Merge branch 'develop' into release/1.6.0

Add Vault Health Check

Fixes #312 and fixes #1224.

.github/workflows/build.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-java@v1
         with:
-          java-version: 14
+          java-version: 16
       - uses: actions/cache@v1
         with:
           path: ~/.m2/repository
@@ -25,12 +25,13 @@ jobs:
       - name: Build and Test
         run: mvn -B install --file main/pom.xml -Pcoverage
       - name: Run Codacy Coverage Reporter
+        if: github.repository == 'cryptomator/cryptomator'
         run: |
           curl -o ~/codacy-coverage-reporter.jar https://repo.maven.apache.org/maven2/com/codacy/codacy-coverage-reporter/7.1.0/codacy-coverage-reporter-7.1.0-assembly.jar
-          $JAVA_HOME/bin/java -jar ~/codacy-coverage-reporter.jar report -l Java -r main/commons/target/site/jacoco/jacoco.xml --partial
-          $JAVA_HOME/bin/java -jar ~/codacy-coverage-reporter.jar report -l Java -r main/ui/target/site/jacoco/jacoco.xml --partial
-          $JAVA_HOME/bin/java -jar ~/codacy-coverage-reporter.jar report -l Java -r main/launcher/target/site/jacoco/jacoco.xml --partial
-          $JAVA_HOME/bin/java -jar ~/codacy-coverage-reporter.jar final
+          $JAVA_HOME/bin/java --illegal-access=permit -jar ~/codacy-coverage-reporter.jar report -l Java -r main/commons/target/site/jacoco/jacoco.xml --partial
+          $JAVA_HOME/bin/java --illegal-access=permit -jar ~/codacy-coverage-reporter.jar report -l Java -r main/ui/target/site/jacoco/jacoco.xml --partial
+          $JAVA_HOME/bin/java --illegal-access=permit -jar ~/codacy-coverage-reporter.jar report -l Java -r main/launcher/target/site/jacoco/jacoco.xml --partial
+          $JAVA_HOME/bin/java --illegal-access=permit -jar ~/codacy-coverage-reporter.jar final
         env:
           CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
       - name: Assemble buildkit-linux.zip
@@ -59,7 +60,7 @@ jobs:
     name: Draft a Release on GitHub Releases
     runs-on: ubuntu-latest
     needs: build
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/') && github.repository == 'cryptomator/cryptomator'
     steps:
       - name: Download buildkit-linux.zip
         uses: actions/download-artifact@v1
@@ -86,6 +87,21 @@ jobs:
           release_name: ${{ github.ref }}
           body: |
             :construction: Work in Progress
+
+            TODO:
+            * [ ] add Linux appimage, zsync file and signature file
+            * [ ] add Windows installer and signature file
+            * [ ] add MacOs disk image and signature file
+
+            ## What's new
+
+            ## Bugfixes
+
+            ## Misc
+
+            ---
+
+            :scroll: A complete list of closed issues is available [here](LINK)
           draft: true
           prerelease: false
       - name: Upload buildkit-linux.zip to GitHub Releases

.gitignore

@@ -21,5 +21,6 @@ pom.xml.versionsBackup
 .idea/compiler.xml
 .idea/encodings.xml
 .idea/jarRepositories.xml
+.idea/uiDesigner.xml
 .idea/**/libraries/
 *.iml

.idea/misc.xml

@@ -8,7 +8,7 @@
       </list>
     </option>
   </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_14" default="false" project-jdk-name="14" project-jdk-type="JavaSDK">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_16" project-jdk-name="16" project-jdk-type="JavaSDK">
     <output url="file://$PROJECT_DIR$/out" />
   </component>
 </project>

README.md

@@ -2,7 +2,7 @@
 
 [![Build](https://github.com/cryptomator/cryptomator/workflows/Build/badge.svg)](https://github.com/cryptomator/cryptomator/actions?query=workflow%3ABuild)
 [![Known Vulnerabilities](https://snyk.io/test/github/cryptomator/cryptomator/badge.svg?targetFile=main%2Fpom.xml)](https://snyk.io/test/github/cryptomator/cryptomator?targetFile=main%2Fpom.xml)
-[![Codacy Badge](https://api.codacy.com/project/badge/Grade/2a0adf3cec6a4143b91035d3924178f1)](https://www.codacy.com/app/cryptomator/cryptomator?utm_source=github.com&utm_medium=referral&utm_content=cryptomator/cryptomator&utm_campaign=Badge_Grade)
+[![Codacy Badge](https://app.codacy.com/project/badge/Grade/2a0adf3cec6a4143b91035d3924178f1)](https://www.codacy.com/gh/cryptomator/cryptomator/dashboard)
 [![Twitter](https://img.shields.io/badge/twitter-@Cryptomator-blue.svg?style=flat)](http://twitter.com/Cryptomator)
 [![Crowdin](https://badges.crowdin.net/cryptomator/localized.svg)](https://translate.cryptomator.org/)
 [![Latest Release](https://img.shields.io/github/release/cryptomator/cryptomator.svg)](https://github.com/cryptomator/cryptomator/releases/latest)
@@ -17,11 +17,26 @@ Cryptomator is provided free of charge as an open-source project despite the hig
 
 ### Gold Sponsors
 
-[<img src="https://cryptomator.org/img/sponsors/geewhiz.svg" alt="gee-whiz" height="96">](https://www.gee-whiz.de/)
+<table>
+  <tbody>
+    <tr>
+      <td><a href="https://www.gee-whiz.de/"><img src="https://cryptomator.org/img/sponsors/geewhiz.svg" alt="gee-whiz" height="80"></a></td>
+      <td><a href="https://proxy-hub.com/"><img src="https://cryptomator.org/img/sponsors/proxyhub.svg" alt="Proxy-Hub" height="80"></a></td>
+    </tr>
+  </tbody>
+</table>
 
 ### Silver Sponsors
 
-[![TheBestVPN](https://cryptomator.org/img/sponsors/thebestvpn.png)](https://thebestvpn.com/)
+<table>
+  <tbody>
+    <tr>
+      <td><a href="https://thebestvpn.com/"><img src="https://cryptomator.org/img/sponsors/thebestvpn@2x.png" alt="TheBestVPN" height="64"></a></td>
+    </tr>
+  </tbody>
+</table>
+
+- [Jameson Lopp](https://www.lopp.net/)
 
 ---
 
@@ -33,7 +48,7 @@ Download native binaries of Cryptomator on [cryptomator.org](https://cryptomator
 
 ## Features
 
-- Works with Dropbox, Google Drive, OneDrive, ownCloud, Nextcloud and any other cloud storage service which synchronizes with a local directory
+- Works with Dropbox, Google Drive, OneDrive, MEGA, pCloud, ownCloud, Nextcloud and any other cloud storage service which synchronizes with a local directory
 - Open Source means: No backdoors, control is better than trust
 - Client-side: No accounts, no data shared with any online service
 - Totally transparent: Just work on the virtual drive as if it were a USB flash drive
@@ -65,7 +80,7 @@ For more information on the security details visit [cryptomator.org](https://doc
 
 ### Dependencies
 
-* JDK 14 (e.g. adoptopenjdk)
+* JDK 16 (e.g. adoptopenjdk)
 * Maven 3
 * Optional: OS-dependent build tools for native packaging (see [Windows](https://github.com/cryptomator/cryptomator-win), [OS X](https://github.com/cryptomator/cryptomator-osx), [Linux](https://github.com/cryptomator/builder-containers))
 

main/buildkit/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>org.cryptomator</groupId>
 		<artifactId>main</artifactId>
-		<version>1.6.0-SNAPSHOT</version>
+		<version>1.6.0</version>
 	</parent>
 	<artifactId>buildkit</artifactId>
 	<packaging>pom</packaging>

main/commons/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>org.cryptomator</groupId>
 		<artifactId>main</artifactId>
-		<version>1.6.0-SNAPSHOT</version>
+		<version>1.6.0</version>
 	</parent>
 	<artifactId>commons</artifactId>
 	<name>Cryptomator Commons</name>

main/commons/src/main/java/org/cryptomator/common/CommonsModule.java

@@ -15,6 +15,7 @@ import org.cryptomator.common.settings.SettingsProvider;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultComponent;
 import org.cryptomator.common.vaults.VaultListManager;
+import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
 import org.cryptomator.frontend.webdav.WebDavServer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -25,6 +26,8 @@ import javafx.beans.binding.Binding;
 import javafx.beans.binding.Bindings;
 import javafx.collections.ObservableList;
 import java.net.InetSocketAddress;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.util.Comparator;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -47,10 +50,28 @@ public abstract class CommonsModule {
 	@Named("licensePublicKey")
 	static String provideLicensePublicKey() {
 		// in PEM format without the dash-escaped begin/end lines
-		return "MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQB7NfnqiZbg2KTmoflmZ71PbXru7oW" //
-				+ "fmnV2yv3eDjlDfGruBrqz9TtXBZV/eYWt31xu1osIqaT12lKBvZ511aaAkIBeOEV" //
-				+ "gwcBIlJr6kUw7NKzeJt7r2rrsOyQoOG2nWc/Of/NBqA3mIZRHk5Aq1YupFdD26QE" //
-				+ "r0DzRyj4ixPIt38CQB8=";
+		return """
+				MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQB7NfnqiZbg2KTmoflmZ71PbXru7oW\
+				fmnV2yv3eDjlDfGruBrqz9TtXBZV/eYWt31xu1osIqaT12lKBvZ511aaAkIBeOEV\
+				gwcBIlJr6kUw7NKzeJt7r2rrsOyQoOG2nWc/Of/NBqA3mIZRHk5Aq1YupFdD26QE\
+				r0DzRyj4ixPIt38CQB8=\
+				""";
+	}
+
+	@Provides
+	@Singleton
+	static SecureRandom provideCSPRNG() {
+		try {
+			return SecureRandom.getInstanceStrong();
+		} catch (NoSuchAlgorithmException e) {
+			throw new IllegalStateException("A strong algorithm must exist in every Java platform.", e);
+		}
+	}
+
+	@Provides
+	@Singleton
+	static MasterkeyFileAccess provideMasterkeyFileAccess(SecureRandom csprng) {
+		return new MasterkeyFileAccess(Constants.PEPPER, csprng);
 	}
 
 	@Provides

main/commons/src/main/java/org/cryptomator/common/Constants.java

@@ -3,5 +3,8 @@ package org.cryptomator.common;
 public interface Constants {
 
 	String MASTERKEY_FILENAME = "masterkey.cryptomator";
+	String MASTERKEY_BACKUP_SUFFIX = ".bkup";
+	String VAULTCONFIG_FILENAME = "vault.cryptomator";
+	byte[] PEPPER = new byte[0];
 
 }

main/commons/src/main/java/org/cryptomator/common/LicenseChecker.java

@@ -33,8 +33,8 @@ class LicenseChecker {
 		try {
 			byte[] keyBytes = BaseEncoding.base64().decode(pemEncodedPublicKey);
 			PublicKey key = KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(keyBytes));
-			if (key instanceof ECPublicKey) {
-				return (ECPublicKey) key;
+			if (key instanceof ECPublicKey k) {
+				return k;
 			} else {
 				throw new IllegalStateException("Key not an EC public key.");
 			}

main/commons/src/main/java/org/cryptomator/common/keychain/KeychainManager.java

@@ -68,6 +68,11 @@ public class KeychainManager implements KeychainAccessProvider {
 		return keychain.getValue() != null;
 	}
 
+	@Override
+	public boolean isLocked() {
+		return keychain.getValue() == null || keychain.get().isLocked();
+	}
+
 	/**
 	 * Checks if the keychain knows a passphrase for the given key.
 	 * <p>

main/commons/src/main/java/org/cryptomator/common/settings/UiTheme.java

@@ -8,7 +8,7 @@ public enum UiTheme {
 	AUTOMATIC("preferences.general.theme.automatic");
 
 	public static UiTheme[] applicableValues() {
-		if (SystemUtils.IS_OS_MAC) {
+		if (SystemUtils.IS_OS_MAC || SystemUtils.IS_OS_WINDOWS) {
 			return values();
 		} else {
 			return new UiTheme[]{LIGHT, DARK};

main/commons/src/main/java/org/cryptomator/common/settings/VaultSettings.java

@@ -24,8 +24,6 @@ import java.nio.file.Path;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Random;
-import java.util.Set;
-import java.util.stream.Collectors;
 
 /**
  * The settings specific to a single vault.
@@ -37,7 +35,7 @@ public class VaultSettings {
 	public static final boolean DEFAULT_USES_INDIVIDUAL_MOUNTPATH = false;
 	public static final boolean DEFAULT_USES_READONLY_MODE = false;
 	public static final String DEFAULT_MOUNT_FLAGS = "";
-	public static final int DEFAULT_FILENAME_LENGTH_LIMIT = -1;
+	public static final int DEFAULT_MAX_CLEARTEXT_FILENAME_LENGTH = -1;
 	public static final WhenUnlocked DEFAULT_ACTION_AFTER_UNLOCK = WhenUnlocked.ASK;
 
 	private static final Random RNG = new Random();
@@ -52,7 +50,7 @@ public class VaultSettings {
 	private final StringProperty customMountPath = new SimpleStringProperty();
 	private final BooleanProperty usesReadOnlyMode = new SimpleBooleanProperty(DEFAULT_USES_READONLY_MODE);
 	private final StringProperty mountFlags = new SimpleStringProperty(DEFAULT_MOUNT_FLAGS);
-	private final IntegerProperty filenameLengthLimit = new SimpleIntegerProperty(DEFAULT_FILENAME_LENGTH_LIMIT);
+	private final IntegerProperty maxCleartextFilenameLength = new SimpleIntegerProperty(DEFAULT_MAX_CLEARTEXT_FILENAME_LENGTH);
 	private final ObjectProperty<WhenUnlocked> actionAfterUnlock = new SimpleObjectProperty<>(DEFAULT_ACTION_AFTER_UNLOCK);
 
 	private final StringBinding mountName;
@@ -63,7 +61,7 @@ public class VaultSettings {
 	}
 
 	Observable[] observables() {
-		return new Observable[]{path, displayName, winDriveLetter, unlockAfterStartup, revealAfterMount, useCustomMountPath, customMountPath, usesReadOnlyMode, mountFlags, filenameLengthLimit, actionAfterUnlock};
+		return new Observable[]{path, displayName, winDriveLetter, unlockAfterStartup, revealAfterMount, useCustomMountPath, customMountPath, usesReadOnlyMode, mountFlags, maxCleartextFilenameLength, actionAfterUnlock};
 	}
 
 	public static VaultSettings withRandomId() {
@@ -152,8 +150,8 @@ public class VaultSettings {
 		return mountFlags;
 	}
 
-	public IntegerProperty filenameLengthLimit() {
-		return filenameLengthLimit;
+	public IntegerProperty maxCleartextFilenameLength() {
+		return maxCleartextFilenameLength;
 	}
 
 	public ObjectProperty<WhenUnlocked> actionAfterUnlock() {
@@ -173,8 +171,7 @@ public class VaultSettings {
 
 	@Override
 	public boolean equals(Object obj) {
-		if (obj instanceof VaultSettings && obj.getClass().equals(this.getClass())) {
-			VaultSettings other = (VaultSettings) obj;
+		if (obj instanceof VaultSettings other && obj.getClass().equals(this.getClass())) {
 			return Objects.equals(this.id, other.id);
 		} else {
 			return false;

main/commons/src/main/java/org/cryptomator/common/settings/VaultSettingsJsonAdapter.java

@@ -29,7 +29,7 @@ class VaultSettingsJsonAdapter {
 		out.name("customMountPath").value(value.customMountPath().get());
 		out.name("usesReadOnlyMode").value(value.usesReadOnlyMode().get());
 		out.name("mountFlags").value(value.mountFlags().get());
-		out.name("filenameLengthLimit").value(value.filenameLengthLimit().get());
+		out.name("maxCleartextFilenameLength").value(value.maxCleartextFilenameLength().get());
 		out.name("actionAfterUnlock").value(value.actionAfterUnlock().get().name());
 		out.endObject();
 	}
@@ -46,7 +46,7 @@ class VaultSettingsJsonAdapter {
 		boolean useCustomMountPath = VaultSettings.DEFAULT_USES_INDIVIDUAL_MOUNTPATH;
 		boolean usesReadOnlyMode = VaultSettings.DEFAULT_USES_READONLY_MODE;
 		String mountFlags = VaultSettings.DEFAULT_MOUNT_FLAGS;
-		int filenameLengthLimit = VaultSettings.DEFAULT_FILENAME_LENGTH_LIMIT;
+		int maxCleartextFilenameLength = VaultSettings.DEFAULT_MAX_CLEARTEXT_FILENAME_LENGTH;
 		WhenUnlocked actionAfterUnlock = VaultSettings.DEFAULT_ACTION_AFTER_UNLOCK;
 
 		in.beginObject();
@@ -64,7 +64,7 @@ class VaultSettingsJsonAdapter {
 				case "individualMountPath", "customMountPath" -> customMountPath = in.nextString();
 				case "usesReadOnlyMode" -> usesReadOnlyMode = in.nextBoolean();
 				case "mountFlags" -> mountFlags = in.nextString();
-				case "filenameLengthLimit" -> filenameLengthLimit = in.nextInt();
+				case "maxCleartextFilenameLength" -> maxCleartextFilenameLength = in.nextInt();
 				case "actionAfterUnlock" -> actionAfterUnlock = parseActionAfterUnlock(in.nextString());
 				default -> {
 					LOG.warn("Unsupported vault setting found in JSON: " + name);
@@ -88,7 +88,7 @@ class VaultSettingsJsonAdapter {
 		vaultSettings.customMountPath().set(customMountPath);
 		vaultSettings.usesReadOnlyMode().set(usesReadOnlyMode);
 		vaultSettings.mountFlags().set(mountFlags);
-		vaultSettings.filenameLengthLimit().set(filenameLengthLimit);
+		vaultSettings.maxCleartextFilenameLength().set(maxCleartextFilenameLength);
 		vaultSettings.actionAfterUnlock().set(actionAfterUnlock);
 		return vaultSettings;
 	}

main/commons/src/main/java/org/cryptomator/common/vaults/DokanyVolume.java

@@ -5,15 +5,15 @@ import org.cryptomator.common.mountpoint.MountPointChooser;
 import org.cryptomator.common.settings.VaultSettings;
 import org.cryptomator.common.settings.VolumeImpl;
 import org.cryptomator.cryptofs.CryptoFileSystem;
+import org.cryptomator.frontend.dokany.DokanyMountFailedException;
 import org.cryptomator.frontend.dokany.Mount;
 import org.cryptomator.frontend.dokany.MountFactory;
-import org.cryptomator.frontend.dokany.MountFailedException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.inject.Named;
-import java.util.concurrent.ExecutorService;
+import java.util.function.Consumer;
 
 public class DokanyVolume extends AbstractVolume {
 
@@ -22,15 +22,13 @@ public class DokanyVolume extends AbstractVolume {
 	private static final String FS_TYPE_NAME = "CryptomatorFS";
 
 	private final VaultSettings vaultSettings;
-	private final MountFactory mountFactory;
 
 	private Mount mount;
 
