# Alternatives to Tomb

Tomb (the Crypto Undertaker), maintained by the Dyne.org Foundation since 2007, is a lightweight shell-script CLI that wraps Linux's cryptsetup/LUKS to create, open and manage encrypted volume files ('tombs'). Its distinguishing feature is optional steganography: encryption keys can be hidden inside JPEG images instead of stored as plain key files, appealing to Linux users and privacy researchers who want an auditable, dependency-light alternative to GUI tools.

Tomb ranks #9 of 11 in File encryption tools, with an Alt Score of 50. It is licensed under GPL-3.0, free from Free and available on Linux and Windows. 9 of 9 checklist rows are verified against a public source.

Source: https://altcatalog.com/alternatives/tomb/
Category: File encryption tools

## Where Tomb stands out

- **Container / volume encryption** — 4 of 11 apps with a verified answer have this

## Overview

- **Who it's for**: Tomb is aimed at GNU/Linux users who want to keep sensitive files in an encrypted, portable container operated entirely from the command line, including people in high-risk or surveillance-prone situations who need to carry data on removable media without a permanent installation.
- **What you get**: A minimalist shell-script tool that creates password- and key-file-protected encrypted volumes ('tombs') on top of Linux dm-crypt/LUKS, with optional steganographic hiding of key files inside JPEG images, paper-based key backups as QR codes, and two-factor unlocking via FIDO2 passkeys.
- **How it works**: Users create a tomb container of a chosen size, forge a separate key file protected by a password, and lock the tomb with that key; opening the tomb mounts it as a normal folder using the Linux kernel's cryptsetup/LUKS machinery, while closing it unmounts and re-seals the contents, with the key intended to be stored separately from the tomb file itself.

## Profile

- **License**: GPL-3.0 (verified 2026-07-30)
- **Pricing model**: Free (verified 2026-07-30)
- **Starts at**: Free (verified 2026-07-30)
- **Platforms**: Linux, Windows
- **Status**: active (verified 2026-07-30)

## Ranked alternatives

| # | App | Alt Score | Licence | Platforms |
|---|-----|-----------|---------|-----------|
| 1 | [VeraCrypt](https://altcatalog.com/alternatives/veracrypt.md) | 75 | Apache-2.0 | Windows, macOS, Linux |
| 2 | [AxCrypt](https://altcatalog.com/alternatives/axcrypt.md) | 70 | ? | Windows, macOS, Linux, iOS |
| 3 | [BestCrypt Container Encryption](https://altcatalog.com/alternatives/bestcrypt-container-encryption.md) | 70 | Proprietary | Windows, macOS, Linux, Android |
| 4 | [AES Crypt](https://altcatalog.com/alternatives/aes-crypt.md) | 65 | Proprietary | Windows, macOS, Linux, Android |
| 5 | [age](https://altcatalog.com/alternatives/age.md) | 65 | BSD-3-Clause | Windows, macOS, Linux |
| 6 | [Cryptomator](https://altcatalog.com/alternatives/cryptomator.md) | 65 | GPL-3.0 | Windows, macOS, Linux, iOS |
| 7 | [Kryptor](https://altcatalog.com/alternatives/kryptor.md) | 65 | GPL-3.0 | Windows, macOS, Linux |
| 8 | [Gpg4win](https://altcatalog.com/alternatives/gpg4win.md) | 55 | GPL | Windows |
| 9 | [NordLocker](https://altcatalog.com/alternatives/nordlocker.md) | 50 | Proprietary | Windows, Android, iOS, Web |
| 10 | [DiskCryptor](https://altcatalog.com/alternatives/diskcryptor.md) | 40 | GPL-3.0 | Windows |

Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/

## Feature comparison

Legend: Yes / No / Partial / ? (not verified).

| File encryption tools checklist | Tomb | VeraCrypt | AxCrypt | BestCrypt Container Encryption | AES Crypt | age |
|---|---|---|---|---|---|---|
| Pricing model | Free | Free | Freemium | Subscription | One-time | Free |
| Starts at | Free | Free | ? | ? | $39.99 | Free |
| License | GPL-3.0 | Apache-2.0 | ? | Proprietary | Proprietary | BSD-3-Clause |
| Platforms | Linux, Windows | Windows, macOS, Linux | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, Android | Windows, macOS, Linux, Android | Windows, macOS, Linux |
| Container / volume encryption | Yes | Yes | Partial | Yes | No | No |
| Per-file encryption | No | No | Yes | No | Yes | Yes |
| Cloud-friendly (per-file sync) | No | No | Yes | Partial | Yes | Yes |
| Cross-platform | Partial | Yes | Yes | Yes | Yes | Yes |
| Open source & audited | Partial | Yes | Partial | Partial | Partial | Partial |
| Hidden volumes | No | Yes | No | Yes | ? | No |
| Key files support | Yes | Yes | Partial | Yes | Yes | Yes |
| Password strength enforcement | No | Partial | Partial | No | ? | No |
| CLI | Yes | Yes | Yes | Yes | Yes | Yes |

## Sources

Sources for Tomb. Each alternative is sourced on its own page.

