Nextcloud vs iCloud Drive for a Family Shared Folder: Encryption That Breaks the iOS Files App

The family shared folder is not a privacy whitepaper. It is a PDF of a camp form, a spreadsheet of who brings what, a folder of JPEGs from a phone that still thinks “storage full” is a personality. Someone will open it from the iOS Files app because that is where iPad users live. If your encryption story makes that tap fail, you did not secure the family. You hid the form from the person who needed it at the gate.

iCloud Drive is the default because it is already on the device. Nextcloud is the default among people who want the bits in the house. Both can share a folder. They break in different places. The break I care about is the one where “we turned on real encryption” and the Files provider shows a lock, a spinner, or a file that opens as garbage. That is Nextcloud end-to-end encryption meeting Apple’s file provider model. It is also, in a quieter way, iCloud Advanced Data Protection meeting a relative whose device was never enrolled.

What the Files app will forgive

Files is a picker and a placeholder machine. It wants a File Provider that can materialize a document when an app calls UIDocument. iCloud Drive is that provider. Nextcloud’s iOS app can be that provider too, for ordinary server-side files: TLS in transit, whatever you did on the disk at rest, names and thumbnails the app is allowed to see.

It will not forgive a design where the filename is public and the bytes are a blob only a special client can unwrap, unless that client is also a well-behaved provider. Nextcloud’s E2EE app was built as a client feature, not as “the Files app is a first-class peer.” People enable E2EE on a folder because a blog said zero-knowledge, then they share the folder with a family member who only knows Files and Safari. The member sees a cloud icon and a disappointment.

I have watched a parent try to attach a camp PDF from Files into an email. iCloud Drive: it works, the attachment is the PDF. Nextcloud without E2EE: it works if the Nextcloud account is signed in and the file is downloaded. Nextcloud with E2EE on that folder: the Files integration is the wrong door. You are in the Nextcloud app, if you are lucky, with a product that still treats E2EE as a power-user lane.

iCloud Drive’s honesty

Apple encrypts. Apple also holds a role in that encryption unless you turned on Advanced Data Protection and every participating device plays along. For a family folder, the practical trust model is “Apple and anyone with the Apple ID on a signed-in device.” Shared albums and iCloud Drive shares are not the same product. A Drive folder shared with a link or with specific people is what I mean here.

The honesty is UX. The Files app is native. Offline flags are understandable. Conflicts happen, but they look like Apple conflicts, not like a Nextcloud client that forked a file because two iPads saved a Pages document. Quota is the failure you already know: someone dumps a wedding video and the family plan fills. You buy more storage or you nag. You do not debug a PHP container.

The dishonesty is lock-in and the vague share. People lose access when they leave the Family Sharing organizer, or when a share was created under an old Apple ID. Encryption did not fail. The social graph did. For a family that is all-in on Apple, that graph is the product. For a family with one Android uncle, iCloud Drive is already the wrong shared folder.

Nextcloud’s honesty

Nextcloud will let you put the folder on a machine you can unplug. That is the reason to run it. Sharing is groups, users, and links you can expire. You can give a relative a login that is not an Apple ID. You can point a Windows laptop and an iPad at the same tree. You can also spend a weekend on Talk, OnlyOffice, and a theme, none of which the shared folder needed.

Default Nextcloud is not E2EE. Default Nextcloud is “the server can see the files, the disk should be encrypted, HTTPS is not optional.” That is enough for camp forms. It is not a slogan. It is a threat model: you trust the box and the admin, you do not trust the cafe Wi-Fi. The iOS Files provider can work in that model because the server can hand over the bytes after the app authenticates.

E2EE changes the threat model to “the server is a hostile or stolen disk.” That is a real model if the box is a VPS you do not control. It is a heavier model if the box is in your closet and the risk is a nosy roommate. Turning on E2EE for a family folder on a closet box is how you buy a threat model you do not have and lose a Files workflow you do.

The encryption that breaks Files

Nextcloud end-to-end encryption, as families actually enable it, lives in a special folder type. Clients that support it decrypt locally. Clients that do not, including a lot of “just use Files” paths, cannot present a useful document. Thumbnails lie. Search on the server cannot see content. Sharing E2EE folders with people who are not on a blessed client is how you get tickets that say “the file is there but it won’t open.”

There is also server-side encryption, which encrypts at rest on the Nextcloud host and still lets the server (and thus a logged-in Files provider) serve plaintext to the user. That will not break Files the same way. It also will not save you from a compromised Nextcloud admin. People confuse the two names. The Files app only cares which one still has a provider that can decrypt.

iCloud’s Advanced Data Protection is the Apple-shaped version of “we cannot see this.” It can surprise you when a third-party app or an older device is out of the circle. It rarely surprises the Files app on a current iPhone that is in the circle. The family failure is enrollment, not a File Provider gap.

What I actually run for relatives

If everyone is on Apple and the folder is forms and photos, I use iCloud Drive. I do not lecture. I turn on 2FA. I show them the shared folder in Files once. I accept Apple as a party to the threat model.

If someone is not on Apple, or I want the bits in the house, I use Nextcloud without E2EE on the family share. TLS, disk encryption, backups I have restored, accounts with good passwords. The iOS app is signed in. Files can attach the PDF. I keep E2EE, if I use it at all, for a private folder that only I open in the Nextcloud client — tax packet, that sort of thing — not for the folder named “Family.”

I do not use a public share link as a family ACL. Links leak in group chats. I use accounts. I accept that I am now the helpdesk. That is the price of the closet box. If I do not want to be the helpdesk, I stay on iCloud and I live with the uncle who cannot join.

Conflicts, versions, and the iPad that sleeps

Both systems grow conflict copies when two people edit a Pages or Office file. Nextcloud’s versions are a comfort if you know where they live. iCloud’s are a comfort if you stay in Apple apps. The iPad that sleeps mid-upload is a Nextcloud classic: a partial file, a client that retries, a duplicate. The iCloud version is a file that stays “waiting” until the iPad sees power and Wi-Fi. Neither is encryption. Both look like encryption to a user who only sees a file that will not open.

I tell people to put finished PDFs in the share, not living documents, if the audience is mixed-skill. Living documents stay in one editor. The share is the envelope. That rule prevents more pain than any E2EE toggle.

The decision

Pick iCloud Drive when the family is Apple-shaped and you want Files to be boring. Pick Nextcloud when you need a non-Apple person or you need the disk in the house. Do not pick Nextcloud E2EE for the folder grandma opens from Files. That encryption is real. The break is also real. A camp form that cannot be attached is not more secure. It is late.

If your threat model needs zero-knowledge on a VPS, keep E2EE and keep those users in the official client. Teach them that Files is not the door. Write that sentence in the family chat once, because you will not be in the parking lot. If you cannot teach that, you do not have that threat model. You have a slogan. The Files app will grade the slogan in public, at the gate, with a child waiting in the car.