 	@Inject
-	public DokanyVolume(VaultSettings vaultSettings, ExecutorService executorService, @Named("orderedMountPointChoosers") Iterable<MountPointChooser> choosers) {
+	public DokanyVolume(VaultSettings vaultSettings, @Named("orderedMountPointChoosers") Iterable<MountPointChooser> choosers) {
 		super(choosers);
 		this.vaultSettings = vaultSettings;
-		this.mountFactory = new MountFactory(executorService);
 	}
 
 	@Override
@@ -39,11 +37,11 @@ public class DokanyVolume extends AbstractVolume {
 	}
 
 	@Override
-	public void mount(CryptoFileSystem fs, String mountFlags) throws InvalidMountPointException, VolumeException {
+	public void mount(CryptoFileSystem fs, String mountFlags, Consumer<Throwable> onExitAction) throws InvalidMountPointException, VolumeException {
 		this.mountPoint = determineMountPoint();
 		try {
-			this.mount = mountFactory.mount(fs.getPath("/"), mountPoint, vaultSettings.mountName().get(), FS_TYPE_NAME, mountFlags.strip());
-		} catch (MountFailedException e) {
+			this.mount = MountFactory.mount(fs.getPath("/"), mountPoint, vaultSettings.mountName().get(), FS_TYPE_NAME, mountFlags.strip(), onExitAction);
+		} catch (DokanyMountFailedException e) {
 			if (vaultSettings.getCustomMountPath().isPresent()) {
 				LOG.warn("Failed to mount vault into {}. Is this directory currently accessed by another process (e.g. Windows Explorer)?", mountPoint);
 			}

main/commons/src/main/java/org/cryptomator/common/vaults/FuseVolume.java

@@ -6,8 +6,8 @@ import org.cryptomator.common.mountpoint.InvalidMountPointException;
 import org.cryptomator.common.mountpoint.MountPointChooser;
 import org.cryptomator.common.settings.VolumeImpl;
 import org.cryptomator.cryptofs.CryptoFileSystem;
-import org.cryptomator.frontend.fuse.mount.CommandFailedException;
 import org.cryptomator.frontend.fuse.mount.EnvironmentVariables;
+import org.cryptomator.frontend.fuse.mount.FuseMountException;
 import org.cryptomator.frontend.fuse.mount.FuseMountFactory;
 import org.cryptomator.frontend.fuse.mount.FuseNotSupportedException;
 import org.cryptomator.frontend.fuse.mount.Mount;
@@ -20,6 +20,7 @@ import javax.inject.Named;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.function.Consumer;
 import java.util.regex.Pattern;
 
 public class FuseVolume extends AbstractVolume {
@@ -35,20 +36,21 @@ public class FuseVolume extends AbstractVolume {
 	}
 
 	@Override
-	public void mount(CryptoFileSystem fs, String mountFlags) throws InvalidMountPointException, VolumeException {
+	public void mount(CryptoFileSystem fs, String mountFlags, Consumer<Throwable> onExitAction) throws InvalidMountPointException, VolumeException {
 		this.mountPoint = determineMountPoint();
-
-		mount(fs.getPath("/"), mountFlags);
+		mount(fs.getPath("/"), mountFlags, onExitAction);
 	}
 
-	private void mount(Path root, String mountFlags) throws VolumeException {
+	private void mount(Path root, String mountFlags, Consumer<Throwable> onExitAction) throws VolumeException {
 		try {
 			Mounter mounter = FuseMountFactory.getMounter();
 			EnvironmentVariables envVars = EnvironmentVariables.create() //
-					.withFlags(splitFlags(mountFlags)).withMountPoint(mountPoint) //
+					.withFlags(splitFlags(mountFlags)) //
+					.withMountPoint(mountPoint) //
+					.withFileNameTranscoder(mounter.defaultFileNameTranscoder()) //
 					.build();
-			this.mount = mounter.mount(root, envVars);
-		} catch (CommandFailedException | FuseNotSupportedException e) {
+			this.mount = mounter.mount(root, envVars, onExitAction);
+		} catch ( FuseMountException | FuseNotSupportedException e) {
 			throw new VolumeException("Unable to mount Filesystem", e);
 		}
 	}
@@ -89,8 +91,7 @@ public class FuseVolume extends AbstractVolume {
 	public synchronized void unmountForced() throws VolumeException {
 		try {
 			mount.unmountForced();
-			mount.close();
-		} catch (CommandFailedException e) {
+		} catch (FuseMountException e) {
 			throw new VolumeException(e);
 		}
 		cleanupMountPoint();
@@ -100,8 +101,7 @@ public class FuseVolume extends AbstractVolume {
 	public synchronized void unmount() throws VolumeException {
 		try {
 			mount.unmount();
-			mount.close();
-		} catch (CommandFailedException e) {
+		} catch (FuseMountException e) {
 			throw new VolumeException(e);
 		}
 		cleanupMountPoint();

main/commons/src/main/java/org/cryptomator/common/vaults/LockNotCompletedException.java

@@ -0,0 +1,12 @@
+package org.cryptomator.common.vaults;
+
+public class LockNotCompletedException extends Exception {
+
+	public LockNotCompletedException(String reason) {
+		super(reason);
+	}
+
+	public LockNotCompletedException(Throwable cause) {
+		super(cause);
+	}
+}

main/commons/src/main/java/org/cryptomator/common/vaults/Vault.java

@@ -17,10 +17,12 @@ import org.cryptomator.cryptofs.CryptoFileSystem;
 import org.cryptomator.cryptofs.CryptoFileSystemProperties;
 import org.cryptomator.cryptofs.CryptoFileSystemProperties.FileSystemFlags;
 import org.cryptomator.cryptofs.CryptoFileSystemProvider;
-import org.cryptomator.cryptofs.common.Constants;
+import org.cryptomator.cryptofs.VaultConfig;
+import org.cryptomator.cryptofs.VaultConfig.UnverifiedVaultConfig;
 import org.cryptomator.cryptofs.common.FileSystemCapabilityChecker;
 import org.cryptomator.cryptolib.api.CryptoException;
-import org.cryptomator.cryptolib.api.InvalidPassphraseException;
+import org.cryptomator.cryptolib.api.MasterkeyLoader;
+import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -35,28 +37,29 @@ import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.SimpleBooleanProperty;
 import java.io.IOException;
-import java.nio.file.NoSuchFileException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.EnumSet;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 
-import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
-
 @PerVault
 public class Vault {
 
 	private static final Logger LOG = LoggerFactory.getLogger(Vault.class);
 	private static final Path HOME_DIR = Paths.get(SystemUtils.USER_HOME);
+	private static final int UNLIMITED_FILENAME_LENGTH = Integer.MAX_VALUE;
 
 	private final VaultSettings vaultSettings;
 	private final Provider<Volume> volumeProvider;
 	private final StringBinding defaultMountFlags;
 	private final AtomicReference<CryptoFileSystem> cryptoFileSystem;
-	private final ObjectProperty<VaultState> state;
+	private final VaultState state;
 	private final ObjectProperty<Exception> lastKnownException;
 	private final VaultStats stats;
 	private final StringBinding displayName;
@@ -74,7 +77,7 @@ public class Vault {
 	private volatile Volume volume;
 
 	@Inject
-	Vault(VaultSettings vaultSettings, Provider<Volume> volumeProvider, @DefaultMountFlags StringBinding defaultMountFlags, AtomicReference<CryptoFileSystem> cryptoFileSystem, ObjectProperty<VaultState> state, @Named("lastKnownException") ObjectProperty<Exception> lastKnownException, VaultStats stats) {
+	Vault(VaultSettings vaultSettings, Provider<Volume> volumeProvider, @DefaultMountFlags StringBinding defaultMountFlags, AtomicReference<CryptoFileSystem> cryptoFileSystem, VaultState state, @Named("lastKnownException") ObjectProperty<Exception> lastKnownException, VaultStats stats) {
 		this.vaultSettings = vaultSettings;
 		this.volumeProvider = volumeProvider;
 		this.defaultMountFlags = defaultMountFlags;
@@ -99,24 +102,31 @@ public class Vault {
 	// Commands
 	// ********************************************************************************/
 
-	private CryptoFileSystem createCryptoFileSystem(CharSequence passphrase) throws NoSuchFileException, IOException, InvalidPassphraseException, CryptoException {
+	private CryptoFileSystem createCryptoFileSystem(MasterkeyLoader keyLoader) throws IOException, MasterkeyLoadingFailedException {
 		Set<FileSystemFlags> flags = EnumSet.noneOf(FileSystemFlags.class);
 		if (vaultSettings.usesReadOnlyMode().get()) {
 			flags.add(FileSystemFlags.READONLY);
+		} else if(vaultSettings.maxCleartextFilenameLength().get() == -1) {
+			LOG.debug("Determining cleartext filename length limitations...");
+			var checker = new FileSystemCapabilityChecker();
+			int shorteningThreshold = getUnverifiedVaultConfig().allegedShorteningThreshold();
+			int ciphertextLimit = checker.determineSupportedCiphertextFileNameLength(getPath());
+			if (ciphertextLimit < shorteningThreshold) {
+				int cleartextLimit = checker.determineSupportedCleartextFileNameLength(getPath());
+				vaultSettings.maxCleartextFilenameLength().set(cleartextLimit);
+			} else {
+				vaultSettings.maxCleartextFilenameLength().setValue(UNLIMITED_FILENAME_LENGTH);
+			}
 		}
-		if (!flags.contains(FileSystemFlags.READONLY) && vaultSettings.filenameLengthLimit().get() == -1) {
-			LOG.debug("Determining file name length limitations...");
-			int limit = new FileSystemCapabilityChecker().determineSupportedFileNameLength(getPath());
-			vaultSettings.filenameLengthLimit().set(limit);
-			LOG.info("Storing file name length limit of {}", limit);
+
+		if (vaultSettings.maxCleartextFilenameLength().get() < UNLIMITED_FILENAME_LENGTH) {
+			LOG.warn("Limiting cleartext filename length on this device to {}.", vaultSettings.maxCleartextFilenameLength().get());
 		}
-		assert vaultSettings.filenameLengthLimit().get() > 0;
+
 		CryptoFileSystemProperties fsProps = CryptoFileSystemProperties.cryptoFileSystemProperties() //
-				.withPassphrase(passphrase) //
+				.withKeyLoader(keyLoader) //
 				.withFlags(flags) //
-				.withMasterkeyFilename(MASTERKEY_FILENAME) //
-				.withMaxPathLength(vaultSettings.filenameLengthLimit().get() + Constants.MAX_ADDITIONAL_PATH_LENGTH) //
-				.withMaxNameLength(vaultSettings.filenameLengthLimit().get()) //
+				.withMaxCleartextNameLength(vaultSettings.maxCleartextFilenameLength().get()) //
 				.build();
 		return CryptoFileSystemProvider.newFileSystem(getPath(), fsProps);
 	}
@@ -133,29 +143,51 @@ public class Vault {
 		}
 	}
 
-	public synchronized void unlock(CharSequence passphrase) throws CryptoException, IOException, VolumeException, InvalidMountPointException {
-		if (cryptoFileSystem.get() == null) {
-			CryptoFileSystem fs = createCryptoFileSystem(passphrase);
-			cryptoFileSystem.set(fs);
-			try {
-				volume = volumeProvider.get();
-				volume.mount(fs, getEffectiveMountFlags());
-			} catch (Exception e) {
-				destroyCryptoFileSystem();
-				throw e;
-			}
-		} else {
+	public synchronized void unlock(MasterkeyLoader keyLoader) throws CryptoException, IOException, VolumeException, InvalidMountPointException {
+		if (cryptoFileSystem.get() != null) {
 			throw new IllegalStateException("Already unlocked.");
 		}
+		CryptoFileSystem fs = createCryptoFileSystem(keyLoader);
+		boolean success = false;
+		try {
+			cryptoFileSystem.set(fs);
+			volume = volumeProvider.get();
+			volume.mount(fs, getEffectiveMountFlags(), this::lockOnVolumeExit);
+			success = true;
+		} finally {
+			if (!success) {
+				destroyCryptoFileSystem();
+			}
+		}
 	}
 
-	public synchronized void lock(boolean forced) throws VolumeException {
+	private void lockOnVolumeExit(Throwable t) {
+		LOG.info("Unmounted vault '{}'", getDisplayName());
+		destroyCryptoFileSystem();
+		state.set(VaultState.Value.LOCKED);
+		if (t != null) {
+			LOG.warn("Unexpected unmount and lock of vault " + getDisplayName(), t);
+		}
+	}
+
+	public synchronized void lock(boolean forced) throws VolumeException, LockNotCompletedException {
+		//initiate unmount
 		if (forced && volume.supportsForcedUnmount()) {
 			volume.unmountForced();
 		} else {
 			volume.unmount();
 		}
-		destroyCryptoFileSystem();
+
+		//wait for lockOnVolumeExit to be executed
+		try {
+			boolean locked = state.awaitState(VaultState.Value.LOCKED, 3000, TimeUnit.MILLISECONDS);
+			if (!locked) {
+				throw new LockNotCompletedException("Locking of vault " + this.getDisplayName() + " still in progress.");
+			}
+		} catch (InterruptedException e) {
+			Thread.currentThread().interrupt();
+			throw new LockNotCompletedException(e);
+		}
 	}
 
 	public void reveal(Volume.Revealer vaultRevealer) throws VolumeException {
@@ -166,16 +198,12 @@ public class Vault {
 	// Observable Properties
 	// *******************************************************************************
 
-	public ObjectProperty<VaultState> stateProperty() {
+	public VaultState stateProperty() {
 		return state;
 	}
 
-	public VaultState getState() {
-		return state.get();
-	}
-
-	public void setState(VaultState value) {
-		state.setValue(value);
+	public VaultState.Value getState() {
+		return state.getValue();
 	}
 
 	public ObjectProperty<Exception> lastKnownExceptionProperty() {
@@ -195,7 +223,7 @@ public class Vault {
 	}
 
 	public boolean isLocked() {
-		return state.get() == VaultState.LOCKED;
+		return state.get() == VaultState.Value.LOCKED;
 	}
 
 	public BooleanBinding processingProperty() {
@@ -203,7 +231,7 @@ public class Vault {
 	}
 
 	public boolean isProcessing() {
-		return state.get() == VaultState.PROCESSING;
+		return state.get() == VaultState.Value.PROCESSING;
 	}
 
 	public BooleanBinding unlockedProperty() {
@@ -211,7 +239,7 @@ public class Vault {
 	}
 
 	public boolean isUnlocked() {
-		return state.get() == VaultState.UNLOCKED;
+		return state.get() == VaultState.Value.UNLOCKED;
 	}
 
 	public BooleanBinding missingProperty() {
@@ -219,7 +247,7 @@ public class Vault {
 	}
 
 	public boolean isMissing() {
-		return state.get() == VaultState.MISSING;
+		return state.get() == VaultState.Value.MISSING;
 	}
 
 	public BooleanBinding needsMigrationProperty() {
@@ -227,7 +255,7 @@ public class Vault {
 	}
 
 	public boolean isNeedsMigration() {
-		return state.get() == VaultState.NEEDS_MIGRATION;
+		return state.get() == VaultState.Value.NEEDS_MIGRATION;
 	}
 
 	public BooleanBinding unknownErrorProperty() {
@@ -235,7 +263,7 @@ public class Vault {
 	}
 
 	public boolean isUnknownError() {
-		return state.get() == VaultState.ERROR;
+		return state.get() == VaultState.Value.ERROR;
 	}
 
 	public StringBinding displayNameProperty() {
@@ -251,7 +279,7 @@ public class Vault {
 	}
 
 	public String getAccessPoint() {
-		if (state.get() == VaultState.UNLOCKED) {
+		if (state.getValue() == VaultState.Value.UNLOCKED) {
 			assert volume != null;
 			return volume.getMountPoint().orElse(Path.of("")).toString();
 		} else {
@@ -299,6 +327,12 @@ public class Vault {
 		return stats;
 	}
 
+	public UnverifiedVaultConfig getUnverifiedVaultConfig() throws IOException {
+		Path configPath = getPath().resolve(org.cryptomator.common.Constants.VAULTCONFIG_FILENAME);
+		String token = Files.readString(configPath, StandardCharsets.US_ASCII);
+		return VaultConfig.decode(token);
+	}
+
 	public Observable[] observables() {
 		return new Observable[]{state};
 	}
@@ -355,8 +389,7 @@ public class Vault {
 
 	@Override
 	public boolean equals(Object obj) {
-		if (obj instanceof Vault && obj.getClass().equals(this.getClass())) {
-			final Vault other = (Vault) obj;
+		if (obj instanceof Vault other && obj.getClass().equals(this.getClass())) {
 			return Objects.equals(this.vaultSettings, other.vaultSettings);
 		} else {
 			return false;

main/commons/src/main/java/org/cryptomator/common/vaults/VaultComponent.java

@@ -26,7 +26,7 @@ public interface VaultComponent {
 		Builder vaultSettings(VaultSettings vaultSettings);
 
 		@BindsInstance
-		Builder initialVaultState(VaultState vaultState);
+		Builder initialVaultState(VaultState.Value vaultState);
 
 		@BindsInstance
 		Builder initialErrorCause(@Nullable @Named("lastKnownException") Exception initialErrorCause);

main/commons/src/main/java/org/cryptomator/common/vaults/VaultListChangeListener.java

@@ -22,10 +22,10 @@ class VaultListChangeListener implements ListChangeListener<Vault> {
 	public void onChanged(Change<? extends Vault> c) {
 		while (c.next()) {
 			if (c.wasAdded()) {
-				List<VaultSettings> addedSettings = c.getAddedSubList().stream().map(Vault::getVaultSettings).collect(Collectors.toList());
+				List<VaultSettings> addedSettings = c.getAddedSubList().stream().map(Vault::getVaultSettings).toList();
 				vaultSettingsList.addAll(c.getFrom(), addedSettings);
 			} else if (c.wasRemoved()) {
-				List<VaultSettings> removedSettings = c.getRemoved().stream().map(Vault::getVaultSettings).collect(Collectors.toList());
+				List<VaultSettings> removedSettings = c.getRemoved().stream().map(Vault::getVaultSettings).toList();
 				vaultSettingsList.removeAll(removedSettings);
 			}
 		}

main/commons/src/main/java/org/cryptomator/common/vaults/VaultListManager.java

@@ -11,6 +11,7 @@ package org.cryptomator.common.vaults;
 import org.cryptomator.common.settings.Settings;
 import org.cryptomator.common.settings.VaultSettings;
 import org.cryptomator.cryptofs.CryptoFileSystemProvider;
+import org.cryptomator.cryptofs.DirStructure;
 import org.cryptomator.cryptofs.migration.Migrators;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -20,14 +21,16 @@ import javax.inject.Singleton;
 import javafx.collections.FXCollections;
 import javafx.collections.ObservableList;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.util.Collection;
 import java.util.Optional;
 import java.util.ResourceBundle;
-import java.util.stream.Collectors;
 
 import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
+import static org.cryptomator.common.Constants.VAULTCONFIG_FILENAME;
+import static org.cryptomator.common.vaults.VaultState.Value.ERROR;
 
 @Singleton
 public class VaultListManager {
@@ -52,19 +55,18 @@ public class VaultListManager {
 		return vaultList;
 	}
 
