Alternatives to Tomb
Minimalist open-source CLI for LUKS-encrypted volumes on Linux, with steganographic key hi
Tomb ranks #9 of 11 in File encryption tools, with an Alt Score of 50. It is licensed under GPL-3.0, free from Free and available on Linux and Windows. 9 of 9 checklist rows are verified against a public source.
Tomb (the Crypto Undertaker), maintained by the Dyne.org Foundation since 2007, is a lightweight shell-script CLI that wraps Linux's cryptsetup/LUKS to create, open and manage encrypted volume files ('tombs'). Its distinguishing feature is optional steganography: encryption keys can be hidden inside JPEG images instead of stored as plain key files, appealing to Linux users and privacy researchers who want an auditable, dependency-light alternative to GUI tools.
Tomb is aimed at GNU/Linux users who want to keep sensitive files in an encrypted, portable container operated entirely from the command line, including people in high-risk or surveillance-prone situations who need to carry data on removable media without a permanent installation.
A minimalist shell-script tool that creates password- and key-file-protected encrypted volumes ('tombs') on top of Linux dm-crypt/LUKS, with optional steganographic hiding of key files inside JPEG images, paper-based key backups as QR codes, and two-factor unlocking via FIDO2 passkeys.
Users create a tomb container of a chosen size, forge a separate key file protected by a password, and lock the tomb with that key; opening the tomb mounts it as a normal folder using the Linux kernel's cryptsetup/LUKS machinery, while closing it unmounts and re-seals the contents, with the key intended to be stored separately from the tomb file itself.
Where Tomb stands out
Verified capabilities most alternatives don't have.
Why people leave Tomb
Dashed reasons are sourced facts; the rest are opinions. Vendors can dispute.
Sign in to add a reason — new reasons go through moderation before appearing.
Ranked alternatives
Ordered by Alt Score. Click any score to see the breakdown.
AxCrypt is a file and folder encryption app that lets users right-click to encrypt individual files with AES-128/256, rather than mounting a container or volume.
BestCrypt Container Encryption, from Finnish vendor Jetico, creates mountable encrypted containers on Windows, macOS, Linux and Android, similar in concept to VeraCrypt.
AES Crypt is a free, open-source utility (since 2005) for encrypting individual files with the AES-256 cipher, available as both a GUI (right-click integration) and a command-line tool on Windows, mac.
NordLocker, from the makers of NordVPN, creates password-protected encrypted folders (lockers) on the user's device using AES-256 and Argon2, with drag-and-drop file/folder encryption and optional end.
DiskCryptor is an open-source Windows encryption tool that can encrypt entire disks, partitions, external drives and file-based containers using AES, Twofish and Serpent.
Feature comparison
How Tomb compares with its alternatives, feature by feature.
| File encryption tools checklist | Tomb | VeraCrypt | AxCrypt | BestCrypt Container Encryption | AES Crypt | age |
|---|---|---|---|---|---|---|
| Pricing model | ||||||
| Starts at | ||||||
| License | ||||||
| Platforms | ||||||
| Container / volume encryption | ||||||
| Per-file encryption | ||||||
| Cloud-friendly (per-file sync) | ||||||
| Cross-platform | ||||||
| Open source & audited | ||||||
| Hidden volumes | ||||||
| Key files support | ||||||
| Password strength enforcement | ||||||
| CLI |
Every fact and feature listed for Tomb is verified against its own pages. Each alternative is sourced on its own page.
-
Pricing model Free verified 2026-07-30
Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.
https://dyne.org/tomb -
Status active verified 2026-07-30
pushed_at":"2025-12-16T03:47:57Z"" — 44 commits recorded since 2025-01-01 via the GitHub commits API; most recent commits (Dec 15-16, 2025) added a new FIDO2 passkey feature and translations. Repo is not archived. This is consistent with
https://api.github.com/repos/dyne/tomb -
License GPL-3.0 verified 2026-07-30
Confirmed by README.md: 'The license is GNU Public License v3.' and GitHub repo metadata (SPDX GPL-3.0).
GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007
https://raw.githubusercontent.com/dyne/tomb/master/COPYING -
Starts at Free verified 2026-07-30
No paid tier exists; project accepts optional donations (dyne.org/donate) but the tool itself is entirely free/GPL.
Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.
https://dyne.org/tomb -
Platforms Linux, Windows verified 2026-07-30
Windows support is only via WSL2 on Windows 11+, not a native Windows build. No macOS/iOS/Android support is documented; GitHub Actions CI (linux.yml) only builds/tests on Linux, and a portable-build
Tomb works only on GNU/Linux systems and WSL2 starting with Windows11.
https://dyne.org/docs/tomb/ -
Container / volume encryption Yes verified 2026-07-30
Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.
https://dyne.org/tomb -
Per-file encryption No verified 2026-07-30
Tomb consistently describes itself as managing files 'in volumes'/containers ('tombs'), not encrypting individual files separately; no per-file encryption mode is documented anywhere on the docs, FAQ,
Tomb is a 100% Free and Open Source tool to manage secret files in volumes protected by strong encryption.
https://dyne.org/docs/tomb/ -
Cloud-friendly (per-file sync) No verified 2026-07-30
Cloud storage is supported only by mounting/syncing the whole monolithic tomb container file (e.g. via sshfs), not by encrypting files individually, so cloud sync engines cannot sync per-file deltas.
It is also possible to store a tomb on a cloud service and mount it locally, ensuring remote servers cannot access contents. One can use sshfs for this
https://dyne.org/docs/tomb/ -
Cross-platform Partial verified 2026-07-30
Limited to GNU/Linux natively plus Windows 11 via WSL2; no macOS, iOS, Android, or standalone Windows support is documented.
Tomb works only on GNU/Linux systems and WSL2 starting with Windows11.
https://dyne.org/docs/tomb/ -
Open source & audited Partial verified 2026-07-30
Fully open source (GPL-3.0) and explicitly described as open to review, but no evidence of a completed formal third-party security audit of Tomb itself was found on the vendor site, docs, FAQ, or GitH
Tomb is a pretty secure tool mainly because it is kept minimal, its source is always open to review (even when installed), and its code is easy to read with some shell script knowledge.
https://dyne.org/tomb/faq/ -
Hidden volumes No verified 2026-07-30
This is steganographic hiding of the KEY inside an image file, not a hidden/decoy-volume-within-a-volume feature (as in VeraCrypt); no such hidden-volume capability is documented for the tomb containe
Tomb also supports deniable key storage using steganography. One can tomb bury and tomb exhume keys to and from JPEG images when the utility steghide is installed.
https://dyne.org/docs/tomb/ -
Key files support Yes verified 2026-07-30
generate encrypted storage folders to be opened and closed using associated key files, which are also protected with a password chosen by the user
https://dyne.org/docs/tomb/ -
Password strength enforcement No verified 2026-07-30
You set empty password, which is not possible."" — Source inspection of the tomb script's gen_key()/ask_password() logic shows only a non-empty check and a confirmation re-type match; no minimum length, complexity, or entropy/strength check is impleme
_failure
https://raw.githubusercontent.com/dyne/tomb/master/tomb -
CLI Yes verified 2026-07-30
Tombs are operated from a terminal command line and require root access to the machine (or just sudo access to the script).
https://dyne.org/tomb
FAQ
Yes. VeraCrypt, AxCrypt and age have a free tier or are fully free. Free-tier limits in the comparison table are verified and dated.
VeraCrypt, age and Cryptomator — every license claim links its source.