and Features

The desktop app, pCloud Drive, runs on Windows, macOS and Linux and shows your storage as a virtual drive that takes no local space by default; desktop sync keeps chosen folders on your computer in step with pCloud in both directions, and a backup mode copies folders from your computer to pCloud. On Linux the app adds pCloud actions to the right-click menu of common file managers. pCloud sets no limit on file size, streams audio and video in the browser, and can import files from other cloud services.

File versioning is short. Earlier versions, deleted files and Rewind, a view of the whole account at an earlier date, go back 15 days on the free plan and 30 days on paid plans. Extended File History, a paid add-on, stretches all three to a year, but only from the day you switch it on. Versions and Rewind are available only on the website.

pCloud Docs lets you edit Word, Excel, PowerPoint, PDF, text and Markdown files and work on them with others in real time. pCloud does not describe this collaborative editing as end-to-end encrypted, and the files it opens outside the Crypto folder are files pCloud can read. Photos AI is opt-in and excludes the Crypto folder, and files in the Crypto folder cannot be kept for offline use in the mobile apps.

Usability and Platforms

There are apps for Windows, macOS and Linux, for Android and iPhone, and a web app. Two-factor authentication sends codes by SMS or through an authenticator app, with ten one-time recovery codes. The Crypto folder is locked until you enter the Crypto Pass, and the desktop app can lock it again when the computer goes to sleep. Paid accounts are never deleted for inactivity; a free account unused for 12 months is deleted with its files.

Price

The free plan starts with 2 GB and grows to 10 GB after a beginner’s tutorial and invitations to friends. Paid plans, billed yearly: Premium gives 500 GB for $49.99 a year, Premium Plus 2 TB for $99.99 and Ultra 10 TB for $299.99. Monthly billing costs $4.99, $9.99 and $29.99. The pricing page shows no separate first-year price. Encryption is extra on top of any of them: 2 TB with the Crypto folder costs $149.98 a year.

pCloud also sells a lifetime plan for each size: listed at $279 for 500 GB, $709 for 2 TB and $2,799 for 10 TB, and sold on 20 October 2026 for $219, $499 and $1,499. Lifetime plans can be stacked up to 17.5 TB per account. The terms define lifetime as your own life or 99 years, whichever is shorter, and also say that if pCloud stops operating, accounts are closed without a refund: a lifetime plan lasts as long as pCloud does. New purchases can be refunded within 14 days, but the terms let pCloud refuse a refund for anything bought at a promotional price.

Pros and Cons

Files in the Crypto folder, including their names, are encrypted on your device before upload
The sync library with the encryption code is published under an open licence
Desktop app with folder sync on Windows, macOS and Linux, and no file size limit
Low storage prices: $49.99 a year for 500 GB and $99.99 for 2 TB, plus lifetime plans
Up to 10 GB free, and files can be stored in the EU or the US

Outside the Crypto folder pCloud holds the keys and can read your files
Encryption on your device costs extra on personal plans: $49.99 a year or a one-time payment
A compromised server could get the app to encrypt new Crypto folder files with an attacker's key, according to the ETH Zurich study; pCloud called the findings theoretical
No published audit of the encryption, and the apps and server are closed source
A forgotten Crypto Pass means losing the encrypted files
Crypto folder sharing is documented only for Business accounts
Versions and deleted files are kept for only 30 days on paid plans unless you buy another add-on

Our Rating

Encryption & Key Custody4.0/10
By default pCloud encrypts files on its own servers with keys it holds. Encryption on your device covers only the Crypto folder, which costs extra on personal plans and is documented as shareable only in Business accounts. In that folder file names are encrypted too, but the ETH Zurich study showed that a compromised server could get the app to encrypt new files with a key the attacker controls. Forgetting the Crypto Pass means losing the encrypted files.
Trust & Transparency4.0/10
The sync library with the encryption code is published, but the apps and the server are closed, and no audit of the encryption is published. pCloud did not answer the ETH Zurich researchers for almost six months and then called their findings theoretical without saying what it would change. The company is Swiss and has no known breach.
Features & Sync7.5/10
A virtual drive and folder sync on Windows, macOS and Linux, no file size limit, document editors and media streaming in the browser. Versions and deleted files are kept for 30 days on paid plans; a year costs an extra add-on. Photos AI skips the Crypto folder, and its files cannot be kept offline in the mobile app.
Usability & Platforms7.5/10
Apps for every major desktop and mobile system and a web app, with two-factor authentication by SMS or an authenticator app. The Crypto folder adds a second password that the reader has to manage on its own.
Price & Value7.0/10
Storage is cheap: $49.99 a year for 500 GB and $99.99 for 2 TB, plus lifetime plans and up to 10 GB free. Encryption on your device costs another $49.99 a year, which brings 2 TB with encryption to about $150 a year. The refund window is 14 days.

Overall5.5/10

Encryption & Key Custody 30% · Trust & Transparency 25% · Features & Sync 20% · Usability & Platforms 15% · Price & Value 10%

See our rating methodology →