-	public Vault add(Path pathToVault) throws NoSuchFileException {
+	public Vault add(Path pathToVault) throws IOException {
 		Path normalizedPathToVault = pathToVault.normalize().toAbsolutePath();
-		if (!CryptoFileSystemProvider.containsVault(normalizedPathToVault, MASTERKEY_FILENAME)) {
+		if (CryptoFileSystemProvider.checkDirStructureForVault(normalizedPathToVault, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME) == DirStructure.UNRELATED) {
 			throw new NoSuchFileException(normalizedPathToVault.toString(), null, "Not a vault directory");
 		}
-		Optional<Vault> alreadyExistingVault = get(normalizedPathToVault);
-		if (alreadyExistingVault.isPresent()) {
-			return alreadyExistingVault.get();
-		} else {
-			Vault newVault = create(newVaultSettings(normalizedPathToVault));
-			vaultList.add(newVault);
-			return newVault;
-		}
+
+		return get(normalizedPathToVault) //
+				.orElseGet(() -> {
+					Vault newVault = create(newVaultSettings(normalizedPathToVault));
+					vaultList.add(newVault);
+					return newVault;
+				});
 	}
 
 	private VaultSettings newVaultSettings(Path path) {
@@ -79,7 +81,7 @@ public class VaultListManager {
 	}
 
 	private void addAll(Collection<VaultSettings> vaultSettings) {
-		Collection<Vault> vaults = vaultSettings.stream().map(this::create).collect(Collectors.toList());
+		Collection<Vault> vaults = vaultSettings.stream().map(this::create).toList();
 		vaultList.addAll(vaults);
 	}
 
@@ -94,43 +96,45 @@ public class VaultListManager {
 	private Vault create(VaultSettings vaultSettings) {
 		VaultComponent.Builder compBuilder = vaultComponentBuilder.vaultSettings(vaultSettings);
 		try {
-			VaultState vaultState = determineVaultState(vaultSettings.path().get());
+			VaultState.Value vaultState = determineVaultState(vaultSettings.path().get());
 			compBuilder.initialVaultState(vaultState);
 		} catch (IOException e) {
 			LOG.warn("Failed to determine vault state for " + vaultSettings.path().get(), e);
-			compBuilder.initialVaultState(VaultState.ERROR);
+			compBuilder.initialVaultState(ERROR);
 			compBuilder.initialErrorCause(e);
 		}
 		return compBuilder.build().vault();
 	}
 
-	public static VaultState redetermineVaultState(Vault vault) {
-		VaultState previousState = vault.getState();
+	public static VaultState.Value redetermineVaultState(Vault vault) {
+		VaultState state = vault.stateProperty();
+		VaultState.Value previousState = state.getValue();
 		return switch (previousState) {
 			case LOCKED, NEEDS_MIGRATION, MISSING -> {
 				try {
-					VaultState determinedState = determineVaultState(vault.getPath());
-					vault.setState(determinedState);
+					var determinedState = determineVaultState(vault.getPath());
+					state.set(determinedState);
 					yield determinedState;
 				} catch (IOException e) {
 					LOG.warn("Failed to determine vault state for " + vault.getPath(), e);
-					vault.setState(VaultState.ERROR);
+					state.set(ERROR);
 					vault.setLastKnownException(e);
-					yield VaultState.ERROR;
+					yield ERROR;
 				}
 			}
 			case ERROR, UNLOCKED, PROCESSING -> previousState;
 		};
 	}
 
-	private static VaultState determineVaultState(Path pathToVault) throws IOException {
-		if (!CryptoFileSystemProvider.containsVault(pathToVault, MASTERKEY_FILENAME)) {
-			return VaultState.MISSING;
-		} else if (Migrators.get().needsMigration(pathToVault, MASTERKEY_FILENAME)) {
-			return VaultState.NEEDS_MIGRATION;
-		} else {
-			return VaultState.LOCKED;
+	private static VaultState.Value determineVaultState(Path pathToVault) throws IOException {
+		if (!Files.exists(pathToVault)) {
+			return VaultState.Value.MISSING;
 		}
+		return switch (CryptoFileSystemProvider.checkDirStructureForVault(pathToVault, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME)) {
+			case VAULT -> VaultState.Value.LOCKED;
+			case UNRELATED -> VaultState.Value.MISSING;
+			case MAYBE_LEGACY -> Migrators.get().needsMigration(pathToVault, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME) ? VaultState.Value.NEEDS_MIGRATION : VaultState.Value.MISSING;
+		};
 	}
 
 }

main/commons/src/main/java/org/cryptomator/common/vaults/VaultModule.java

@@ -40,12 +40,6 @@ public class VaultModule {
 		return new AtomicReference<>();
 	}
 
-	@Provides
-	@PerVault
-	public ObjectProperty<VaultState> provideVaultState(VaultState initialState) {
-		return new SimpleObjectProperty<>(initialState);
-	}
-
 	@Provides
 	@Named("lastKnownException")
 	@PerVault
@@ -53,7 +47,6 @@ public class VaultModule {
 		return new SimpleObjectProperty<>(initialErrorCause);
 	}
 
-
 	@Provides
 	public Volume provideVolume(Settings settings, WebDavVolume webDavVolume, FuseVolume fuseVolume, DokanyVolume dokanyVolume) {
 		VolumeImpl preferredImpl = settings.preferredVolumeImpl().get();
@@ -105,7 +98,6 @@ public class VaultModule {
 		flags.append(" -oatomic_o_trunc");
 		flags.append(" -oauto_xattr");
 		flags.append(" -oauto_cache");
-		flags.append(" -omodules=iconv,from_code=UTF-8,to_code=UTF-8-MAC"); // show files names in Unicode NFD encoding
 		flags.append(" -onoappledouble"); // vastly impacts performance for some reason...
 		flags.append(" -odefault_permissions"); // let the kernel assume permissions based on file attributes etc
 

main/commons/src/main/java/org/cryptomator/common/vaults/VaultState.java

@@ -1,34 +1,141 @@
 package org.cryptomator.common.vaults;
 
-public enum VaultState {
-	/**
-	 * No vault found at the provided path
-	 */
-	MISSING,
+import com.google.common.base.Preconditions;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.application.Platform;
+import javafx.beans.value.ObservableObjectValue;
+import javafx.beans.value.ObservableValueBase;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.concurrent.locks.Condition;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+@PerVault
+public class VaultState extends ObservableValueBase<VaultState.Value> implements ObservableObjectValue<VaultState.Value> {
+
+	private static final Logger LOG = LoggerFactory.getLogger(VaultState.class);
+
+	public enum Value {
+		/**
+		 * No vault found at the provided path
+		 */
+		MISSING,
+
+		/**
+		 * Vault requires migration to a newer vault format
+		 */
+		NEEDS_MIGRATION,
+
+		/**
+		 * Vault ready to be unlocked
+		 */
+		LOCKED,
+
+		/**
+		 * Vault in transition between two other states
+		 */
+		PROCESSING,
+
+		/**
+		 * Vault is unlocked
+		 */
+		UNLOCKED,
+
+		/**
+		 * Unknown state due to preceeding unrecoverable exceptions.
+		 */
+		ERROR;
+	}
+
+	private final AtomicReference<Value> value;
+	private final Lock lock = new ReentrantLock();
+	private final Condition valueChanged = lock.newCondition();
+
+	@Inject
+	public VaultState(VaultState.Value initialValue) {
+		this.value = new AtomicReference<>(initialValue);
+	}
+
+	@Override
+	public Value get() {
+		return getValue();
+	}
+
+	@Override
+	public Value getValue() {
+		return value.get();
+	}
 
 	/**
-	 * Vault requires migration to a newer vault format
+	 * Transitions from <code>fromState</code> to <code>toState</code>.
+	 *
+	 * @param fromState Previous state
+	 * @param toState New state
+	 * @return <code>true</code> if successful
 	 */
-	NEEDS_MIGRATION,
+	public boolean transition(Value fromState, Value toState) {
+		Preconditions.checkArgument(fromState != toState, "fromState must be different than toState");
+		boolean success = value.compareAndSet(fromState, toState);
+		if (success) {
+			fireValueChangedEvent();
+		} else {
+			LOG.debug("Failed transiting into state {}: Expected state was not{}.", fromState, toState);
+		}
+		return success;
+	}
+
+	public void set(Value newState) {
+		var oldState = value.getAndSet(newState);
+		if (oldState != newState) {
+			fireValueChangedEvent();
+		}
+	}
 
 	/**
-	 * Vault ready to be unlocked
+	 * Waits for the specified time, until the desired state is reached.
+	 *
+	 * @param desiredState what state to wait for
+	 * @param time the maximum time to wait
+	 * @param unit the time unit of the {@code time} argument
+	 * @return {@code false} if the waiting time detectably elapsed before reaching {@code desiredState}
+	 * @throws InterruptedException if the current thread is interrupted
 	 */
-	LOCKED,
+	public boolean awaitState(Value desiredState, long time, TimeUnit unit) throws InterruptedException {
+		lock.lock();
+		try {
+			long remaining = TimeUnit.NANOSECONDS.convert(time, unit);
+			while (value.get() != desiredState) {
+				if (remaining <= 0L) {
+					return false;
+				}
+				remaining = valueChanged.awaitNanos(remaining);
+			}
+			return true;
+		} finally {
+			lock.unlock();
+		}
+	}
 
-	/**
-	 * Vault in transition between two other states
-	 */
-	PROCESSING,
-
-	/**
-	 * Vault is unlocked
-	 */
-	UNLOCKED,
-
-	/**
-	 * Unknown state due to preceeding unrecoverable exceptions.
-	 */
-	ERROR;
+	private void signal() {
+		lock.lock();
+		try {
+			valueChanged.signalAll();
+		} finally {
+			lock.unlock();
+		}
+	}
 
+	@Override
+	protected void fireValueChangedEvent() {
+		signal();
+		if (Platform.isFxApplicationThread()) {
+			super.fireValueChangedEvent();
+		} else {
+			Platform.runLater(super::fireValueChangedEvent);
+		}
+	}
 }

main/commons/src/main/java/org/cryptomator/common/vaults/VaultStats.java

@@ -26,7 +26,7 @@ public class VaultStats {
 	private static final Logger LOG = LoggerFactory.getLogger(VaultStats.class);
 
 	private final AtomicReference<CryptoFileSystem> fs;
-	private final ObjectProperty<VaultState> state;
+	private final VaultState state;
 	private final ScheduledService<Optional<CryptoFileSystemStats>> updateService;
 	private final LongProperty bytesPerSecondRead = new SimpleLongProperty();
 	private final LongProperty bytesPerSecondWritten = new SimpleLongProperty();
@@ -41,7 +41,7 @@ public class VaultStats {
 	private final LongProperty filesWritten = new SimpleLongProperty();
 
 	@Inject
-	VaultStats(AtomicReference<CryptoFileSystem> fs, ObjectProperty<VaultState> state, ExecutorService executor) {
+	VaultStats(AtomicReference<CryptoFileSystem> fs, VaultState state, ExecutorService executor) {
 		this.fs = fs;
 		this.state = state;
 		this.updateService = new UpdateStatsService();
@@ -52,13 +52,13 @@ public class VaultStats {
 	}
 
 	private void vaultStateChanged(@SuppressWarnings("unused") Observable observable) {
-		if (VaultState.UNLOCKED.equals(state.get())) {
+		if (VaultState.Value.UNLOCKED == state.get()) {
 			assert fs.get() != null;
 			LOG.debug("start recording stats");
-			updateService.restart();
+			Platform.runLater(() -> updateService.restart());
 		} else {
 			LOG.debug("stop recording stats");
-			updateService.cancel();
+			Platform.runLater(() -> updateService.cancel());
 		}
 	}
 

main/commons/src/main/java/org/cryptomator/common/vaults/Volume.java

@@ -7,6 +7,8 @@ import org.cryptomator.cryptofs.CryptoFileSystem;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.util.Optional;
+import java.util.concurrent.CompletionStage;
+import java.util.function.Consumer;
 import java.util.stream.Stream;
 
 /**
@@ -32,7 +34,7 @@ public interface Volume {
 	 * @param fs
 	 * @throws IOException
 	 */
-	void mount(CryptoFileSystem fs, String mountFlags) throws IOException, VolumeException, InvalidMountPointException;
+	void mount(CryptoFileSystem fs, String mountFlags, Consumer<Throwable> onExitAction) throws IOException, VolumeException, InvalidMountPointException;
 
 	/**
 	 * Reveals the mounted volume.

main/commons/src/main/java/org/cryptomator/common/vaults/WebDavVolume.java

@@ -17,6 +17,7 @@ import java.net.InetAddress;
 import java.net.UnknownHostException;
 import java.nio.file.Path;
 import java.util.Optional;
+import java.util.function.Consumer;
 import java.util.function.Supplier;
 
 public class WebDavVolume implements Volume {
@@ -31,6 +32,7 @@ public class WebDavVolume implements Volume {
 	private WebDavServer server;
 	private WebDavServletController servlet;
 	private Mounter.Mount mount;
+	private Consumer<Throwable> onExitAction;
 
 	@Inject
 	public WebDavVolume(Provider<WebDavServer> serverProvider, VaultSettings vaultSettings, Settings settings, WindowsDriveLetters windowsDriveLetters) {
@@ -41,12 +43,13 @@ public class WebDavVolume implements Volume {
 	}
 
 	@Override
-	public void mount(CryptoFileSystem fs, String mountFlags) throws VolumeException {
+	public void mount(CryptoFileSystem fs, String mountFlags, Consumer<Throwable> onExitAction) throws VolumeException {
 		startServlet(fs);
 		mountServlet();
+		this.onExitAction = onExitAction;
 	}
 
-	private void startServlet(CryptoFileSystem fs){
+	private void startServlet(CryptoFileSystem fs) {
 		if (server == null) {
 			server = serverProvider.get();
 		}
@@ -66,7 +69,7 @@ public class WebDavVolume implements Volume {
 
 		//on windows, prevent an automatic drive letter selection in the upstream library. Either we choose already a specifc one or there is no free.
 		Supplier<String> driveLetterSupplier;
-		if(System.getProperty("os.name").toLowerCase().contains("windows") && vaultSettings.winDriveLetter().isEmpty().get()) {
+		if (System.getProperty("os.name").toLowerCase().contains("windows") && vaultSettings.winDriveLetter().isEmpty().get()) {
 			driveLetterSupplier = () -> windowsDriveLetters.getAvailableDriveLetter().orElse(null);
 		} else {
 			driveLetterSupplier = () -> vaultSettings.winDriveLetter().get();
@@ -101,6 +104,7 @@ public class WebDavVolume implements Volume {
 			throw new VolumeException(e);
 		}
 		cleanup();
+		onExitAction.accept(null);
 	}
 
 	@Override
@@ -111,6 +115,7 @@ public class WebDavVolume implements Volume {
 			throw new VolumeException(e);
 		}
 		cleanup();
+		onExitAction.accept(null);
 	}
 
 	@Override

main/commons/src/test/java/org/cryptomator/common/EnvironmentTest.java

@@ -32,7 +32,7 @@ class EnvironmentTest {
 	public void testSettingsPath() {
 		System.setProperty("cryptomator.settingsPath", "~/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json");
 
-		List<Path> result = env.getSettingsPath().collect(Collectors.toList());
+		List<Path> result = env.getSettingsPath().toList();
 		MatcherAssert.assertThat(result, Matchers.hasSize(2));
 		MatcherAssert.assertThat(result, Matchers.contains(Paths.get("/home/testuser/.config/Cryptomator/settings.json"), //
 				Paths.get("/home/testuser/.Cryptomator/settings.json")));
@@ -43,7 +43,7 @@ class EnvironmentTest {
 	public void testIpcPortPath() {
 		System.setProperty("cryptomator.ipcPortPath", "~/.config/Cryptomator/ipcPort.bin:~/.Cryptomator/ipcPort.bin");
 
-		List<Path> result = env.getIpcPortPath().collect(Collectors.toList());
+		List<Path> result = env.getIpcPortPath().toList();
 		MatcherAssert.assertThat(result, Matchers.hasSize(2));
 		MatcherAssert.assertThat(result, Matchers.contains(Paths.get("/home/testuser/.config/Cryptomator/ipcPort.bin"), //
 				Paths.get("/home/testuser/.Cryptomator/ipcPort.bin")));
@@ -54,7 +54,7 @@ class EnvironmentTest {
 	public void testKeychainPath() {
 		System.setProperty("cryptomator.keychainPath", "~/AppData/Roaming/Cryptomator/keychain.json");
 
-		List<Path> result = env.getKeychainPath().collect(Collectors.toList());
+		List<Path> result = env.getKeychainPath().toList();
 		MatcherAssert.assertThat(result, Matchers.hasSize(1));
 		MatcherAssert.assertThat(result, Matchers.contains(Paths.get("/home/testuser/AppData/Roaming/Cryptomator/keychain.json")));
 	}
@@ -88,7 +88,7 @@ class EnvironmentTest {
 		@DisplayName("test.path.property=")
 		public void testEmptyList() {
 			System.setProperty("test.path.property", "");
-			List<Path> result = env.getPaths("test.path.property").collect(Collectors.toList());
+			List<Path> result = env.getPaths("test.path.property").toList();
 
 			MatcherAssert.assertThat(result, Matchers.hasSize(0));
 		}
@@ -97,7 +97,7 @@ class EnvironmentTest {
 		@DisplayName("test.path.property=/foo/bar/test")
 		public void testSingleAbsolutePath() {
 			System.setProperty("test.path.property", "/foo/bar/test");
-			List<Path> result = env.getPaths("test.path.property").collect(Collectors.toList());
+			List<Path> result = env.getPaths("test.path.property").toList();
 
 			MatcherAssert.assertThat(result, Matchers.hasSize(1));
 			MatcherAssert.assertThat(result, Matchers.hasItem(Paths.get("/foo/bar/test")));
@@ -107,7 +107,7 @@ class EnvironmentTest {
 		@DisplayName("test.path.property=~/test")
 		public void testSingleHomeRelativePath() {
 			System.setProperty("test.path.property", "~/test");
-			List<Path> result = env.getPaths("test.path.property").collect(Collectors.toList());
+			List<Path> result = env.getPaths("test.path.property").toList();
 
 			MatcherAssert.assertThat(result, Matchers.hasSize(1));
 			MatcherAssert.assertThat(result, Matchers.hasItem(Paths.get("/home/testuser/test")));
@@ -117,7 +117,7 @@ class EnvironmentTest {
 		@DisplayName("test.path.property=~/test:~/test2:/foo/bar/test")
 		public void testMultiplePaths() {
 			System.setProperty("test.path.property", "~/test:~/test2:/foo/bar/test");
-			List<Path> result = env.getPaths("test.path.property").collect(Collectors.toList());
+			List<Path> result = env.getPaths("test.path.property").toList();
 
