diff --git a/main/commons/src/main/java/org/cryptomator/common/settings/Settings.java b/main/commons/src/main/java/org/cryptomator/common/settings/Settings.java
index 5ef5df1c4..a2721f4d3 100644
--- a/main/commons/src/main/java/org/cryptomator/common/settings/Settings.java
+++ b/main/commons/src/main/java/org/cryptomator/common/settings/Settings.java
@@ -10,8 +10,6 @@ package org.cryptomator.common.settings;
 
 import java.util.function.Consumer;
 
-import org.apache.commons.lang3.SystemUtils;
-
 import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.IntegerProperty;
 import javafx.beans.property.SimpleBooleanProperty;
diff --git a/main/keychain/pom.xml b/main/keychain/pom.xml
index e8e2cc871..89deb4984 100644
--- a/main/keychain/pom.xml
+++ b/main/keychain/pom.xml
@@ -17,10 +17,6 @@
 			<groupId>com.google.code.gson</groupId>
 			<artifactId>gson</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>commons-codec</groupId>
-			<artifactId>commons-codec</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.cryptomator</groupId>
 			<artifactId>jni</artifactId>
diff --git a/main/keychain/src/main/java/org/cryptomator/keychain/WindowsProtectedKeychainAccess.java b/main/keychain/src/main/java/org/cryptomator/keychain/WindowsProtectedKeychainAccess.java
index 5527b0b27..f31536aff 100644
--- a/main/keychain/src/main/java/org/cryptomator/keychain/WindowsProtectedKeychainAccess.java
+++ b/main/keychain/src/main/java/org/cryptomator/keychain/WindowsProtectedKeychainAccess.java
@@ -18,7 +18,6 @@ import java.io.Writer;
 import java.lang.reflect.Type;
 import java.nio.ByteBuffer;
 import java.nio.CharBuffer;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.NoSuchFileException;
@@ -32,13 +31,13 @@ import java.util.UUID;
 
 import javax.inject.Inject;
 
-import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.jni.WinDataProtection;
 import org.cryptomator.jni.WinFunctions;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.common.io.BaseEncoding;
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonDeserializationContext;
@@ -179,16 +178,16 @@ class WindowsProtectedKeychainAccess implements KeychainAccessStrategy {
 
 	private static class ByteArrayJsonAdapter implements JsonSerializer<byte[]>, JsonDeserializer<byte[]> {
 
-		private static final Base64 BASE64 = new Base64();
+		private static final BaseEncoding BASE64 = BaseEncoding.base64();
 
 		@Override
 		public byte[] deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context) throws JsonParseException {
-			return BASE64.decode(json.getAsString().getBytes(StandardCharsets.UTF_8));
+			return BASE64.decode(json.getAsString());
 		}
 
 		@Override
 		public JsonElement serialize(byte[] src, Type typeOfSrc, JsonSerializationContext context) {
-			return new JsonPrimitive(new String(BASE64.encode(src), StandardCharsets.UTF_8));
+			return new JsonPrimitive(BASE64.encode(src));
 		}
 
 	}
diff --git a/main/pom.xml b/main/pom.xml
index 73ed929b6..16514ad82 100644
--- a/main/pom.xml
+++ b/main/pom.xml
@@ -28,21 +28,24 @@
 		<cryptomator.cryptofs.version>1.4.0</cryptomator.cryptofs.version>
 		<cryptomator.webdav.version>0.6.1</cryptomator.webdav.version>
 		<cryptomator.jni.version>1.0.2</cryptomator.jni.version>
+		
+		<commons-io.version>2.5</commons-io.version>
+		<commons-lang3.version>3.6</commons-lang3.version>
+		<httpclient.version>4.5.3</httpclient.version>
+		
+		<easybind.version>1.0.3</easybind.version>
+		
+		<guava.version>22.0</guava.version>
+		<dagger.version>2.11</dagger.version>
+		<gson.version>2.8.1</gson.version>
+		
 		<slf4j.version>1.7.25</slf4j.version>
 		<logback.version>1.2.2</logback.version>
+		
 		<junit.version>4.12</junit.version>
 		<junit.hierarchicalrunner.version>4.12.1</junit.hierarchicalrunner.version>
-		<hamcrest.version>1.3</hamcrest.version> <!-- keep in sync with version required by JUnit -->
-		<commons-io.version>2.4</commons-io.version>
-		<commons-collections.version>4.0</commons-collections.version>
-		<commons-lang3.version>3.5</commons-lang3.version>
-		<commons-codec.version>1.10</commons-codec.version>
-		<httpclient.version>4.5.3</httpclient.version>
 		<mockito.version>2.7.21</mockito.version>
-		<dagger.version>2.11</dagger.version>
-		<easybind.version>1.0.3</easybind.version>
-		<guava.version>22.0</guava.version>
-		<gson.version>2.8.0</gson.version>
+		<hamcrest.version>1.3</hamcrest.version> <!-- keep in sync with version required by JUnit -->
 	</properties>
 
