gocryptfs

gocryptfs is an encrypted overlay filesystem for Linux and macOS. It keeps encrypted data in one directory and exposes the decrypted files through a separate mounted directory, so your file contents and file names stay encrypted at rest while you read and write them normally.

Built on FUSE and the go-fuse library, it adds a reverse mode that presents an encrypted view of an existing plaintext directory, which is handy for encrypted backups. Filenames are protected with per-directory IVs, content uses AES-GCM or XChaCha20-Poly1305, and a stable command-line ABI lets you call it safely from your own apps and scripts.

Linux is the native platform, with beta-quality macOS support. On CPUs without AES acceleration, gocryptfs can route crypto through OpenSSL via a thin wrapper for a large speedup.