 			MatcherAssert.assertThat(result, Matchers.hasSize(3));
 			MatcherAssert.assertThat(result, Matchers.contains(Paths.get("/home/testuser/test"), //

main/commons/src/test/java/org/cryptomator/common/LicenseCheckerTest.java

@@ -9,10 +9,12 @@ import java.util.Optional;
 
 class LicenseCheckerTest {
 
-	private static final String PUBLIC_KEY = "MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBgc4HZz+/fBbC7lmEww0AO3NK9wVZ" //
-			+ "PDZ0VEnsaUFLEYpTzb90nITtJUcPUbvOsdZIZ1Q8fnbquAYgxXL5UgHMoywAib47" //
-			+ "6MkyyYgPk0BXZq3mq4zImTRNuaU9slj9TVJ3ScT3L1bXwVuPJDzpr5GOFpaj+WwM" //
-			+ "Al8G7CqwoJOsW7Kddns=";
+	private static final String PUBLIC_KEY = """
+			MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBgc4HZz+/fBbC7lmEww0AO3NK9wVZ\
+			PDZ0VEnsaUFLEYpTzb90nITtJUcPUbvOsdZIZ1Q8fnbquAYgxXL5UgHMoywAib47\
+			6MkyyYgPk0BXZq3mq4zImTRNuaU9slj9TVJ3ScT3L1bXwVuPJDzpr5GOFpaj+WwM\
+			Al8G7CqwoJOsW7Kddns=\
+			""";
 
 	private LicenseChecker licenseChecker;
 

main/commons/src/test/java/org/cryptomator/common/keychain/MapKeychainAccess.java

@@ -44,4 +44,9 @@ class MapKeychainAccess implements KeychainAccessProvider {
 		return true;
 	}
 
+	@Override
+	public boolean isLocked() {
+		return false;
+	}
+
 }

main/commons/src/test/java/org/cryptomator/common/settings/SettingsJsonAdapterTest.java

@@ -21,13 +21,18 @@ public class SettingsJsonAdapterTest {
 
 	@Test
 	public void testDeserialize() throws IOException {
-		String vault1Json = "{\"id\": \"1\", \"path\": \"/vault1\", \"mountName\": \"vault1\", \"winDriveLetter\": \"X\"}";
-		String vault2Json = "{\"id\": \"2\", \"path\": \"/vault2\", \"mountName\": \"vault2\", \"winDriveLetter\": \"Y\"}";
-		String json = "{\"directories\": [" + vault1Json + "," + vault2Json + "]," //
-				+ "\"checkForUpdatesEnabled\": true,"//
-				+ "\"port\": 8080,"//
-				+ "\"numTrayNotifications\": 42,"//
-				+ "\"preferredVolumeImpl\": \"FUSE\"}";
+		String json = """
+				{
+					"directories": [
+						{"id": "1", "path": "/vault1", "mountName": "vault1", "winDriveLetter": "X"},
+						{"id": "2", "path": "/vault2", "mountName": "vault2", "winDriveLetter": "Y"}
+					],
+					"checkForUpdatesEnabled": true,
+					"port": 8080,
+					"numTrayNotifications": 42,
+					"preferredVolumeImpl": "FUSE"
+				}
+				""";
 
 		Settings settings = adapter.fromJson(json);
 

main/launcher/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>org.cryptomator</groupId>
 		<artifactId>main</artifactId>
-		<version>1.6.0-SNAPSHOT</version>
+		<version>1.6.0</version>
 	</parent>
 	<artifactId>launcher</artifactId>
 	<name>Cryptomator Launcher</name>

main/launcher/src/main/java/org/cryptomator/launcher/FileOpenRequestHandler.java

@@ -41,7 +41,7 @@ class FileOpenRequestHandler {
 	}
 
 	private void openFiles(OpenFilesEvent evt) {
-		Collection<Path> pathsToOpen = evt.getFiles().stream().map(File::toPath).collect(Collectors.toList());
+		Collection<Path> pathsToOpen = evt.getFiles().stream().map(File::toPath).toList();
 		AppLaunchEvent launchEvent = new AppLaunchEvent(AppLaunchEvent.EventType.OPEN_FILE, pathsToOpen);
 		tryToEnqueueFileOpenRequest(launchEvent);
 	}
@@ -59,7 +59,7 @@ class FileOpenRequestHandler {
 				LOG.trace("Argument not a valid path: {}", str);
 				return null;
 			}
-		}).filter(Objects::nonNull).collect(Collectors.toList());
+		}).filter(Objects::nonNull).toList();
 		if (!pathsToOpen.isEmpty()) {
 			AppLaunchEvent launchEvent = new AppLaunchEvent(AppLaunchEvent.EventType.OPEN_FILE, pathsToOpen);
 			tryToEnqueueFileOpenRequest(launchEvent);

main/launcher/src/main/java/org/cryptomator/logging/LoggerModule.java

@@ -47,8 +47,8 @@ public class LoggerModule {
 	@Singleton
 	static LoggerContext provideLoggerContext() {
 		ILoggerFactory loggerFactory = LoggerFactory.getILoggerFactory();
-		if (loggerFactory instanceof LoggerContext) {
-			return (LoggerContext) loggerFactory;
+		if (loggerFactory instanceof LoggerContext context) {
+			return context;
 		} else {
 			throw new IllegalStateException("SLF4J not bound to Logback.");
 		}

main/pom.xml

@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>org.cryptomator</groupId>
 	<artifactId>main</artifactId>
-	<version>1.5.12</version>
+	<version>1.6.0</version>
 	<packaging>pom</packaging>
 	<name>Cryptomator</name>
 
@@ -22,41 +22,35 @@
 
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+		<project.jdk.version>16</project.jdk.version>
 
 		<!-- cryptomator dependencies -->
-		<cryptomator.cryptofs.version>1.9.13</cryptomator.cryptofs.version>
-		<cryptomator.integrations.version>0.1.6</cryptomator.integrations.version>
-		<cryptomator.integrations.win.version>0.2.1</cryptomator.integrations.win.version>
-		<cryptomator.integrations.mac.version>0.1.0-beta3</cryptomator.integrations.mac.version>
-		<cryptomator.integrations.linux.version>0.1.1</cryptomator.integrations.linux.version>
-		<cryptomator.fuse.version>1.2.8</cryptomator.fuse.version>
-		<cryptomator.dokany.version>1.2.3</cryptomator.dokany.version>
-		<cryptomator.webdav.version>1.1.1</cryptomator.webdav.version>
+		<cryptomator.cryptofs.version>2.1.0-beta5</cryptomator.cryptofs.version>
+		<cryptomator.integrations.version>1.0.0-beta2</cryptomator.integrations.version>
+		<cryptomator.integrations.win.version>1.0.0-beta2</cryptomator.integrations.win.version>
+		<cryptomator.integrations.mac.version>1.0.0-beta2</cryptomator.integrations.mac.version>
+		<cryptomator.integrations.linux.version>1.0.0-beta1</cryptomator.integrations.linux.version>
+		<cryptomator.fuse.version>1.3.1</cryptomator.fuse.version>
+		<cryptomator.dokany.version>1.3.1</cryptomator.dokany.version>
+		<cryptomator.webdav.version>1.2.2</cryptomator.webdav.version>
 
 		<!-- 3rd party dependencies -->
-		<javafx.version>15</javafx.version>
+		<javafx.version>16</javafx.version>
 		<commons-lang3.version>3.11</commons-lang3.version>
-		<jwt.version>3.12.0</jwt.version>
+		<jwt.version>3.15.0</jwt.version>
 		<easybind.version>2.1.0</easybind.version>
-		<guava.version>30.0-jre</guava.version>
-		<dagger.version>2.29.1</dagger.version>
+		<guava.version>30.1.1-jre</guava.version>
+		<dagger.version>2.35.1</dagger.version>
 		<gson.version>2.8.6</gson.version>
 		<slf4j.version>1.7.30</slf4j.version>
 		<logback.version>1.2.3</logback.version>
 
 		<!-- test dependencies -->
-		<junit.jupiter.version>5.7.0</junit.jupiter.version>
-		<mockito.version>3.6.0</mockito.version>
+		<junit.jupiter.version>5.7.1</junit.jupiter.version>
+		<mockito.version>3.9.0</mockito.version>
 		<hamcrest.version>2.2</hamcrest.version>
 	</properties>
 
-	<repositories>
-		<repository>
-			<id>jcenter</id>
-			<url>https://jcenter.bintray.com</url>
-		</repository>
-	</repositories>
-
 	<dependencyManagement>
 		<dependencies>
 			<!-- modules -->
@@ -224,12 +218,6 @@
 				<scope>test</scope>
 			</dependency>
 
-			<!-- TODO: temporary fix for XXE attack, can be removed once java-jwt is updated -->
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>2.10.5.1</version>
-			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
@@ -437,7 +425,7 @@
 			<plugin>
 				<artifactId>maven-compiler-plugin</artifactId>
 				<configuration>
-					<release>14</release>
+					<release>${project.jdk.version}</release>
 					<annotationProcessorPaths>
 						<path>
 							<groupId>com.google.dagger</groupId>

main/suppression.xml

@@ -1,11 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- This file lists false positives found by org.owasp:dependency-check-maven build plugin -->
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
-	<suppress>
-		<notes><![CDATA[ Upstream fix backported from 2.11.0 to 2.10.5.1, see https://github.com/FasterXML/jackson-databind/issues/2589#issuecomment-714833837. ]]></notes>
-		<gav>com.fasterxml.jackson.core:jackson-databind:2.10.5.1</gav>
-		<cve>CVE-2020-25649</cve>
-	</suppress>
 	<suppress>
 		<notes><![CDATA[ Suppress known vulnerabilities in FUSE libraries for fuse-nio-adapter. For more info, see suppression.xml of https://github.com/cryptomator/fuse-nio-adapter ]]></notes>
 		<gav regex="true">^org\.cryptomator:fuse-nio-adapter:.*$</gav>

main/ui/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>org.cryptomator</groupId>
 		<artifactId>main</artifactId>
-		<version>1.6.0-SNAPSHOT</version>
+		<version>1.6.0</version>
 	</parent>
 	<artifactId>ui</artifactId>
 	<name>Cryptomator GUI</name>

main/ui/src/main/java/org/cryptomator/ui/addvaultwizard/AddVaultModule.java

@@ -6,10 +6,10 @@ import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.common.PasswordStrengthUtil;
@@ -33,18 +33,11 @@ import java.util.ResourceBundle;
 @Module
 public abstract class AddVaultModule {
 
-	@Provides
-	@AddVaultWizardScoped
-	@Named("newPassword")
-	static ObjectProperty<CharSequence> provideNewPasswordProperty() {
-		return new SimpleObjectProperty<>("");
-	}
-
 	@Provides
 	@AddVaultWizardWindow
 	@AddVaultWizardScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -91,50 +84,50 @@ public abstract class AddVaultModule {
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_WELCOME)
 	@AddVaultWizardScoped
-	static Scene provideWelcomeScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_WELCOME.getRessourcePathString());
+	static Scene provideWelcomeScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_WELCOME);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_EXISTING)
 	@AddVaultWizardScoped
-	static Scene provideChooseExistingVaultScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_EXISTING.getRessourcePathString());
+	static Scene provideChooseExistingVaultScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_EXISTING);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_NEW_NAME)
 	@AddVaultWizardScoped
-	static Scene provideCreateNewVaultNameScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_NAME.getRessourcePathString());
+	static Scene provideCreateNewVaultNameScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_NAME);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_NEW_LOCATION)
 	@AddVaultWizardScoped
-	static Scene provideCreateNewVaultLocationScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_LOCATION.getRessourcePathString());
+	static Scene provideCreateNewVaultLocationScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_LOCATION);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_NEW_PASSWORD)
 	@AddVaultWizardScoped
-	static Scene provideCreateNewVaultPasswordScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_PASSWORD.getRessourcePathString());
+	static Scene provideCreateNewVaultPasswordScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_PASSWORD);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY)
 	@AddVaultWizardScoped
-	static Scene provideCreateNewVaultRecoveryKeyScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY.getRessourcePathString());
+	static Scene provideCreateNewVaultRecoveryKeyScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.ADDVAULT_SUCCESS)
 	@AddVaultWizardScoped
-	static Scene provideCreateNewVaultSuccessScene(@AddVaultWizardWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_SUCCESS.getRessourcePathString());
+	static Scene provideCreateNewVaultSuccessScene(@AddVaultWizardWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ADDVAULT_SUCCESS);
 	}
 
 	// ------------------
@@ -167,8 +160,8 @@ public abstract class AddVaultModule {
 	@Provides
 	@IntoMap
 	@FxControllerKey(NewPasswordController.class)
-	static FxController provideNewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater, @Named("newPassword") ObjectProperty<CharSequence> password) {
-		return new NewPasswordController(resourceBundle, strengthRater, password);
+	static FxController provideNewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater) {
+		return new NewPasswordController(resourceBundle, strengthRater);
 	}
 
 	@Binds

main/ui/src/main/java/org/cryptomator/ui/addvaultwizard/ChooseExistingVaultController.java

@@ -81,7 +81,7 @@ public class ChooseExistingVaultController implements FxController {
 				Vault newVault = vaultListManager.add(vaultPath.get());
 				vault.set(newVault);
 				window.setScene(successScene.get());
-			} catch (NoSuchFileException e) {
+			} catch (IOException e) {
 				LOG.error("Failed to open existing vault.", e);
 				errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
 			}

main/ui/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultLocationController.java

@@ -1,10 +1,10 @@
 package org.cryptomator.ui.addvaultwizard;
 
 import dagger.Lazy;
-import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.controls.FontAwesome5IconView;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -15,21 +15,21 @@ import javafx.beans.binding.BooleanBinding;
 import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleObjectProperty;
 import javafx.beans.property.SimpleStringProperty;
 import javafx.beans.property.StringProperty;
 import javafx.beans.value.ObservableValue;
 import javafx.fxml.FXML;
+import javafx.scene.Node;
 import javafx.scene.Scene;
+import javafx.scene.control.Label;
 import javafx.scene.control.RadioButton;
 import javafx.scene.control.Toggle;
 import javafx.scene.control.ToggleGroup;
 import javafx.stage.DirectoryChooser;
 import javafx.stage.Stage;
 import java.io.File;
-import java.io.IOException;
-import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.Files;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ResourceBundle;
@@ -43,55 +43,74 @@ public class CreateNewVaultLocationController implements FxController {
 	private final Stage window;
 	private final Lazy<Scene> chooseNameScene;
 	private final Lazy<Scene> choosePasswordScene;
-	private final ErrorComponent.Builder errorComponent;
 	private final LocationPresets locationPresets;
 	private final ObjectProperty<Path> vaultPath;
 	private final StringProperty vaultName;
 	private final ResourceBundle resourceBundle;
 	private final BooleanBinding validVaultPath;
 	private final BooleanProperty usePresetPath;
-	private final StringProperty warningText;
+	private final StringProperty statusText;
+	private final ObjectProperty<Node> statusGraphic;
 
 	private Path customVaultPath = DEFAULT_CUSTOM_VAULT_PATH;
+
+	//FXML
 	public ToggleGroup predefinedLocationToggler;
 	public RadioButton iclouddriveRadioButton;
 	public RadioButton dropboxRadioButton;
 	public RadioButton gdriveRadioButton;
 	public RadioButton onedriveRadioButton;
+	public RadioButton megaRadioButton;
+	public RadioButton pcloudRadioButton;
 	public RadioButton customRadioButton;
+	public Label vaultPathStatus;
+	public FontAwesome5IconView goodLocation;
+	public FontAwesome5IconView badLocation;
 
 	@Inject
-	CreateNewVaultLocationController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_NAME) Lazy<Scene> chooseNameScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_PASSWORD) Lazy<Scene> choosePasswordScene, ErrorComponent.Builder errorComponent, LocationPresets locationPresets, ObjectProperty<Path> vaultPath, @Named("vaultName") StringProperty vaultName, ResourceBundle resourceBundle) {
+	CreateNewVaultLocationController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_NAME) Lazy<Scene> chooseNameScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_PASSWORD) Lazy<Scene> choosePasswordScene, LocationPresets locationPresets, ObjectProperty<Path> vaultPath, @Named("vaultName") StringProperty vaultName, ResourceBundle resourceBundle) {
 		this.window = window;
 		this.chooseNameScene = chooseNameScene;
 		this.choosePasswordScene = choosePasswordScene;
-		this.errorComponent = errorComponent;
 		this.locationPresets = locationPresets;
 		this.vaultPath = vaultPath;
 		this.vaultName = vaultName;
 		this.resourceBundle = resourceBundle;
-		this.validVaultPath = Bindings.createBooleanBinding(this::isValidVaultPath, vaultPath);
+		this.validVaultPath = Bindings.createBooleanBinding(this::validateVaultPathAndSetStatus, this.vaultPath);
 		this.usePresetPath = new SimpleBooleanProperty();
-		this.warningText = new SimpleStringProperty();
+		this.statusText = new SimpleStringProperty();
+		this.statusGraphic = new SimpleObjectProperty<>();
 	}
 
-	private boolean isValidVaultPath() {
-		return vaultPath.get() != null && Files.notExists(vaultPath.get());
+	private boolean validateVaultPathAndSetStatus() {
+		final Path p = vaultPath.get();
+		if (p == null) {
+			statusText.set("Error: Path is NULL.");
+			statusGraphic.set(badLocation);
+			return false;
+		} else if (!Files.exists(p.getParent())) {
+			statusText.set(resourceBundle.getString("addvaultwizard.new.locationDoesNotExist"));
+			statusGraphic.set(badLocation);
+			return false;
+		} else if (!Files.isWritable(p.getParent())) {
+			statusText.set(resourceBundle.getString("addvaultwizard.new.locationIsNotWritable"));
+			statusGraphic.set(badLocation);
+			return false;
+		} else if (!Files.notExists(p)) {
+			statusText.set(resourceBundle.getString("addvaultwizard.new.fileAlreadyExists"));
+			statusGraphic.set(badLocation);
+			return false;
+		} else {
+			statusText.set(resourceBundle.getString("addvaultwizard.new.locationIsOk"));
+			statusGraphic.set(goodLocation);
+			return true;
+		}
 	}
 
 	@FXML
 	public void initialize() {
 		predefinedLocationToggler.selectedToggleProperty().addListener(this::togglePredefinedLocation);
 		usePresetPath.bind(predefinedLocationToggler.selectedToggleProperty().isNotEqualTo(customRadioButton));
-		vaultPath.addListener(this::vaultPathDidChange);
-	}
-
-	private void vaultPathDidChange(@SuppressWarnings("unused") ObservableValue<? extends Path> observable, @SuppressWarnings("unused") Path oldValue, Path newValue) {
-		if (!Files.notExists(newValue)) {
-			warningText.set(resourceBundle.getString("addvaultwizard.new.fileAlreadyExists"));
-		} else {
-			warningText.set(null);
-		}
 	}
 
 	private void togglePredefinedLocation(@SuppressWarnings("unused") ObservableValue<? extends Toggle> observable, @SuppressWarnings("unused") Toggle oldValue, Toggle newValue) {
@@ -103,6 +122,10 @@ public class CreateNewVaultLocationController implements FxController {
 			vaultPath.set(locationPresets.getGdriveLocation().resolve(vaultName.get()));
 		} else if (onedriveRadioButton.equals(newValue)) {
 			vaultPath.set(locationPresets.getOnedriveLocation().resolve(vaultName.get()));
+		} else if (megaRadioButton.equals(newValue)) {
+			vaultPath.set(locationPresets.getMegaLocation().resolve(vaultName.get()));
+		} else if (pcloudRadioButton.equals(newValue)) {
+			vaultPath.set(locationPresets.getPcloudLocation().resolve(vaultName.get()));
 		} else if (customRadioButton.equals(newValue)) {
 			vaultPath.set(customVaultPath.resolve(vaultName.get()));
 		}
@@ -115,21 +138,10 @@ public class CreateNewVaultLocationController implements FxController {
 
