pCloud's Encryption Is Broken: ETH Zurich Found Critical Flaws, pCloud Didn't Care

I’ve recommended pCloud on this site. I make money when you buy cloud storage from them. And now I need to tell you their encryption is, apparently, broken.

ETH Zurich E2EE Cloud Storage Security Test: Who Passed, Who Failed

Provider	Key Injection Attack	File Injection	Metadata Tampering	Chunk Auth Issues	Response to Disclosure
pCloud	❌ Vulnerable	❌ Vulnerable	❌ Vulnerable	❌ Vulnerable	Dismissed as 'theoretical'
Sync.com	❌ Vulnerable	❌ Vulnerable	❌ Vulnerable	N/A	No response to disclosure
Icedrive	N/A	❌ Limited vuln.	❌ Vulnerable	❌ Vulnerable	Acknowledged but refused to fix
Seafile	N/A	❌ Vulnerable	❌ Vulnerable	❌ Vulnerable	Committed to partial fix
Tresorit	✅ Not vulnerable	✅ Not vulnerable	✅ Not vulnerable	✅ Not vulnerable	Already secure by design

Source: 'End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem' — ETH Zurich, ACM CCS 2024. Full paper: brokencloudstorage.info

In October 2024, researchers Jonas Hofmann and Kien Tuong Truong at ETH Zurich — one of the world’s top technical universities — published a paper called “End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem” at ACM CCS 2024.

They tested five major end-to-end encrypted cloud storage providers: pCloud, Sync.com, Icedrive, Seafile, and Tresorit.

Four out of five failed. pCloud failed the worst.

Only Tresorit passed — because, as the researchers noted, it had “a comparably more thoughtful design and an appropriate choice of cryptographic primitives.”

pCloud? Vulnerable to every attack category tested.

Commission disclosure upfront: I make money from pCloud (affiliate). I make $0 from Tresorit. I make $0 from Proton Drive. I’m about to tell you that pCloud’s paid encryption add-on — the one I’ve linked to in previous articles — has critical security flaws that pCloud has refused to fix. This is the same transparency approach I took when I called out “unlimited” hosting lies from my own affiliate partners.

⚡ 30-Second Verdict

ETH Zurich found pCloud vulnerable to 4 critical attack categories — key injection, file injection, metadata tampering, and chunk authentication bypass
A malicious server could decrypt your “encrypted” files by forcing your client to use an attacker-controlled key
pCloud dismissed the findings as “theoretical” and “based on highly unrealistic conditions”
pCloud did not respond to the researchers’ responsible disclosure attempts
No patches have been released as of March 2026
Users pay $3.99-$4.99/month extra for Crypto encryption that has proven flaws
Only Tresorit passed the full security test — the only E2EE cloud storage that actually works as advertised
February 2026: pCloud users reported seeing other people’s files in their accounts — a separate but concerning incident

What ETH Zurich Found

The researchers tested each provider against a specific threat model: what happens if the server is compromised or malicious? This matters because the entire point of end-to-end encryption is that even the server operator can’t access your files.

If the encryption breaks when the server is hostile, it’s not real end-to-end encryption. It’s marketing.

Attack 1: Unauthenticated Encryption Keys

The most critical finding. A malicious pCloud server could force your client to encrypt files using an attacker-controlled key. The attacker could then decrypt those files.

In plain English: pCloud’s encryption client doesn’t properly verify that the encryption key actually belongs to you. A hostile server can swap in its own key, your client encrypts with it, and the server can read everything.

This defeats the entire purpose of end-to-end encryption.

Attack 2: File Injection

A malicious server could place files into your storage that are indistinguishable from files you uploaded yourself. You’d have no way to tell the difference between your real files and injected ones.

This isn’t just a theoretical nuisance — imagine planted evidence, manipulated documents, or phishing files appearing in your “encrypted” cloud storage.

Attack 3: Metadata Tampering

File names, folder structures, and file paths are not integrity-protected in pCloud. A malicious server could rename your files, reorganize your folders, or truncate file names without detection.

Your “encrypted” storage could silently reorganize itself and you’d never know.

Attack 4: Chunk Authentication Bypass

pCloud splits files into chunks for upload. The researchers found that these chunks aren’t properly authenticated — meaning a malicious server could remove or reorder chunks within a file, corrupting your data in ways that aren’t immediately visible.

pCloud’s Response: Dismissal

When the researchers tried to disclose these vulnerabilities responsibly — the standard practice in security research where you notify the company before publishing — pCloud did not respond.