- **Pricing model**: Free — <https://dyne.org/tomb> (verified 2026-07-30)
  - Quote: “Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.”
- **Status**: active — <https://api.github.com/repos/dyne/tomb> (verified 2026-07-30)
  - Note: pushed_at":"2025-12-16T03:47:57Z"" — 44 commits recorded since 2025-01-01 via the GitHub commits API; most recent commits (Dec 15-16, 2025) added a new FIDO2 passkey feature and translations. Repo is not archived. This is consistent with
- **License**: GPL-3.0 — <https://raw.githubusercontent.com/dyne/tomb/master/COPYING> (verified 2026-07-30)
  - Note: Confirmed by README.md: 'The license is GNU Public License v3.' and GitHub repo metadata (SPDX GPL-3.0).
  - Quote: “GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007”
- **Starts at**: Free — <https://dyne.org/tomb> (verified 2026-07-30)
  - Note: No paid tier exists; project accepts optional donations (dyne.org/donate) but the tool itself is entirely free/GPL.
  - Quote: “Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.”
- **Platforms**: Linux, Windows — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Note: Windows support is only via WSL2 on Windows 11+, not a native Windows build. No macOS/iOS/Android support is documented; GitHub Actions CI (linux.yml) only builds/tests on Linux, and a portable-build
  - Quote: “Tomb works only on GNU/Linux systems and WSL2 starting with Windows11.”
- **Container / volume encryption**: Yes — <https://dyne.org/tomb> (verified 2026-07-30)
  - Quote: “Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.”
- **Per-file encryption**: No — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Note: Tomb consistently describes itself as managing files 'in volumes'/containers ('tombs'), not encrypting individual files separately; no per-file encryption mode is documented anywhere on the docs, FAQ,
  - Quote: “Tomb is a 100% Free and Open Source tool to manage secret files in volumes protected by strong encryption.”
- **Cloud-friendly (per-file sync)**: No — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Note: Cloud storage is supported only by mounting/syncing the whole monolithic tomb container file (e.g. via sshfs), not by encrypting files individually, so cloud sync engines cannot sync per-file deltas.
  - Quote: “It is also possible to store a tomb on a cloud service and mount it locally, ensuring remote servers cannot access contents. One can use sshfs for this”
- **Cross-platform**: Partial — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Note: Limited to GNU/Linux natively plus Windows 11 via WSL2; no macOS, iOS, Android, or standalone Windows support is documented.
  - Quote: “Tomb works only on GNU/Linux systems and WSL2 starting with Windows11.”
- **Open source & audited**: Partial — <https://dyne.org/tomb/faq/> (verified 2026-07-30)
  - Note: Fully open source (GPL-3.0) and explicitly described as open to review, but no evidence of a completed formal third-party security audit of Tomb itself was found on the vendor site, docs, FAQ, or GitH
  - Quote: “Tomb is a pretty secure tool mainly because it is kept minimal, its source is always open to review (even when installed), and its code is easy to read with some shell script knowledge.”
- **Hidden volumes**: No — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Note: This is steganographic hiding of the KEY inside an image file, not a hidden/decoy-volume-within-a-volume feature (as in VeraCrypt); no such hidden-volume capability is documented for the tomb containe
  - Quote: “Tomb also supports deniable key storage using steganography. One can tomb bury and tomb exhume keys to and from JPEG images when the utility steghide is installed.”
- **Key files support**: Yes — <https://dyne.org/docs/tomb/> (verified 2026-07-30)
  - Quote: “generate encrypted storage folders to be opened and closed using associated key files, which are also protected with a password chosen by the user”
- **Password strength enforcement**: No — <https://raw.githubusercontent.com/dyne/tomb/master/tomb> (verified 2026-07-30)
  - Note: You set empty password, which is not possible."" — Source inspection of the tomb script's gen_key()/ask_password() logic shows only a non-empty check and a confirmation re-type match; no minimum length, complexity, or entropy/strength check is impleme
  - Quote: “_failure ”
- **CLI**: Yes — <https://dyne.org/tomb> (verified 2026-07-30)
  - Quote: “Tombs are operated from a terminal command line and require root access to the machine (or just sudo access to the script).”

---
Ranked by verified data, never by who paid. https://altcatalog.com/trust/