 	@FXML
 	public void next() {
-		try {
-			// check if we have write access AND the vaultPath doesn't already exist:
-			assert Files.isDirectory(vaultPath.get().getParent());
-			Path createdDir = Files.createDirectory(vaultPath.get());
-			Files.delete(createdDir); // assert: dir exists and is empty
+		if (validateVaultPathAndSetStatus()) {
 			window.setScene(choosePasswordScene.get());
-		} catch (FileAlreadyExistsException e) {
-			LOG.warn("Can not use already existing vault path {}", vaultPath.get());
-			warningText.set(resourceBundle.getString("addvaultwizard.new.fileAlreadyExists"));
-		} catch (NoSuchFileException e) {
-			LOG.warn("At least one path component does not exist of path {}", vaultPath.get());
-			warningText.set(resourceBundle.getString("addvaultwizard.new.locationDoesNotExist"));
-		} catch (IOException e) {
-			LOG.error("Failed to create and delete directory at chosen vault path.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+		} else {
+			validVaultPath.invalidate();
 		}
 	}
 
@@ -179,19 +191,27 @@ public class CreateNewVaultLocationController implements FxController {
 		return usePresetPath.get();
 	}
 
-	public StringProperty warningTextProperty() {
-		return warningText;
+	public BooleanBinding anyRadioButtonSelectedProperty() {
+		return predefinedLocationToggler.selectedToggleProperty().isNotNull();
 	}
 
-	public String getWarningText() {
-		return warningText.get();
+	public boolean isAnyRadioButtonSelected() {
+		return anyRadioButtonSelectedProperty().get();
 	}
 
-	public BooleanBinding showWarningProperty() {
-		return warningText.isNotEmpty();
+	public StringProperty statusTextProperty() {
+		return statusText;
 	}
 
-	public boolean isShowWarning() {
-		return showWarningProperty().get();
+	public String getStatusText() {
+		return statusText.get();
+	}
+
+	public ObjectProperty<Node> statusGraphicProperty() {
+		return statusGraphic;
+	}
+
+	public Node getStatusGraphic() {
+		return statusGraphic.get();
 	}
 }

main/ui/src/main/java/org/cryptomator/ui/addvaultwizard/CreateNewVaultPasswordController.java

@@ -5,11 +5,18 @@ import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
 import org.cryptomator.cryptofs.CryptoFileSystemProperties;
 import org.cryptomator.cryptofs.CryptoFileSystemProvider;
+import org.cryptomator.cryptofs.VaultCipherCombo;
+import org.cryptomator.cryptolib.api.CryptoException;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.cryptomator.cryptolib.api.MasterkeyLoader;
+import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
 import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.common.Tasks;
+import org.cryptomator.ui.keyloading.masterkeyfile.MasterkeyFileLoadingStrategy;
 import org.cryptomator.ui.recoverykey.RecoveryKeyFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -17,7 +24,6 @@ import org.slf4j.LoggerFactory;
 import javax.inject.Inject;
 import javax.inject.Named;
 import javafx.beans.binding.Bindings;
-import javafx.beans.binding.BooleanBinding;
 import javafx.beans.binding.ObjectBinding;
 import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.ObjectProperty;
@@ -31,13 +37,13 @@ import javafx.scene.control.ToggleGroup;
 import javafx.stage.Stage;
 import java.io.IOException;
 import java.io.UncheckedIOException;
+import java.net.URI;
 import java.nio.channels.WritableByteChannel;
 import java.nio.file.FileSystem;
 import java.nio.file.Files;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.nio.file.StandardOpenOption;
-import java.util.Collections;
+import java.security.SecureRandom;
 import java.util.ResourceBundle;
 import java.util.concurrent.ExecutorService;
 
@@ -48,6 +54,7 @@ import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
 public class CreateNewVaultPasswordController implements FxController {
 
 	private static final Logger LOG = LoggerFactory.getLogger(CreateNewVaultPasswordController.class);
+	private static final URI DEFAULT_KEY_ID = URI.create(MasterkeyFileLoadingStrategy.SCHEME + ":" + MASTERKEY_FILENAME); // TODO better place?
 
 	private final Stage window;
 	private final Lazy<Scene> chooseLocationScene;
@@ -62,8 +69,9 @@ public class CreateNewVaultPasswordController implements FxController {
 	private final StringProperty recoveryKeyProperty;
 	private final VaultListManager vaultListManager;
 	private final ResourceBundle resourceBundle;
-	private final ObjectProperty<CharSequence> password;
 	private final ReadmeGenerator readmeGenerator;
+	private final SecureRandom csprng;
+	private final MasterkeyFileAccess masterkeyFileAccess;
 	private final BooleanProperty processing;
 	private final BooleanProperty readyToCreateVault;
 	private final ObjectBinding<ContentDisplay> createVaultButtonState;
@@ -71,9 +79,10 @@ public class CreateNewVaultPasswordController implements FxController {
 	public ToggleGroup recoveryKeyChoice;
 	public Toggle showRecoveryKey;
 	public Toggle skipRecoveryKey;
+	public NewPasswordController newPasswordSceneController;
 
 	@Inject
-	CreateNewVaultPasswordController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_LOCATION) Lazy<Scene> chooseLocationScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY) Lazy<Scene> recoveryKeyScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, ErrorComponent.Builder errorComponent, ExecutorService executor, RecoveryKeyFactory recoveryKeyFactory, @Named("vaultName") StringProperty vaultName, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, @Named("recoveryKey") StringProperty recoveryKey, VaultListManager vaultListManager, ResourceBundle resourceBundle, @Named("newPassword") ObjectProperty<CharSequence> password, ReadmeGenerator readmeGenerator) {
+	CreateNewVaultPasswordController(@AddVaultWizardWindow Stage window, @FxmlScene(FxmlFile.ADDVAULT_NEW_LOCATION) Lazy<Scene> chooseLocationScene, @FxmlScene(FxmlFile.ADDVAULT_NEW_RECOVERYKEY) Lazy<Scene> recoveryKeyScene, @FxmlScene(FxmlFile.ADDVAULT_SUCCESS) Lazy<Scene> successScene, ErrorComponent.Builder errorComponent, ExecutorService executor, RecoveryKeyFactory recoveryKeyFactory, @Named("vaultName") StringProperty vaultName, ObjectProperty<Path> vaultPath, @AddVaultWizardWindow ObjectProperty<Vault> vault, @Named("recoveryKey") StringProperty recoveryKey, VaultListManager vaultListManager, ResourceBundle resourceBundle, ReadmeGenerator readmeGenerator, SecureRandom csprng, MasterkeyFileAccess masterkeyFileAccess) {
 		this.window = window;
 		this.chooseLocationScene = chooseLocationScene;
 		this.recoveryKeyScene = recoveryKeyScene;
@@ -87,8 +96,9 @@ public class CreateNewVaultPasswordController implements FxController {
 		this.recoveryKeyProperty = recoveryKey;
 		this.vaultListManager = vaultListManager;
 		this.resourceBundle = resourceBundle;
-		this.password = password;
 		this.readmeGenerator = readmeGenerator;
+		this.csprng = csprng;
+		this.masterkeyFileAccess = masterkeyFileAccess;
 		this.processing = new SimpleBooleanProperty();
 		this.readyToCreateVault = new SimpleBooleanProperty();
 		this.createVaultButtonState = Bindings.createObjectBinding(this::getCreateVaultButtonState, processing);
@@ -96,8 +106,11 @@ public class CreateNewVaultPasswordController implements FxController {
 
 	@FXML
 	public void initialize() {
-		BooleanBinding isValidNewPassword = Bindings.createBooleanBinding(() -> password.get() != null && password.get().length() > 0, password);
-		readyToCreateVault.bind(isValidNewPassword.and(recoveryKeyChoice.selectedToggleProperty().isNotNull()).and(processing.not()));
+		readyToCreateVault.bind(newPasswordSceneController.passwordsMatchAndSufficientProperty().and(recoveryKeyChoice.selectedToggleProperty().isNotNull()).and(processing.not()));
+		window.setOnHiding(event -> {
+			newPasswordSceneController.passwordField.wipe();
+			newPasswordSceneController.reenterField.wipe();
+		});
 	}
 
 	@FXML
@@ -130,8 +143,8 @@ public class CreateNewVaultPasswordController implements FxController {
 		Path pathToVault = vaultPathProperty.get();
 		processing.set(true);
 		Tasks.create(() -> {
-			initializeVault(pathToVault, password.get());
-			return recoveryKeyFactory.createRecoveryKey(pathToVault, password.get());
+			initializeVault(pathToVault);
+			return recoveryKeyFactory.createRecoveryKey(pathToVault, newPasswordSceneController.passwordField.getCharacters());
 		}).onSuccess(recoveryKey -> {
 			initializationSucceeded(pathToVault);
 			recoveryKeyProperty.set(recoveryKey);
@@ -148,7 +161,7 @@ public class CreateNewVaultPasswordController implements FxController {
 		Path pathToVault = vaultPathProperty.get();
 		processing.set(true);
 		Tasks.create(() -> {
-			initializeVault(pathToVault, password.get());
+			initializeVault(pathToVault);
 		}).onSuccess(() -> {
 			initializationSucceeded(pathToVault);
 			window.setScene(successScene.get());
@@ -160,24 +173,35 @@ public class CreateNewVaultPasswordController implements FxController {
 		}).runOnce(executor);
 	}
 
-	private void initializeVault(Path path, CharSequence passphrase) throws IOException {
-		CryptoFileSystemProvider.initialize(path, MASTERKEY_FILENAME, passphrase);
-		CryptoFileSystemProperties fsProps = CryptoFileSystemProperties.cryptoFileSystemProperties() //
-				.withPassphrase(passphrase) //
-				.withFlags(Collections.emptySet()) //
-				.withMasterkeyFilename(MASTERKEY_FILENAME) //
-				.build();
+	private void initializeVault(Path path) throws IOException {
+		// 1. write masterkey:
+		Path masterkeyFilePath = path.resolve(MASTERKEY_FILENAME);
+		try (Masterkey masterkey = Masterkey.generate(csprng)) {
+			masterkeyFileAccess.persist(masterkey, masterkeyFilePath, newPasswordSceneController.passwordField.getCharacters());
 
-		String vaultReadmeFileName = resourceBundle.getString("addvault.new.readme.accessLocation.fileName");
-		try (FileSystem fs = CryptoFileSystemProvider.newFileSystem(path, fsProps); // 
-			 WritableByteChannel ch = Files.newByteChannel(fs.getPath("/", vaultReadmeFileName), StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE)) {
-			ch.write(US_ASCII.encode(readmeGenerator.createVaultAccessLocationReadmeRtf()));
+			// 2. initialize vault:
+			try {
+				MasterkeyLoader loader = ignored -> masterkey.clone();
+				CryptoFileSystemProperties fsProps = CryptoFileSystemProperties.cryptoFileSystemProperties().withCipherCombo(VaultCipherCombo.SIV_CTRMAC).withKeyLoader(loader).build();
+				CryptoFileSystemProvider.initialize(path, fsProps, DEFAULT_KEY_ID);
+
+				// 3. write vault-internal readme file:
+				String vaultReadmeFileName = resourceBundle.getString("addvault.new.readme.accessLocation.fileName");
+				try (FileSystem fs = CryptoFileSystemProvider.newFileSystem(path, fsProps); //
+					 WritableByteChannel ch = Files.newByteChannel(fs.getPath("/", vaultReadmeFileName), StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE)) {
+					ch.write(US_ASCII.encode(readmeGenerator.createVaultAccessLocationReadmeRtf()));
+				}
+			} catch (CryptoException e) {
+				throw new IOException("Failed initialize vault.", e);
+			}
 		}
 
+		// 4. write vault-external readme file:
 		String storagePathReadmeFileName = resourceBundle.getString("addvault.new.readme.storageLocation.fileName");
 		try (WritableByteChannel ch = Files.newByteChannel(path.resolve(storagePathReadmeFileName), StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE)) {
 			ch.write(US_ASCII.encode(readmeGenerator.createVaultStorageLocationReadmeRtf()));
 		}
+
 		LOG.info("Created vault at {}", path);
 	}
 
@@ -185,7 +209,7 @@ public class CreateNewVaultPasswordController implements FxController {
 		try {
 			Vault newVault = vaultListManager.add(pathToVault);
 			vaultProperty.set(newVault);
-		} catch (NoSuchFileException e) {
+		} catch (IOException e) {
 			throw new UncheckedIOException(e);
 		}
 	}

main/ui/src/main/java/org/cryptomator/ui/addvaultwizard/LocationPresets.java

@@ -16,15 +16,21 @@ public class LocationPresets {
 	private static final String[] DROPBOX_LOCATIONS = {"~/Dropbox"};
 	private static final String[] GDRIVE_LOCATIONS = {"~/Google Drive"};
 	private static final String[] ONEDRIVE_LOCATIONS = {"~/OneDrive"};
+	private static final String[] MEGA_LOCATIONS = {"~/MEGA"};
+	private static final String[] PCLOUD_LOCATIONS = {"~/pCloudDrive"};
 
 	private final ReadOnlyObjectProperty<Path> iclouddriveLocation;
 	private final ReadOnlyObjectProperty<Path> dropboxLocation;
 	private final ReadOnlyObjectProperty<Path> gdriveLocation;
 	private final ReadOnlyObjectProperty<Path> onedriveLocation;
+	private final ReadOnlyObjectProperty<Path> megaLocation;
+	private final ReadOnlyObjectProperty<Path> pcloudLocation;
 	private final BooleanBinding foundIclouddrive;
 	private final BooleanBinding foundDropbox;
 	private final BooleanBinding foundGdrive;
 	private final BooleanBinding foundOnedrive;
+	private final BooleanBinding foundMega;
+	private final BooleanBinding foundPcloud;
 
 	@Inject
 	public LocationPresets() {
@@ -32,10 +38,14 @@ public class LocationPresets {
 		this.dropboxLocation = new SimpleObjectProperty<>(existingWritablePath(DROPBOX_LOCATIONS));
 		this.gdriveLocation = new SimpleObjectProperty<>(existingWritablePath(GDRIVE_LOCATIONS));
 		this.onedriveLocation = new SimpleObjectProperty<>(existingWritablePath(ONEDRIVE_LOCATIONS));
+		this.megaLocation = new SimpleObjectProperty<>(existingWritablePath(MEGA_LOCATIONS));
+		this.pcloudLocation = new SimpleObjectProperty<>(existingWritablePath(PCLOUD_LOCATIONS));
 		this.foundIclouddrive = iclouddriveLocation.isNotNull();
 		this.foundDropbox = dropboxLocation.isNotNull();
 		this.foundGdrive = gdriveLocation.isNotNull();
 		this.foundOnedrive = onedriveLocation.isNotNull();
+		this.foundMega = megaLocation.isNotNull();
+		this.foundPcloud = pcloudLocation.isNotNull();
 	}
 
 	private static Path existingWritablePath(String... candidates) {
@@ -122,4 +132,36 @@ public class LocationPresets {
 		return foundOnedrive.get();
 	}
 
+	public ReadOnlyObjectProperty<Path> megaLocationProperty() {
+		return megaLocation;
+	}
+
+	public Path getMegaLocation() {
+		return megaLocation.get();
+	}
+
+	public BooleanBinding foundMegaProperty() {
+		return foundMega;
+	}
+
+	public boolean isFoundMega() {
+		return foundMega.get();
+	}
+
+	public ReadOnlyObjectProperty<Path> pcloudLocationProperty() {
+		return pcloudLocation;
+	}
+
+	public Path getPcloudLocation() {
+		return pcloudLocation.get();
+	}
+
+	public BooleanBinding foundPcloudProperty() {
+		return foundPcloud;
+	}
+
+	public boolean isFoundPcloud() {
+		return foundPcloud.get();
+	}
+
 }

main/ui/src/main/java/org/cryptomator/ui/changepassword/ChangePasswordController.java

@@ -2,29 +2,33 @@ package org.cryptomator.ui.changepassword;
 
 import org.cryptomator.common.keychain.KeychainManager;
 import org.cryptomator.common.vaults.Vault;
-import org.cryptomator.cryptofs.CryptoFileSystemProvider;
+import org.cryptomator.cryptofs.common.MasterkeyBackupHelper;
+import org.cryptomator.cryptolib.api.CryptoException;
 import org.cryptomator.cryptolib.api.InvalidPassphraseException;
+import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
 import org.cryptomator.integrations.keychain.KeychainAccessException;
 import org.cryptomator.ui.common.Animations;
 import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.controls.NiceSecurePasswordField;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
-import javax.inject.Named;
-import javafx.beans.binding.Bindings;
 import javafx.beans.binding.BooleanBinding;
-import javafx.beans.property.ObjectProperty;
 import javafx.fxml.FXML;
 import javafx.scene.control.Button;
 import javafx.scene.control.CheckBox;
 import javafx.stage.Stage;
 import java.io.IOException;
-import java.nio.CharBuffer;
-import java.util.Optional;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.security.SecureRandom;
 
+import static org.cryptomator.common.Constants.MASTERKEY_BACKUP_SUFFIX;
 import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
 
 @ChangePasswordScoped
@@ -34,29 +38,36 @@ public class ChangePasswordController implements FxController {
 
 	private final Stage window;
 	private final Vault vault;
-	private final ObjectProperty<CharSequence> newPassword;
 	private final ErrorComponent.Builder errorComponent;
 	private final KeychainManager keychain;
+	private final SecureRandom csprng;
+	private final MasterkeyFileAccess masterkeyFileAccess;
 
 	public NiceSecurePasswordField oldPasswordField;
 	public CheckBox finalConfirmationCheckbox;
 	public Button finishButton;
+	public NewPasswordController newPasswordController;
 
 	@Inject
-	public ChangePasswordController(@ChangePasswordWindow Stage window, @ChangePasswordWindow Vault vault, @Named("newPassword") ObjectProperty<CharSequence> newPassword, ErrorComponent.Builder errorComponent, KeychainManager keychain) {
+	public ChangePasswordController(@ChangePasswordWindow Stage window, @ChangePasswordWindow Vault vault, ErrorComponent.Builder errorComponent, KeychainManager keychain, SecureRandom csprng, MasterkeyFileAccess masterkeyFileAccess) {
 		this.window = window;
 		this.vault = vault;
-		this.newPassword = newPassword;
 		this.errorComponent = errorComponent;
 		this.keychain = keychain;
+		this.csprng = csprng;
+		this.masterkeyFileAccess = masterkeyFileAccess;
 	}
 
 	@FXML
 	public void initialize() {
 		BooleanBinding checkboxNotConfirmed = finalConfirmationCheckbox.selectedProperty().not();
 		BooleanBinding oldPasswordFieldEmpty = oldPasswordField.textProperty().isEmpty();
-		BooleanBinding newPasswordInvalid = Bindings.createBooleanBinding(() -> newPassword.get() == null || newPassword.get().length() == 0, newPassword);
-		finishButton.disableProperty().bind(checkboxNotConfirmed.or(oldPasswordFieldEmpty).or(newPasswordInvalid));
+		finishButton.disableProperty().bind(checkboxNotConfirmed.or(oldPasswordFieldEmpty).or(newPasswordController.passwordsMatchAndSufficientProperty().not()));
+		window.setOnHiding(event -> {
+			oldPasswordField.wipe();
+			newPasswordController.passwordField.wipe();
+			newPasswordController.reenterField.wipe();
+		});
 	}
 