After the paper was published, pCloud issued a statement calling the findings “theoretical” and “based on highly unrealistic conditions that do not reflect real-world threats.”

They added: “Should any actionable insights arise from this research, we will promptly implement enhancements.”

Translation: “We don’t think this is a problem and we’re not going to fix it.”

As of March 2026 — over a year after the responsible disclosure attempt — no patches have been released.

Compare this to Tresorit, which didn’t need to patch anything because their encryption was properly designed from the start. Or Seafile, which at least committed to addressing the issues.

pCloud’s response pattern:

Ignored the researchers
Called the findings theoretical
Released no patches
Continued charging $3.99-$4.99/month for Crypto

Then Users’ Files Started Appearing in Other People’s Accounts

In February 2026 — months after pCloud dismissed the ETH Zurich findings as “theoretical” — users reported a separate incident where files and folders from other pCloud users became visible in their accounts.

Some users could download these files. Others could see file names and metadata. This was a cross-account data exposure — one of the most basic security failures a cloud storage provider can have.

pCloud’s response? They called it a “rare synchronization anomaly.”

Under GDPR, they had 72 hours to notify affected users. No official GDPR notification was released. Users only learned about it through support channels when they contacted pCloud themselves.

This incident is separate from the ETH Zurich encryption findings. But it paints a picture: a company that dismisses academic security research, doesn’t patch known vulnerabilities, and then has a fundamental data exposure incident that it minimizes and fails to properly disclose.

You’re Paying Extra for Broken Encryption

Here’s what makes this especially infuriating: pCloud Crypto is a paid add-on.

Monthly: $3.99-$4.99/month on top of your storage plan
Lifetime: $150 one-time on top of your lifetime storage purchase

Users are paying a premium for encryption that ETH Zurich researchers proved can be bypassed by a hostile server. And pCloud’s default storage — without Crypto — uses encryption keys that pCloud controls, meaning they can access your files anytime.

So the options are:

Without Crypto: pCloud holds the keys and can access your files
With Crypto: You pay extra for encryption that has documented vulnerabilities pCloud refuses to fix

Neither is acceptable for a service that markets itself on security.

How This Changes My Recommendations

I’ve recommended pCloud in several articles on this site. I’ve earned commissions from those recommendations.

That stops today for security-focused use cases.

If you’re using pCloud as convenient cloud storage and don’t care about encryption — it still works fine for that. The sync is good, the apps are decent, the pricing (especially lifetime deals) is competitive.

But if you chose pCloud because you trusted its encryption — if you’re storing sensitive documents, financial records, medical files, or anything you need genuinely protected — you need to switch.

What to Use Instead

For privacy-first cloud storage:

Proton Drive — From Free (Commission: $0)

True zero-knowledge encryption by default (not a paid add-on)
Built on OpenPGP (open standard, battle-tested)
Swiss jurisdiction, four consecutive Securitum audits
File names, folder names, and metadata all encrypted
Read our full Proton Drive review
Commission: $0 (I make nothing)

For verified E2EE storage:

Tresorit — the only provider that passed the ETH Zurich test. Their encryption design was praised as “more thoughtful” with “appropriate choice of cryptographic primitives.” If you need encryption that actually works as advertised, Tresorit is the only tested option. Commission: $0 (no affiliate relationship).

For understanding the full landscape:

See our Cloud Storage Monopoly Map for who owns what and where the independent alternatives live.

The Uncomfortable Truth About “Encrypted” Cloud Storage

The ETH Zurich study tested five providers. Four failed. The services with a combined user base of 22+ million are using encryption that doesn’t protect against the exact threat it’s supposed to protect against — a compromised or malicious server.

This matters because:

Government requests: If a government orders pCloud to hand over data, their server can potentially decrypt your “encrypted” files using the key injection attack
Data breaches: If an attacker compromises pCloud’s servers, the encryption doesn’t protect you
Insider threats: A malicious employee could potentially access encrypted files

The whole point of end-to-end encryption is that none of these scenarios should matter. With properly implemented E2EE, even pCloud themselves shouldn’t be able to access your files.

With pCloud’s current implementation, they can. And they’re charging you extra for the privilege.

Don’t Trust Me — Verify Everything

Full disclosure: I make money from pCloud (affiliate). I make $0 from Tresorit, $0 from Proton Drive. I’m calling out pCloud’s encryption flaws despite the affiliate relationship — because recommending broken security to earn a commission isn’t something I’m willing to do. My pCloud lifetime deal article will be updated to reflect these findings.