 	<repositories>
@@ -126,27 +129,17 @@
 				<version>${logback.version}</version>
 			</dependency>
 
-			<!-- commons -->
+			<!-- Apache Commons -->
 			<dependency>
 				<groupId>commons-io</groupId>
 				<artifactId>commons-io</artifactId>
 				<version>${commons-io.version}</version>
 			</dependency>
-			<dependency>
-				<groupId>org.apache.commons</groupId>
-				<artifactId>commons-collections4</artifactId>
-				<version>${commons-collections.version}</version>
-			</dependency>
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-lang3</artifactId>
 				<version>${commons-lang3.version}</version>
 			</dependency>
-			<dependency>
-				<groupId>commons-codec</groupId>
-				<artifactId>commons-codec</artifactId>
-				<version>${commons-codec.version}</version>
-			</dependency>
 			<dependency>
 				<groupId>org.apache.httpcomponents</groupId>
 				<artifactId>httpclient</artifactId>
@@ -160,27 +153,17 @@
 				<version>${easybind.version}</version>
 			</dependency>
 
-			<!-- Guava -->
+			<!-- Google -->
 			<dependency>
 				<groupId>com.google.guava</groupId>
 				<artifactId>guava</artifactId>
 				<version>${guava.version}</version>
 			</dependency>
-
-			<!-- DI -->
 			<dependency>
 				<groupId>com.google.dagger</groupId>
 				<artifactId>dagger</artifactId>
 				<version>${dagger.version}</version>
 			</dependency>
-			<dependency>
-				<groupId>com.google.dagger</groupId>
-				<artifactId>dagger-compiler</artifactId>
-				<version>${dagger.version}</version>
-				<scope>provided</scope>
-			</dependency>
-
-			<!-- JSON -->
 			<dependency>
 				<groupId>com.google.code.gson</groupId>
 				<artifactId>gson</artifactId>
@@ -281,7 +264,7 @@
 			<plugins>
 				<plugin>
 					<artifactId>maven-dependency-plugin</artifactId>
-					<version>3.0.0</version>
+					<version>3.0.1</version>
 					<executions>
 						<execution>
 							<id>copy-libs</id>
diff --git a/main/ui/pom.xml b/main/ui/pom.xml
index d9151ee7b..537358e27 100644
--- a/main/ui/pom.xml
+++ b/main/ui/pom.xml
@@ -62,10 +62,6 @@
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-lang3</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>org.apache.commons</groupId>
-			<artifactId>commons-collections4</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.apache.httpcomponents</groupId>
 			<artifactId>httpclient</artifactId>
diff --git a/main/ui/src/main/java/org/cryptomator/ui/l10n/Localization.java b/main/ui/src/main/java/org/cryptomator/ui/l10n/Localization.java
index b4e0d6a78..299392098 100644
--- a/main/ui/src/main/java/org/cryptomator/ui/l10n/Localization.java
+++ b/main/ui/src/main/java/org/cryptomator/ui/l10n/Localization.java
@@ -22,11 +22,12 @@ import java.util.ResourceBundle;
 import javax.inject.Inject;
 import javax.inject.Singleton;
 
-import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.common.collect.Sets;
+
 @Singleton
 public class Localization extends ResourceBundle {
 
@@ -88,7 +89,7 @@ public class Localization extends ResourceBundle {
 
 	@Override
 	public Enumeration<String> getKeys() {
-		Collection<String> keys = CollectionUtils.union(localized.keySet(), fallback.keySet());
+		Collection<String> keys = Sets.union(localized.keySet(), fallback.keySet());
 		return Collections.enumeration(keys);
 	}