 	@FXML
@@ -67,24 +78,31 @@ public class ChangePasswordController implements FxController {
 	@FXML
 	public void finish() {
 		try {
-			CryptoFileSystemProvider.changePassphrase(vault.getPath(), MASTERKEY_FILENAME, oldPasswordField.getCharacters(), newPassword.get());
+			CharSequence oldPassphrase = oldPasswordField.getCharacters();
+			CharSequence newPassphrase = newPasswordController.passwordField.getCharacters();
+			Path masterkeyPath = vault.getPath().resolve(MASTERKEY_FILENAME);
+			byte[] oldMasterkeyBytes = Files.readAllBytes(masterkeyPath);
+			byte[] newMasterkeyBytes = masterkeyFileAccess.changePassphrase(oldMasterkeyBytes, oldPassphrase, newPassphrase);
+			Path backupKeyPath = vault.getPath().resolve(MASTERKEY_FILENAME + MasterkeyBackupHelper.generateFileIdSuffix(oldMasterkeyBytes) + MASTERKEY_BACKUP_SUFFIX);
+			Files.move(masterkeyPath, backupKeyPath, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+			Files.write(masterkeyPath, newMasterkeyBytes, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
 			LOG.info("Successfully changed password for {}", vault.getDisplayName());
-			window.close();
 			updatePasswordInSystemkeychain();
-		} catch (IOException e) {
-			LOG.error("IO error occured during password change. Unable to perform operation.", e);
-			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+			window.close();
 		} catch (InvalidPassphraseException e) {
 			Animations.createShakeWindowAnimation(window).play();
 			oldPasswordField.selectAll();
 			oldPasswordField.requestFocus();
+		} catch (IOException | CryptoException e) {
+			LOG.error("Password change failed. Unable to perform operation.", e);
+			errorComponent.cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
 		}
 	}
 
 	private void updatePasswordInSystemkeychain() {
 		if (keychain.isSupported()) {
 			try {
-				keychain.changePassphrase(vault.getId(), CharBuffer.wrap(newPassword.get()));
+				keychain.changePassphrase(vault.getId(), newPasswordController.passwordField.getCharacters());
 				LOG.info("Successfully updated password in system keychain for {}", vault.getDisplayName());
 			} catch (KeychainAccessException e) {
 				LOG.error("Failed to update password in system keychain.", e);

main/ui/src/main/java/org/cryptomator/ui/changepassword/ChangePasswordModule.java

@@ -5,10 +5,10 @@ import dagger.Module;
 import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.NewPasswordController;
 import org.cryptomator.ui.common.PasswordStrengthUtil;
@@ -16,8 +16,6 @@ import org.cryptomator.ui.common.StageFactory;
 
 import javax.inject.Named;
 import javax.inject.Provider;
-import javafx.beans.property.ObjectProperty;
-import javafx.beans.property.SimpleObjectProperty;
 import javafx.scene.Scene;
 import javafx.stage.Modality;
 import javafx.stage.Stage;
@@ -27,18 +25,11 @@ import java.util.ResourceBundle;
 @Module
 abstract class ChangePasswordModule {
 
-	@Provides
-	@ChangePasswordScoped
-	@Named("newPassword")
-	static ObjectProperty<CharSequence> provideNewPasswordProperty() {
-		return new SimpleObjectProperty<>("");
-	}
-
 	@Provides
 	@ChangePasswordWindow
 	@ChangePasswordScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -56,8 +47,8 @@ abstract class ChangePasswordModule {
 	@Provides
 	@FxmlScene(FxmlFile.CHANGEPASSWORD)
 	@ChangePasswordScoped
-	static Scene provideUnlockScene(@ChangePasswordWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/changepassword.fxml");
+	static Scene provideUnlockScene(@ChangePasswordWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.CHANGEPASSWORD);
 	}
 
 
@@ -71,8 +62,8 @@ abstract class ChangePasswordModule {
 	@Provides
 	@IntoMap
 	@FxControllerKey(NewPasswordController.class)
-	static FxController provideNewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater, @Named("newPassword") ObjectProperty<CharSequence> password) {
-		return new NewPasswordController(resourceBundle, strengthRater, password);
+	static FxController provideNewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater) {
+		return new NewPasswordController(resourceBundle, strengthRater);
 	}
 
 }

main/ui/src/main/java/org/cryptomator/ui/common/DefaultSceneFactory.java

@@ -42,8 +42,8 @@ public class DefaultSceneFactory implements Function<Parent, Scene> {
 	protected void configureScene(Scene scene) {
 		scene.windowProperty().addListener(observable -> {
 			Window window = scene.getWindow();
-			if (window instanceof Stage) {
-				setupDefaultAccelerators(scene, (Stage) window);
+			if (window instanceof Stage s) {
+				setupDefaultAccelerators(scene, s);
 			}
 		});
 	}

main/ui/src/main/java/org/cryptomator/ui/common/ErrorModule.java

@@ -18,8 +18,8 @@ import java.util.ResourceBundle;
 abstract class ErrorModule {
 
 	@Provides
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -38,8 +38,8 @@ abstract class ErrorModule {
 
 	@Provides
 	@FxmlScene(FxmlFile.ERROR)
-	static Scene provideErrorScene(FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene(FxmlFile.ERROR.getRessourcePathString());
+	static Scene provideErrorScene(FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.ERROR);
 	}
 
 

main/ui/src/main/java/org/cryptomator/ui/common/FxmlFile.java

@@ -11,6 +11,8 @@ public enum FxmlFile {
 	CHANGEPASSWORD("/fxml/changepassword.fxml"), //
 	ERROR("/fxml/error.fxml"), //
 	FORGET_PASSWORD("/fxml/forget_password.fxml"), //
+	HEALTH_START("/fxml/health_start.fxml"), //
+	HEALTH_CHECK_LIST("/fxml/health_check_list.fxml"), //
 	LOCK_FORCED("/fxml/lock_forced.fxml"), //
 	LOCK_FAILED("/fxml/lock_failed.fxml"), //
 	MAIN_WINDOW("/fxml/main_window.fxml"), //
@@ -26,8 +28,9 @@ public enum FxmlFile {
 	RECOVERYKEY_RESET_PASSWORD("/fxml/recoverykey_reset_password.fxml"), //
 	RECOVERYKEY_SUCCESS("/fxml/recoverykey_success.fxml"), //
 	REMOVE_VAULT("/fxml/remove_vault.fxml"), //
-	UNLOCK("/fxml/unlock.fxml"),
+	UNLOCK_ENTER_PASSWORD("/fxml/unlock_enter_password.fxml"),
 	UNLOCK_INVALID_MOUNT_POINT("/fxml/unlock_invalid_mount_point.fxml"), //
+	UNLOCK_SELECT_MASTERKEYFILE("/fxml/unlock_select_masterkeyfile.fxml"), //
 	UNLOCK_SUCCESS("/fxml/unlock_success.fxml"), //
 	VAULT_OPTIONS("/fxml/vault_options.fxml"), //
 	VAULT_STATISTICS("/fxml/stats.fxml"), //
@@ -39,7 +42,7 @@ public enum FxmlFile {
 		this.ressourcePathString = ressourcePathString;
 	}
 
-	public String getRessourcePathString() {
+	String getRessourcePathString() {
 		return ressourcePathString;
 	}
 }

main/ui/src/main/java/org/cryptomator/ui/common/FxmlLoaderFactory.java

@@ -11,13 +11,13 @@ import java.util.Map;
 import java.util.ResourceBundle;
 import java.util.function.Function;
 
-public class FXMLLoaderFactory {
+public class FxmlLoaderFactory {
 
 	private final Map<Class<? extends FxController>, Provider<FxController>> controllerFactories;
 	private final Function<Parent, Scene> sceneFactory;
 	private final ResourceBundle resourceBundle;
 
-	public FXMLLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> controllerFactories, Function<Parent, Scene> sceneFactory, ResourceBundle resourceBundle) {
+	public FxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> controllerFactories, Function<Parent, Scene> sceneFactory, ResourceBundle resourceBundle) {
 		this.controllerFactories = controllerFactories;
 		this.sceneFactory = sceneFactory;
 		this.resourceBundle = resourceBundle;
@@ -48,13 +48,17 @@ public class FXMLLoaderFactory {
 		return loader;
 	}
 
+	public Scene createScene(FxmlFile fxmlFile) {
+		return createScene(fxmlFile.getRessourcePathString());
+	}
+
 	/**
 	 * {@link #load(String) Loads} the FXML file and creates a new Scene containing the loaded ui.
 	 *
 	 * @param fxmlResourceName Name of the resource (as in {@link Class#getResource(String)}).
 	 * @throws UncheckedIOException wrapping any IOException thrown by {@link #load(String)).
 	 */
-	public Scene createScene(String fxmlResourceName) {
+	private Scene createScene(String fxmlResourceName) {
 		final FXMLLoader loader;
 		try {
 			loader = load(fxmlResourceName);

main/ui/src/main/java/org/cryptomator/ui/common/NewPasswordController.java

@@ -8,7 +8,8 @@ import javafx.beans.Observable;
 import javafx.beans.binding.Bindings;
 import javafx.beans.binding.BooleanBinding;
 import javafx.beans.property.IntegerProperty;
-import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.ReadOnlyBooleanProperty;
+import javafx.beans.property.ReadOnlyBooleanWrapper;
 import javafx.beans.property.SimpleIntegerProperty;
 import javafx.fxml.FXML;
 import javafx.scene.control.Label;
@@ -18,8 +19,8 @@ public class NewPasswordController implements FxController {
 
 	private final ResourceBundle resourceBundle;
 	private final PasswordStrengthUtil strengthRater;
-	private final ObjectProperty<CharSequence> password;
 	private final IntegerProperty passwordStrength = new SimpleIntegerProperty(-1);
+	private final ReadOnlyBooleanWrapper passwordsMatchAndSufficient = new ReadOnlyBooleanWrapper();
 
 	public NiceSecurePasswordField passwordField;
 	public NiceSecurePasswordField reenterField;
@@ -31,10 +32,9 @@ public class NewPasswordController implements FxController {
 	public FontAwesome5IconView passwordMatchCheckmark;
 	public FontAwesome5IconView passwordMatchCross;
 
-	public NewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater, ObjectProperty<CharSequence> password) {
+	public NewPasswordController(ResourceBundle resourceBundle, PasswordStrengthUtil strengthRater) {
 		this.resourceBundle = resourceBundle;
 		this.strengthRater = strengthRater;
-		this.password = password;
 	}
 
 	@FXML
@@ -44,7 +44,7 @@ public class NewPasswordController implements FxController {
 		passwordStrengthLabel.graphicProperty().bind(Bindings.createObjectBinding(this::getIconViewForPasswordStrengthLabel, passwordField.textProperty(), passwordStrength));
 		passwordStrengthLabel.textProperty().bind(EasyBind.map(passwordStrength, strengthRater::getStrengthDescription));
 
-		BooleanBinding passwordsMatch = Bindings.createBooleanBinding(this::hasSamePasswordInBothFields, passwordField.textProperty(), reenterField.textProperty());
+		BooleanBinding passwordsMatch = Bindings.createBooleanBinding(this::passwordFieldsMatch, passwordField.textProperty(), reenterField.textProperty());
 		BooleanBinding reenterFieldNotEmpty = reenterField.textProperty().isNotEmpty();
 		passwordMatchLabel.visibleProperty().bind(reenterFieldNotEmpty);
 		passwordMatchLabel.graphicProperty().bind(Bindings.when(passwordsMatch.and(reenterFieldNotEmpty)).then(passwordMatchCheckmark).otherwise(passwordMatchCross));
@@ -54,6 +54,7 @@ public class NewPasswordController implements FxController {
 		reenterField.textProperty().addListener(this::passwordsDidChange);
 	}
 
+
 	private FontAwesome5IconView getIconViewForPasswordStrengthLabel() {
 		if (passwordField.getCharacters().length() == 0) {
 			return null;
@@ -67,17 +68,19 @@ public class NewPasswordController implements FxController {
 	}
 
 	private void passwordsDidChange(@SuppressWarnings("unused") Observable observable) {
-		if (hasSamePasswordInBothFields() && strengthRater.fulfillsMinimumRequirements(passwordField.getCharacters())) {
-			password.set(passwordField.getCharacters());
-		} else {
-			password.set("");
+		if (passwordFieldsMatch() && strengthRater.fulfillsMinimumRequirements(passwordField.getCharacters())) {
+			passwordsMatchAndSufficient.setValue(true);
 		}
 	}
 
-	private boolean hasSamePasswordInBothFields() {
+	private boolean passwordFieldsMatch() {
 		return CharSequence.compare(passwordField.getCharacters(), reenterField.getCharacters()) == 0;
 	}
 
+	public ReadOnlyBooleanProperty passwordsMatchAndSufficientProperty() {
+		return passwordsMatchAndSufficient.getReadOnlyProperty();
+	}
+
 	/* Getter/Setter */
 
 	public IntegerProperty passwordStrengthProperty() {

main/ui/src/main/java/org/cryptomator/ui/common/VaultService.java

@@ -1,5 +1,6 @@
 package org.cryptomator.ui.common;
 
+import org.cryptomator.common.vaults.LockNotCompletedException;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.common.vaults.Volume;
@@ -175,24 +176,29 @@ public class VaultService {
 		}
 
 		@Override
-		protected Vault call() throws Volume.VolumeException {
+		protected Vault call() throws Volume.VolumeException, LockNotCompletedException {
 			vault.lock(forced);
 			return vault;
 		}
 
 		@Override
 		protected void scheduled() {
-			vault.setState(VaultState.PROCESSING);
+			vault.stateProperty().transition(VaultState.Value.UNLOCKED, VaultState.Value.PROCESSING);
 		}
 
 		@Override
 		protected void succeeded() {
-			vault.setState(VaultState.LOCKED);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.LOCKED);
 		}
 
 		@Override
 		protected void failed() {
-			vault.setState(VaultState.UNLOCKED);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.UNLOCKED);
+		}
+
+		@Override
+		protected void cancelled() {
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.UNLOCKED);
 		}
 
 	}

main/ui/src/main/java/org/cryptomator/ui/controls/FontAwesome5Icon.java

@@ -6,8 +6,10 @@ package org.cryptomator.ui.controls;
 public enum FontAwesome5Icon {
 	ANCHOR("\uF13D"), //
 	ARROW_UP("\uF062"), //
+	BAN("\uF05E"), //
 	BUG("\uF188"), //
 	CHECK("\uF00C"), //
+	CLOCK("\uF017"), //
 	COG("\uF013"), //
 	COGS("\uF085"), //
 	COPY("\uF0C5"), //

main/ui/src/main/java/org/cryptomator/ui/controls/FormattedLabel.java

@@ -12,6 +12,7 @@ public class FormattedLabel extends Label {
 
 	private final StringProperty format = new SimpleStringProperty("");
 	private final ObjectProperty<Object> arg1 = new SimpleObjectProperty<>();
+	private final ObjectProperty<Object> arg2 = new SimpleObjectProperty<>();
 	// add arg2, arg3, ... on demand
 
 	public FormattedLabel() {
@@ -19,11 +20,11 @@ public class FormattedLabel extends Label {
 	}
 
 	protected StringBinding createStringBinding() {
-		return Bindings.createStringBinding(this::updateText, format, arg1);
+		return Bindings.createStringBinding(this::updateText, format, arg1, arg2);
 	}
 
 	private String updateText() {
-		return String.format(format.get(), arg1.get());
+		return String.format(format.get(), arg1.get(), arg2.get());
 	}
 
 	/* Observables */
@@ -51,4 +52,16 @@ public class FormattedLabel extends Label {
 	public void setArg1(Object arg1) {
 		this.arg1.set(arg1);
 	}
+
+	public ObjectProperty<Object> arg2Property() {
+		return arg2;
+	}
+
+	public Object getArg2() {
+		return arg2.get();
+	}
+
+	public void setArg2(Object arg2) {
+		this.arg2.set(arg2);
+	}
 }

main/ui/src/main/java/org/cryptomator/ui/controls/SecurePasswordField.java

@@ -123,7 +123,7 @@ public class SecurePasswordField extends TextField {
 	}
 
 	private void updateCapsLocked() {
-		// AWT code needed until https://bugs.openjdk.java.net/browse/JDK-8090882 is closed:
+		//TODO: fixed in JavaFX 17. AWT code needed until update (see https://bugs.openjdk.java.net/browse/JDK-8259680)
 		capsLocked.set(isFocused() && Toolkit.getDefaultToolkit().getLockingKeyState(java.awt.event.KeyEvent.VK_CAPS_LOCK));
 	}
 

main/ui/src/main/java/org/cryptomator/ui/forgetPassword/ForgetPasswordModule.java

@@ -5,7 +5,7 @@ import dagger.Module;
 import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
@@ -29,8 +29,8 @@ abstract class ForgetPasswordModule {
 	@Provides
 	@ForgetPasswordWindow
 	@ForgetPasswordScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -62,8 +62,8 @@ abstract class ForgetPasswordModule {
 	@Provides
 	@FxmlScene(FxmlFile.FORGET_PASSWORD)
 	@ForgetPasswordScoped
-	static Scene provideForgetPasswordScene(@ForgetPasswordWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/forget_password.fxml");
+	static Scene provideForgetPasswordScene(@ForgetPasswordWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.FORGET_PASSWORD);
 	}
 
 	// ------------------

main/ui/src/main/java/org/cryptomator/ui/fxapp/FxApplication.java

@@ -5,11 +5,13 @@ import org.cryptomator.common.LicenseHolder;
 import org.cryptomator.common.settings.Settings;
 import org.cryptomator.common.settings.UiTheme;
 import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.integrations.tray.TrayIntegrationProvider;
 import org.cryptomator.integrations.uiappearance.Theme;
 import org.cryptomator.integrations.uiappearance.UiAppearanceException;
 import org.cryptomator.integrations.uiappearance.UiAppearanceListener;
 import org.cryptomator.integrations.uiappearance.UiAppearanceProvider;
+import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.VaultService;
 import org.cryptomator.ui.lock.LockComponent;
 import org.cryptomator.ui.mainwindow.MainWindowComponent;
@@ -44,8 +46,9 @@ public class FxApplication extends Application {
 	private final Lazy<MainWindowComponent> mainWindow;
 	private final Lazy<PreferencesComponent> preferencesWindow;
 	private final Lazy<QuitComponent> quitWindow;
-	private final Provider<UnlockComponent.Builder> unlockWindowBuilderProvider;
-	private final Provider<LockComponent.Builder> lockWindowBuilderProvider;
+	private final Provider<UnlockComponent.Builder> unlockWorkflowBuilderProvider;
+	private final Provider<LockComponent.Builder> lockWorkflowBuilderProvider;
+	private final ErrorComponent.Builder errorWindowBuilder;
 	private final Optional<TrayIntegrationProvider> trayIntegration;
 	private final Optional<UiAppearanceProvider> appearanceProvider;
 	private final VaultService vaultService;
@@ -55,13 +58,14 @@ public class FxApplication extends Application {
 	private final UiAppearanceListener systemInterfaceThemeListener = this::systemInterfaceThemeChanged;
 
