Hoodik vs Dropbox: A Self-Hosted, Encrypted Dropbox Alternative

Dropbox invented consumer file sync and it still does that job better than anyone. It is also, by design, a service that can read every file you give it. Those two facts are not in tension for most users, and they are the whole decision for some.

What "Encrypted" Means on Each Side

Dropbox encrypts your files. This is true and Dropbox says so clearly: AES-256 at rest, TLS in transit. What that protects against is someone stealing a disk out of a Dropbox datacenter. What it does not protect against is Dropbox itself, because Dropbox generates and holds the keys. An employee with the right access, a subpoena, a misconfigured internal tool, or an attacker who gets far enough into Dropbox's systems all end up at the same place: readable files.

Hoodik encrypts differently. Your file is encrypted in your browser or in the app, with a key that is itself wrapped for your account, before a single byte goes over the network. The server receives ciphertext and stores ciphertext. There is no key on the server to compel, leak, or misuse. If someone walks out of the datacenter with the whole disk, they have noise.

The same difference applies to file names. Dropbox knows your folder is called 2026-tax-return and that it contains bank-statements-q3.pdf. Hoodik encrypts that metadata client-side too, so the server sees an opaque blob with a UUID.

Where Dropbox Wins

The sync client. Dropbox has been refining it since 2007 and it shows: block-level delta sync so a one-line edit in a large file transfers a few kilobytes, LAN sync between machines on the same network, selective sync, smart sync for placeholder files. Hoodik has no equivalent. Its clients are web, iOS, Android, and macOS apps that upload and download deliberately, not a daemon that keeps a folder mirrored.

If your workflow is "save to a folder and it appears on my other machine," Dropbox does that and Hoodik does not. That is a real gap and it disqualifies Hoodik for plenty of people.

Integrations are the second gap. Dropbox connects to Slack, Zoom, Adobe, Canva, Microsoft Office, and a long tail of others. Hoodik has an HTTP API and no pre-built integrations, partly because integrations are hard to build against data the server cannot read.

Collaboration is the third. Dropbox Paper, comment threads, shared team folders with granular admin control, file requests. Hoodik has sharing with Reader, Editor, and Co-owner roles, and password-protected public links, which covers "send this to someone" but not "eight people editing a document together."

Price per gigabyte also favors Dropbox at consumer scale. Around $11.99/month for 2 TB is more storage than a €9/month Hoodik Cloud instance gives you.

Where Hoodik Wins

The server cannot read your files. Everything else follows from that.

It means content scanning is not possible rather than merely promised. Dropbox scans uploads against hash databases for copyright and abuse enforcement, which is a reasonable thing for a company in its position to do and also means an automated system is looking at your files. Hoodik's server has ciphertext. There is nothing to scan.

It means a breach is survivable. Dropbox's 2012 incident exposed around 68 million credentials. Credentials against an encrypted-blob store are worth much less than credentials against a store the provider can decrypt, and Hoodik's OPAQUE login means the server never receives your password in the first place. A password the server never sees is a password it cannot leak.

It means search works without telling anyone what you searched for. Hoodik runs a BERT tokenizer on the client, hashes each token with SHA256, and sends only hashes to the server for matching. You get search across every file from any device, and the server learns nothing about the query or the file names it matched.

The cryptography is also a generation ahead. Hoodik wraps file keys with a hybrid of X25519 and ML-KEM-768, the key exchange NIST standardized for the post-quantum era. Traffic recorded today for decryption later is a real threat model for anything with a long secrecy lifetime, and classical key exchange loses that fight.

Then there is the exit. Dropbox is Dropbox. Hoodik runs on a machine you own, or on Hoodik Cloud where we run it for you on the same publicly auditable code, and you can export the whole instance and self-host it whenever you want. The managed option is a convenience you rent, not a lock you accept.

Who Should Use Which

Most Dropbox users should stay on Dropbox. If you are sharing design files with clients, syncing a working folder across three machines, and living inside integrations, Dropbox is the better tool and the encryption difference will never come up in your day.

Hoodik is for the case where it does come up. Client records under a confidentiality obligation, legal or medical documents, research data, financial records, anything where "the provider can technically read this" is an answer you cannot give. For that, the sync client stops being the deciding feature.

You do not have to run a server to get there. Hoodik Cloud starts at €9/month for a 100 GB instance in the EU or US, provisioned in minutes, with a 14-day trial. It is a managed service like Dropbox is a managed service, with the difference that we cannot read your files either.