 	@Inject
-	FxApplication(Settings settings, Lazy<MainWindowComponent> mainWindow, Lazy<PreferencesComponent> preferencesWindow, Provider<UnlockComponent.Builder> unlockWindowBuilderProvider, Provider<LockComponent.Builder> lockWindowBuilderProvider, Lazy<QuitComponent> quitWindow, Optional<TrayIntegrationProvider> trayIntegration, Optional<UiAppearanceProvider> appearanceProvider, VaultService vaultService, LicenseHolder licenseHolder) {
+	FxApplication(Settings settings, Lazy<MainWindowComponent> mainWindow, Lazy<PreferencesComponent> preferencesWindow, Provider<UnlockComponent.Builder> unlockWorkflowBuilderProvider, Provider<LockComponent.Builder> lockWorkflowBuilderProvider, Lazy<QuitComponent> quitWindow, ErrorComponent.Builder errorWindowBuilder, Optional<TrayIntegrationProvider> trayIntegration, Optional<UiAppearanceProvider> appearanceProvider, VaultService vaultService, LicenseHolder licenseHolder) {
 		this.settings = settings;
 		this.mainWindow = mainWindow;
 		this.preferencesWindow = preferencesWindow;
-		this.unlockWindowBuilderProvider = unlockWindowBuilderProvider;
-		this.lockWindowBuilderProvider = lockWindowBuilderProvider;
+		this.unlockWorkflowBuilderProvider = unlockWorkflowBuilderProvider;
+		this.lockWorkflowBuilderProvider = lockWorkflowBuilderProvider;
 		this.quitWindow = quitWindow;
+		this.errorWindowBuilder = errorWindowBuilder;
 		this.trayIntegration = trayIntegration;
 		this.appearanceProvider = appearanceProvider;
 		this.vaultService = vaultService;
@@ -86,7 +90,7 @@ public class FxApplication extends Application {
 	}
 
 	private void hasVisibleStagesChanged(@SuppressWarnings("unused") ObservableValue<? extends Boolean> observableValue, @SuppressWarnings("unused") boolean oldValue, boolean newValue) {
-		LOG.warn("has visible stages: {}", newValue);
+		LOG.debug("has visible stages: {}", newValue);
 		if (newValue) {
 			trayIntegration.ifPresent(TrayIntegrationProvider::restoredFromTray);
 		} else {
@@ -113,15 +117,23 @@ public class FxApplication extends Application {
 
 	public void startUnlockWorkflow(Vault vault, Optional<Stage> owner) {
 		Platform.runLater(() -> {
-			unlockWindowBuilderProvider.get().vault(vault).owner(owner).build().startUnlockWorkflow();
-			LOG.debug("Showing UnlockWindow for {}", vault.getDisplayName());
+			if (vault.stateProperty().transition(VaultState.Value.LOCKED, VaultState.Value.PROCESSING)) {
+				unlockWorkflowBuilderProvider.get().vault(vault).owner(owner).build().startUnlockWorkflow();
+				LOG.debug("Start unlock workflow for {}", vault.getDisplayName());
+			} else {
+				showMainWindow().thenAccept(mainWindow -> errorWindowBuilder.window(mainWindow).cause(new IllegalStateException("Unable to unlock vault in non-locked state.")));
+			}
 		});
 	}
 
 	public void startLockWorkflow(Vault vault, Optional<Stage> owner) {
 		Platform.runLater(() -> {
-			lockWindowBuilderProvider.get().vault(vault).owner(owner).build().startLockWorkflow();
-			LOG.debug("Start lock workflow for {}", vault.getDisplayName());
+			if (vault.stateProperty().transition(VaultState.Value.UNLOCKED, VaultState.Value.PROCESSING)) {
+				lockWorkflowBuilderProvider.get().vault(vault).owner(owner).build().startLockWorkflow();
+				LOG.debug("Start lock workflow for {}", vault.getDisplayName());
+			} else {
+				showMainWindow().thenAccept(mainWindow -> errorWindowBuilder.window(mainWindow).cause(new IllegalStateException("Unable to lock vault in non-unlocked state.")));
+			}
 		});
 	}
 
@@ -137,13 +149,13 @@ public class FxApplication extends Application {
 	}
 
 	private void appThemeChanged(@SuppressWarnings("unused") ObservableValue<? extends UiTheme> observable, @SuppressWarnings("unused") UiTheme oldValue, UiTheme newValue) {
-		appearanceProvider.ifPresent(appearanceProvider -> {
+		if (appearanceProvider.isPresent() && oldValue == UiTheme.AUTOMATIC && newValue != UiTheme.AUTOMATIC) {
 			try {
-				appearanceProvider.removeListener(systemInterfaceThemeListener);
+				appearanceProvider.get().removeListener(systemInterfaceThemeListener);
 			} catch (UiAppearanceException e) {
 				LOG.error("Failed to disable automatic theme switching.");
 			}
-		});
+		}
 		loadSelectedStyleSheet(newValue);
 	}
 

main/ui/src/main/java/org/cryptomator/ui/fxapp/UpdateCheckerModule.java

@@ -15,6 +15,7 @@ import javafx.beans.property.StringProperty;
 import javafx.concurrent.ScheduledService;
 import javafx.concurrent.Task;
 import javafx.util.Duration;
+import java.io.UncheckedIOException;
 import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
@@ -39,8 +40,13 @@ public abstract class UpdateCheckerModule {
 
 	@Provides
 	@FxApplicationScoped
-	static HttpClient provideHttpClient() {
-		return HttpClient.newHttpClient();
+	static Optional<HttpClient> provideHttpClient() {
+		try {
+			return Optional.of(HttpClient.newHttpClient());
+		} catch (UncheckedIOException e) {
+			LOG.error("HttpClient for update check cannot be created.", e);
+			return Optional.empty();
+		}
 	}
 
 	@Provides
@@ -66,11 +72,20 @@ public abstract class UpdateCheckerModule {
 
 	@Provides
 	@FxApplicationScoped
-	static ScheduledService<String> provideCheckForUpdatesService(ExecutorService executor, HttpClient httpClient, HttpRequest checkForUpdatesRequest, @Named("checkForUpdatesInterval") ObjectBinding<Duration> period) {
+	static ScheduledService<String> provideCheckForUpdatesService(ExecutorService executor, Optional<HttpClient> httpClient, HttpRequest checkForUpdatesRequest, @Named("checkForUpdatesInterval") ObjectBinding<Duration> period) {
 		ScheduledService<String> service = new ScheduledService<>() {
 			@Override
 			protected Task<String> createTask() {
-				return new UpdateCheckerTask(httpClient, checkForUpdatesRequest);
+				if (httpClient.isPresent()) {
+					return new UpdateCheckerTask(httpClient.get(), checkForUpdatesRequest);
+				} else {
+					return new Task<>() {
+						@Override
+						protected String call() {
+							throw new NullPointerException("No HttpClient present.");
+						}
+					};
+				}
 			}
 		};
 		service.setOnFailed(event -> LOG.error("Failed to execute update service", service.getException()));

main/ui/src/main/java/org/cryptomator/ui/health/BatchService.java

@@ -0,0 +1,36 @@
+package org.cryptomator.ui.health;
+
+import com.google.common.base.Preconditions;
+import com.google.common.base.Suppliers;
+import dagger.Lazy;
+
+import javax.inject.Inject;
+import javafx.concurrent.Service;
+import javafx.concurrent.Task;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.concurrent.ExecutorService;
+import java.util.function.Supplier;
+
+public class BatchService extends Service<Void> {
+
+	private final Iterator<HealthCheckTask> remainingTasks;
+
+	@Inject
+	public BatchService(Iterable<HealthCheckTask> tasks) {
+		this.remainingTasks = tasks.iterator();
+	}
+
+	@Override
+	protected Task<Void> createTask() {
+		Preconditions.checkState(remainingTasks.hasNext(), "No remaining tasks");
+		return remainingTasks.next();
+	}
+
+	@Override
+	protected void succeeded() {
+		if (remainingTasks.hasNext()) {
+			this.restart();
+		}
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/health/CheckDetailController.java

@@ -0,0 +1,170 @@
+package org.cryptomator.ui.health;
+
+import com.tobiasdiez.easybind.EasyBind;
+import com.tobiasdiez.easybind.EasyObservableList;
+import com.tobiasdiez.easybind.Subscription;
+import com.tobiasdiez.easybind.optional.OptionalBinding;
+import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.ui.common.FxController;
+
+import javax.inject.Inject;
+import javafx.beans.binding.Binding;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.collections.FXCollections;
+import javafx.concurrent.Worker;
+import javafx.fxml.FXML;
+import javafx.scene.control.ListView;
+import java.util.function.Function;
+import java.util.stream.Stream;
+
+@HealthCheckScoped
+public class CheckDetailController implements FxController {
+
+	private final EasyObservableList<DiagnosticResult> results;
+	private final OptionalBinding<Worker.State> taskState;
+	private final Binding<String> taskName;
+	private final Binding<Number> taskDuration;
+	private final ResultListCellFactory resultListCellFactory;
+	private final Binding<Boolean> taskRunning;
+	private final Binding<Boolean> taskScheduled;
+	private final Binding<Boolean> taskFinished;
+	private final Binding<Boolean> taskNotStarted;
+	private final Binding<Boolean> taskSucceeded;
+	private final Binding<Boolean> taskFailed;
+	private final Binding<Boolean> taskCancelled;
+	private final Binding<Number> countOfWarnSeverity;
+	private final Binding<Number> countOfCritSeverity;
+
+	public ListView<DiagnosticResult> resultsListView;
+	private Subscription resultSubscription;
+
+	@Inject
+	public CheckDetailController(ObjectProperty<HealthCheckTask> selectedTask, ResultListCellFactory resultListCellFactory) {
+		this.results = EasyBind.wrapList(FXCollections.observableArrayList());
+		this.taskState = EasyBind.wrapNullable(selectedTask).mapObservable(HealthCheckTask::stateProperty);
+		this.taskName = EasyBind.wrapNullable(selectedTask).map(HealthCheckTask::getTitle).orElse("");
+		this.taskDuration = EasyBind.wrapNullable(selectedTask).mapObservable(HealthCheckTask::durationInMillisProperty).orElse(-1L);
+		this.resultListCellFactory = resultListCellFactory;
+		this.taskRunning = EasyBind.wrapNullable(selectedTask).mapObservable(HealthCheckTask::runningProperty).orElse(false); //TODO: DOES NOT WORK
+		this.taskScheduled = taskState.map(Worker.State.SCHEDULED::equals).orElse(false);
+		this.taskNotStarted = taskState.map(Worker.State.READY::equals).orElse(false);
+		this.taskSucceeded = taskState.map(Worker.State.SUCCEEDED::equals).orElse(false);
+		this.taskFailed = taskState.map(Worker.State.FAILED::equals).orElse(false);
+		this.taskCancelled = taskState.map(Worker.State.CANCELLED::equals).orElse(false);
+		this.taskFinished = EasyBind.combine(taskSucceeded, taskFailed, taskCancelled, (a, b, c) -> a || b || c);
+		this.countOfWarnSeverity = results.reduce(countSeverity(DiagnosticResult.Severity.WARN));
+		this.countOfCritSeverity = results.reduce(countSeverity(DiagnosticResult.Severity.CRITICAL));
+		selectedTask.addListener(this::selectedTaskChanged);
+	}
+
+	private void selectedTaskChanged(ObservableValue<? extends HealthCheckTask> observable, HealthCheckTask oldValue, HealthCheckTask newValue) {
+		if (resultSubscription != null) {
+			resultSubscription.unsubscribe();
+		}
+		if (newValue != null) {
+			resultSubscription = EasyBind.bindContent(results, newValue.results());
+		}
+	}
+
+	private Function<Stream<? extends DiagnosticResult>, Long> countSeverity(DiagnosticResult.Severity severity) {
+		return stream -> stream.filter(item -> severity.equals(item.getServerity())).count();
+	}
+
+	@FXML
+	public void initialize() {
+		resultsListView.setItems(results);
+		resultsListView.setCellFactory(resultListCellFactory);
+	}
+
+	/* Getter/Setter */
+
+	public String getTaskName() {
+		return taskName.getValue();
+	}
+
+	public Binding<String> taskNameProperty() {
+		return taskName;
+	}
+
+	public Number getTaskDuration() {
+		return taskDuration.getValue();
+	}
+
+	public Binding<Number> taskDurationProperty() {
+		return taskDuration;
+	}
+
+	public long getCountOfWarnSeverity() {
+		return countOfWarnSeverity.getValue().longValue();
+	}
+
+	public Binding<Number> countOfWarnSeverityProperty() {
+		return countOfWarnSeverity;
+	}
+
+	public long getCountOfCritSeverity() {
+		return countOfCritSeverity.getValue().longValue();
+	}
+
+	public Binding<Number> countOfCritSeverityProperty() {
+		return countOfCritSeverity;
+	}
+
+	public boolean isTaskRunning() {
+		return taskRunning.getValue();
+	}
+
+	public Binding<Boolean> taskRunningProperty() {
+		return taskRunning;
+	}
+
+	public boolean isTaskFinished() {
+		return taskFinished.getValue();
+	}
+
+	public Binding<Boolean> taskFinishedProperty() {
+		return taskFinished;
+	}
+
+	public boolean isTaskScheduled() {
+		return taskScheduled.getValue();
+	}
+
+	public Binding<Boolean> taskScheduledProperty() {
+		return taskScheduled;
+	}
+
+	public boolean isTaskNotStarted() {
+		return taskNotStarted.getValue();
+	}
+
+	public Binding<Boolean> taskNotStartedProperty() {
+		return taskNotStarted;
+	}
+
+	public boolean isTaskSucceeded() {
+		return taskSucceeded.getValue();
+	}
+
+	public Binding<Boolean> taskSucceededProperty() {
+		return taskSucceeded;
+	}
+
+	public boolean isTaskFailed() {
+		return taskFailed.getValue();
+	}
+
+	public Binding<Boolean> taskFailedProperty() {
+		return taskFailed;
+	}
+
+	public boolean isTaskCancelled() {
+		return taskCancelled.getValue();
+	}
+
+	public Binding<Boolean> taskCancelledProperty() {
+		return taskCancelled;
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/CheckListCell.java

@@ -0,0 +1,64 @@
+package org.cryptomator.ui.health;
+
+import org.cryptomator.ui.controls.FontAwesome5Icon;
+import org.cryptomator.ui.controls.FontAwesome5IconView;
+
+import javafx.beans.binding.Bindings;
+import javafx.beans.value.ObservableValue;
+import javafx.concurrent.Worker;
+import javafx.geometry.Insets;
+import javafx.geometry.Pos;
+import javafx.scene.Node;
+import javafx.scene.control.ContentDisplay;
+import javafx.scene.control.ListCell;
+
+class CheckListCell extends ListCell<HealthCheckTask> {
+
+	private final FontAwesome5IconView stateIcon = new FontAwesome5IconView();
+
+	CheckListCell() {
+		setPadding(new Insets(6));
+		setAlignment(Pos.CENTER_LEFT);
+		setContentDisplay(ContentDisplay.LEFT);
+	}
+
+	@Override
+	protected void updateItem(HealthCheckTask item, boolean empty) {
+		super.updateItem(item, empty);
+
+		if (item != null) {
+			textProperty().bind(item.titleProperty());
+			item.stateProperty().addListener(this::stateChanged);
+			graphicProperty().bind(Bindings.createObjectBinding(() -> graphicForState(item.getState()),item.stateProperty()));
+			stateIcon.setGlyph(glyphForState(item.getState()));
+		} else {
+			textProperty().unbind();
+			graphicProperty().unbind();
+			setGraphic(null);
+			setText(null);
+		}
+	}
+
+	private void stateChanged(ObservableValue<? extends Worker.State> observable, Worker.State oldState, Worker.State newState) {
+		stateIcon.setGlyph(glyphForState(newState));
+		stateIcon.setVisible(true);
+	}
+
+	private Node graphicForState(Worker.State state) {
+		return switch (state) {
+			case READY -> null;
+			case SCHEDULED, RUNNING, FAILED, CANCELLED, SUCCEEDED -> stateIcon;
+		};
+	}
+
+	private FontAwesome5Icon glyphForState(Worker.State state) {
+		return switch (state) {
+			case READY -> FontAwesome5Icon.COG; //just a placeholder
+			case SCHEDULED -> FontAwesome5Icon.CLOCK;
+			case RUNNING -> FontAwesome5Icon.SPINNER;
+			case FAILED -> FontAwesome5Icon.EXCLAMATION_TRIANGLE;
+			case CANCELLED -> FontAwesome5Icon.BAN;
+			case SUCCEEDED -> FontAwesome5Icon.CHECK;
+		};
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/health/CheckListController.java

@@ -0,0 +1,180 @@
+package org.cryptomator.ui.health;
+
+import com.google.common.base.Preconditions;
+import com.tobiasdiez.easybind.EasyBind;
+import dagger.Lazy;
+import org.cryptomator.ui.common.ErrorComponent;
+import org.cryptomator.ui.common.FxController;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.beans.binding.Binding;
+import javafx.beans.binding.BooleanBinding;
+import javafx.beans.property.BooleanProperty;
+import javafx.beans.property.IntegerProperty;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleBooleanProperty;
+import javafx.beans.property.SimpleIntegerProperty;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.collections.FXCollections;
+import javafx.collections.ObservableList;
+import javafx.concurrent.Worker;
+import javafx.event.ActionEvent;
+import javafx.fxml.FXML;
+import javafx.scene.control.CheckBox;
+import javafx.scene.control.ListView;
+import javafx.scene.control.cell.CheckBoxListCell;
+import javafx.stage.Stage;
+import javafx.util.StringConverter;
+import java.io.IOException;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+
+@HealthCheckScoped
+public class CheckListController implements FxController {
+
+	private static final Logger LOG = LoggerFactory.getLogger(CheckListController.class);
+	private static final Set<Worker.State> END_STATES = Set.of(Worker.State.FAILED, Worker.State.CANCELLED, Worker.State.SUCCEEDED);
+
+	private final Stage window;
+	private final ObservableList<HealthCheckTask> tasks;
+	private final ReportWriter reportWriter;
+	private final ExecutorService executorService;
+	private final ObjectProperty<HealthCheckTask> selectedTask;
+	private final Lazy<ErrorComponent.Builder> errorComponenBuilder;
+	private final SimpleObjectProperty<Worker<?>> runningTask;
+	private final Binding<Boolean> running;
+	private final Binding<Boolean> finished;
+	private final Map<HealthCheckTask, BooleanProperty> listPickIndicators;
+	private final IntegerProperty numberOfPickedChecks;
+	private final BooleanBinding anyCheckSelected;
+	private final BooleanProperty showResultScreen;
+
+	/* FXML */
+	public ListView<HealthCheckTask> checksListView;
+
+
+	@Inject
+	public CheckListController(@HealthCheckWindow Stage window, Lazy<Collection<HealthCheckTask>> tasks, ReportWriter reportWriteTask, ObjectProperty<HealthCheckTask> selectedTask, ExecutorService executorService, Lazy<ErrorComponent.Builder> errorComponenBuilder) {
+		this.window = window;
+		this.tasks = FXCollections.observableArrayList(tasks.get());
+		this.reportWriter = reportWriteTask;
+		this.executorService = executorService;
+		this.selectedTask = selectedTask;
+		this.errorComponenBuilder = errorComponenBuilder;
+		this.runningTask = new SimpleObjectProperty<>();
+		this.running = EasyBind.wrapNullable(runningTask).mapObservable(Worker::runningProperty).orElse(false);
+		this.finished = EasyBind.wrapNullable(runningTask).mapObservable(Worker::stateProperty).map(END_STATES::contains).orElse(false);
+		this.listPickIndicators = new HashMap<>();
+		this.numberOfPickedChecks = new SimpleIntegerProperty(0);
+		this.tasks.forEach(task -> {
+			var entrySelectedProp = new SimpleBooleanProperty(false);
+			entrySelectedProp.addListener((observable, oldValue, newValue) -> numberOfPickedChecks.set(numberOfPickedChecks.get() + (newValue ? 1 : -1)));
+			listPickIndicators.put(task, entrySelectedProp);
+		});
+		this.anyCheckSelected = selectedTask.isNotNull();
+		this.showResultScreen = new SimpleBooleanProperty(false);
+	}
+
+	@FXML
+	public void initialize() {
+		checksListView.setItems(tasks);
+		checksListView.setCellFactory(CheckBoxListCell.forListView(listPickIndicators::get, new StringConverter<HealthCheckTask>() {
+			@Override
+			public String toString(HealthCheckTask object) {
+				return object.getTitle();
+			}
+
+			@Override
+			public HealthCheckTask fromString(String string) {
+				return null;
+			}
+		}));
+		selectedTask.bind(checksListView.getSelectionModel().selectedItemProperty());
+	}
+
+	@FXML
+	public void toggleSelectAll(ActionEvent event) {
+		if (event.getSource() instanceof CheckBox c) {
+			listPickIndicators.forEach( (task, pickProperty) -> pickProperty.set(c.isSelected()));
+		}
+	}
+
+	@FXML
+	public void runSelectedChecks() {
+		Preconditions.checkState(runningTask.get() == null);
+		var batch = checksListView.getItems().filtered(item -> listPickIndicators.get(item).get());
+		var batchService = new BatchService(batch);
+		batchService.setExecutor(executorService);
+		batchService.start();
+		runningTask.set(batchService);
+		showResultScreen.set(true);
+		checksListView.getSelectionModel().select(batch.get(0));
+		checksListView.setCellFactory(view -> new CheckListCell());
+		window.sizeToScene();
+	}
+
+	@FXML
+	public synchronized void cancelCheck() {
+		Preconditions.checkState(runningTask.get() != null);
+		runningTask.get().cancel();
+	}
+
+	@FXML
+	public void exportResults() {
+		try {
+			reportWriter.writeReport(tasks);
+		} catch (IOException e) {
+			LOG.error("Failed to write health check report.", e);
+			errorComponenBuilder.get().cause(e).window(window).returnToScene(window.getScene()).build().showErrorScene();
+		}
+	}
+
+	/* Getter/Setter */
+	public boolean isRunning() {
+		return running.getValue();
+	}
+
+	public Binding<Boolean> runningProperty() {
+		return running;
+	}
+
+	public boolean isFinished() {
+		return finished.getValue();
+	}
+
+	public Binding<Boolean> finishedProperty() {
+		return finished;
+	}
+
+	public boolean isAnyCheckSelected() {
+		return anyCheckSelected.get();
+	}
+
+	public BooleanBinding anyCheckSelectedProperty() {
+		return anyCheckSelected;
+	}
+
+	public boolean getShowResultScreen() {
+		return showResultScreen.get();
+	}
+
+	public BooleanProperty showResultScreenProperty() {
+		return showResultScreen;
+	}
+
+	public int getNumberOfPickedChecks() {
+		return numberOfPickedChecks.get();
+	}
+
+	public IntegerProperty numberOfPickedChecksProperty() {
+		return numberOfPickedChecks;
+	}
+
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/HealthCheckComponent.java

@@ -0,0 +1,39 @@
+package org.cryptomator.ui.health;
+
+import dagger.BindsInstance;
+import dagger.Lazy;
+import dagger.Subcomponent;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlScene;
+
+import javafx.scene.Scene;
+import javafx.stage.Stage;
+
+@HealthCheckScoped
+@Subcomponent(modules = {HealthCheckModule.class})
+public interface HealthCheckComponent {
+
+	@HealthCheckWindow
+	Stage window();
+
+	@FxmlScene(FxmlFile.HEALTH_START)
+	Lazy<Scene> scene();
+
+	default Stage showHealthCheckWindow() {
+		Stage stage = window();
+		stage.setScene(scene().get());
+		stage.show();
+		return stage;
+	}
+
+	@Subcomponent.Builder
+	interface Builder {
+
+		@BindsInstance
+		Builder vault(@HealthCheckWindow Vault vault);
+
+		HealthCheckComponent build();
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/HealthCheckModule.java

@@ -0,0 +1,141 @@
+package org.cryptomator.ui.health;
+
+import dagger.Binds;
+import dagger.Module;
+import dagger.Provides;
+import dagger.multibindings.IntoMap;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptofs.VaultConfig;
+import org.cryptomator.cryptofs.health.api.HealthCheck;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.cryptomator.ui.common.DefaultSceneFactory;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.FxControllerKey;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
+import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.common.StageFactory;
+import org.cryptomator.ui.keyloading.KeyLoadingComponent;
+import org.cryptomator.ui.keyloading.KeyLoadingStrategy;
+import org.cryptomator.ui.mainwindow.MainWindow;
+
+import javax.inject.Provider;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.beans.value.ChangeListener;
+import javafx.scene.Scene;
+import javafx.stage.Modality;
+import javafx.stage.Stage;
+import java.security.SecureRandom;
+import java.util.Collection;
+import java.util.Map;
+import java.util.Optional;
+import java.util.ResourceBundle;
+import java.util.concurrent.atomic.AtomicReference;
+
+@Module(subcomponents = {KeyLoadingComponent.class})
+abstract class HealthCheckModule {
+
+	@Provides
+	@HealthCheckScoped
+	static AtomicReference<Masterkey> provideMasterkeyRef() {
+		return new AtomicReference<>();
+	}
+
+	@Provides
+	@HealthCheckScoped
+	static AtomicReference<VaultConfig> provideVaultConfigRef() {
+		return new AtomicReference<>();
+	}
+
+	@Provides
+	@HealthCheckScoped
+	static Collection<HealthCheck> provideAvailableHealthChecks() {
+		return HealthCheck.allChecks();
+	}
+
+	@Provides
+	@HealthCheckScoped
+	static ObjectProperty<HealthCheckTask> provideSelectedHealthCheckTask() {
+		return new SimpleObjectProperty<>();
+	}
+
+	/* Only inject with Lazy-Wrapper!*/
+	@Provides
+	@HealthCheckScoped
+	static Collection<HealthCheckTask> provideAvailableHealthCheckTasks(Collection<HealthCheck> availableHealthChecks, @HealthCheckWindow Vault vault, AtomicReference<Masterkey> masterkeyRef, AtomicReference<VaultConfig> vaultConfigRef, SecureRandom csprng, ResourceBundle resourceBundle) {
+		return availableHealthChecks.stream().map(check -> new HealthCheckTask(vault.getPath(), vaultConfigRef.get(), masterkeyRef.get(), csprng, check, resourceBundle)).toList();
+	}
+
+	@Provides
+	@HealthCheckWindow
+	@HealthCheckScoped
+	static KeyLoadingStrategy provideKeyLoadingStrategy(KeyLoadingComponent.Builder compBuilder, @HealthCheckWindow Vault vault, @HealthCheckWindow Stage window) {
+		return compBuilder.vault(vault).window(window).build().keyloadingStrategy();
+	}
+
+	@Provides
+	@HealthCheckWindow
+	@HealthCheckScoped
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
+	}
+
+	@Provides
+	@HealthCheckWindow
+	@HealthCheckScoped
+	static Stage provideStage(StageFactory factory, @MainWindow Stage owner, ResourceBundle resourceBundle, ChangeListener<Boolean> showingListener) {
+		Stage stage = factory.create();
+		stage.setTitle(resourceBundle.getString("health.title"));
+		stage.setResizable(true);
+		stage.initModality(Modality.WINDOW_MODAL);
+		stage.initOwner(owner);
+		stage.showingProperty().addListener(showingListener); // bind masterkey lifecycle to window
+		return stage;
+	}
+
+	@Provides
+	@HealthCheckScoped
+	static ChangeListener<Boolean> provideWindowShowingChangeListener(AtomicReference<Masterkey> masterkey) {
+		return (observable, wasShowing, isShowing) -> {
+			if (!isShowing) {
+				Optional.ofNullable(masterkey.getAndSet(null)).ifPresent(Masterkey::destroy);
+			}
+		};
+	}
+
+	@Provides
+	@FxmlScene(FxmlFile.HEALTH_START)
+	@HealthCheckScoped
+	static Scene provideHealthStartScene(@HealthCheckWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.HEALTH_START);
+	}
+
+	@Provides
+	@FxmlScene(FxmlFile.HEALTH_CHECK_LIST)
+	@HealthCheckScoped
+	static Scene provideHealthCheckListScene(@HealthCheckWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.HEALTH_CHECK_LIST);
+	}
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(StartController.class)
+	abstract FxController bindStartController(StartController controller);
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(CheckListController.class)
+	abstract FxController bindCheckController(CheckListController controller);
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(CheckDetailController.class)
+	abstract FxController bindCheckDetailController(CheckDetailController controller);
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(ResultListCellController.class)
+	abstract FxController bindResultListCellController(ResultListCellController controller);
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/HealthCheckScoped.java

@@ -0,0 +1,13 @@
+package org.cryptomator.ui.health;
+
+import javax.inject.Scope;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+@Scope
+@Documented
+@Retention(RetentionPolicy.RUNTIME)
+@interface HealthCheckScoped {
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/HealthCheckTask.java

@@ -0,0 +1,108 @@
+package org.cryptomator.ui.health;
+
+import org.cryptomator.cryptofs.VaultConfig;
+import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.cryptofs.health.api.HealthCheck;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javafx.application.Platform;
+import javafx.beans.property.LongProperty;
+import javafx.beans.property.SimpleLongProperty;
+import javafx.collections.FXCollections;
+import javafx.collections.ObservableList;
+import javafx.concurrent.Task;
+import java.nio.file.Path;
+import java.security.SecureRandom;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.MissingResourceException;
+import java.util.Objects;
+import java.util.ResourceBundle;
+import java.util.concurrent.CancellationException;
+
+class HealthCheckTask extends Task<Void> {
+
+	private static final Logger LOG = LoggerFactory.getLogger(HealthCheckTask.class);
+
+	private final Path vaultPath;
+	private final VaultConfig vaultConfig;
+	private final Masterkey masterkey;
+	private final SecureRandom csprng;
+	private final HealthCheck check;
+	private final ObservableList<DiagnosticResult> results;
+	private final LongProperty durationInMillis;
+
+	public HealthCheckTask(Path vaultPath, VaultConfig vaultConfig, Masterkey masterkey, SecureRandom csprng, HealthCheck check, ResourceBundle resourceBundle) {
+		this.vaultPath = Objects.requireNonNull(vaultPath);
+		this.vaultConfig = Objects.requireNonNull(vaultConfig);
+		this.masterkey = Objects.requireNonNull(masterkey);
+		this.csprng = Objects.requireNonNull(csprng);
+		this.check = Objects.requireNonNull(check);
+		this.results = FXCollections.observableArrayList();
+		try {
+			updateTitle(resourceBundle.getString("health." + check.identifier()));
+		} catch (MissingResourceException e) {
+			LOG.warn("Missing proper name for health check {}, falling back to default.", check.identifier());
+			updateTitle(check.identifier());
+		}
+		this.durationInMillis = new SimpleLongProperty(-1);
+	}
+
+	@Override
+	protected Void call() {
+		Instant start = Instant.now();
+		try (var masterkeyClone = masterkey.clone(); //
+			 var cryptor = vaultConfig.getCipherCombo().getCryptorProvider(csprng).withKey(masterkeyClone)) {
+			check.check(vaultPath, vaultConfig, masterkeyClone, cryptor, result -> {
+				if (isCancelled()) {
+					throw new CancellationException();
+				}
+				// FIXME: slowdown for demonstration purposes only:
+				try {
+					Thread.sleep(2000);
+				} catch (InterruptedException e) {
+					if (isCancelled()) {
+						return;
+					} else {
+						Thread.currentThread().interrupt();
+						throw new RuntimeException(e);
+					}
+				}
+				Platform.runLater(() -> results.add(result));
+			});
+		}
+		Platform.runLater(() ->durationInMillis.set(Duration.between(start, Instant.now()).toMillis()));
+		return null;
+	}
+
+	@Override
+	protected void scheduled() {
+		LOG.info("starting {}", check.identifier());
+	}
+
+	@Override
+	protected void done() {
+		LOG.info("finished {}", check.identifier());
+	}
+
+	/* Getter */
+
+	public ObservableList<DiagnosticResult> results() {
+		return results;
+	}
+
+	public HealthCheck getCheck() {
+		return check;
+	}
+
+	public LongProperty durationInMillisProperty() {
+		return durationInMillis;
+	}
+
+	public long getDurationInMillis() {
+		return durationInMillis.get();
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/HealthCheckWindow.java

@@ -0,0 +1,14 @@
+package org.cryptomator.ui.health;
+
+import javax.inject.Qualifier;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Qualifier
+@Documented
+@Retention(RUNTIME)
+@interface HealthCheckWindow {
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/ReportWriter.java

@@ -0,0 +1,105 @@
+package org.cryptomator.ui.health;
+
+import org.apache.commons.lang3.exception.ExceptionUtils;
+import org.cryptomator.common.Environment;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptofs.VaultConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.application.Application;
+import javafx.concurrent.Worker;
+import java.io.BufferedWriter;
+import java.io.IOException;
+import java.io.OutputStreamWriter;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.Collection;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.stream.Collectors;
+
+@HealthCheckScoped
+public class ReportWriter {
+
+	private static final Logger LOG = LoggerFactory.getLogger(ReportWriter.class);
+	private static final String REPORT_HEADER = """
+			**************************************
+			*   Cryptomator Vault Health Report  *
+			**************************************
+			Analyzed vault: %s (Current name "%s")
+			Vault storage path: %s
+			""";
+	private static final String REPORT_CHECK_HEADER = """
+			   
+			   
+			Check %s
+			------------------------------
+			""";
+	private static final String REPORT_CHECK_RESULT = "%8s - %s\n";
+	private static final DateTimeFormatter TIME_STAMP = DateTimeFormatter.ofPattern("yyyyMMdd-HHmmss").withZone(ZoneId.systemDefault());
+
+	private final Vault vault;
+	private final VaultConfig vaultConfig;
+	private final Application application;
+	private final Path exportDestination;
+
+	@Inject
+	public ReportWriter(@HealthCheckWindow Vault vault, AtomicReference<VaultConfig> vaultConfigRef, Application application, Environment env) {
+		this.vault = vault;
+		this.vaultConfig = Objects.requireNonNull(vaultConfigRef.get());
+		this.application = application;
+		this.exportDestination = env.getLogDir().orElse(Path.of(System.getProperty("user.home"))).resolve("healthReport_" + vault.getDisplayName() + "_" + TIME_STAMP.format(Instant.now()) + ".log");
+	}
+
+	protected void writeReport(Collection<HealthCheckTask> tasks) throws IOException {
+		try (var out = Files.newOutputStream(exportDestination, StandardOpenOption.CREATE, StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING); //
+			 var writer = new BufferedWriter(new OutputStreamWriter(out, StandardCharsets.UTF_8))) {
+			writer.write(REPORT_HEADER.formatted(vaultConfig.getId(), vault.getDisplayName(), vault.getPath()));
+			for (var task : tasks) {
+				if (task.getState() == Worker.State.READY) {
+					LOG.debug("Skipping not performed check {}.", task.getCheck().identifier());
+					continue;
+				}
+				writer.write(REPORT_CHECK_HEADER.formatted(task.getCheck().identifier()));
+				switch (task.getState()) {
+					case SUCCEEDED -> {
+						writer.write("STATUS: SUCCESS\nRESULTS:\n");
+						for (var result : task.results()) {
+							writer.write(REPORT_CHECK_RESULT.formatted(result.getServerity(), result.toString()));
+						}
+					}
+					case CANCELLED -> writer.write("STATUS: CANCELED\n");
+					case FAILED -> {
+						writer.write("STATUS: FAILED\nREASON:\n" + task.getCheck().identifier());
+						writer.write(prepareFailureMsg(task));
+					}
+					case RUNNING, SCHEDULED -> throw new IllegalStateException("Checks are still running.");
+				}
+			}
+		}
+		reveal();
+	}
+
+	private String prepareFailureMsg(HealthCheckTask task) {
+		if (task.getException() != null) {
+			return ExceptionUtils.getStackTrace(task.getException()) //
+					.lines() //
+					.map(line -> "\t\t" + line + "\n") //
+					.collect(Collectors.joining());
+		} else {
+			return "Unknown reason of failure.";
+		}
+	}
+
+	private void reveal() {
+		application.getHostServices().showDocument(exportDestination.getParent().toUri().toString());
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/health/ResultFixApplier.java

@@ -0,0 +1,47 @@
+package org.cryptomator.ui.health;
+
+import com.google.common.base.Preconditions;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptofs.VaultConfig;
+import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.scene.control.Alert;
+import java.nio.file.Path;
+import java.security.SecureRandom;
+import java.util.concurrent.atomic.AtomicReference;
+
+@HealthCheckScoped
+class ResultFixApplier {
+
+	private static final Logger LOG = LoggerFactory.getLogger(ResultFixApplier.class);
+
+	private final Path vaultPath;
+	private final SecureRandom csprng;
+	private final Masterkey masterkey;
+	private final VaultConfig vaultConfig;
+
+	@Inject
+	public ResultFixApplier(@HealthCheckWindow Vault vault, AtomicReference<Masterkey> masterkeyRef, AtomicReference<VaultConfig> vaultConfigRef, SecureRandom csprng) {
+		this.vaultPath = vault.getPath();
+		this.masterkey = masterkeyRef.get();
+		this.vaultConfig = vaultConfigRef.get();
+		this.csprng = csprng;
+	}
+
+	public void fix(DiagnosticResult result) {
+		Preconditions.checkArgument(result.getServerity() == DiagnosticResult.Severity.WARN, "Unfixable result");
+		try (var masterkeyClone = masterkey.clone(); //
+			 var cryptor = vaultConfig.getCipherCombo().getCryptorProvider(csprng).withKey(masterkeyClone)) {
+			result.fix(vaultPath, vaultConfig, masterkeyClone, cryptor);
+		} catch (Exception e) {
+			LOG.error("Failed to apply fix", e);
+			Alert alert = new Alert(Alert.AlertType.ERROR, e.getMessage());
+			alert.showAndWait();
+			//TODO: real error/not supported handling
+		}
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/health/ResultListCellController.java

@@ -0,0 +1,92 @@
+package org.cryptomator.ui.health;
+
+import com.tobiasdiez.easybind.EasyBind;
+import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.controls.FontAwesome5Icon;
+import org.cryptomator.ui.controls.FontAwesome5IconView;
+
+import javax.inject.Inject;
+import javafx.beans.binding.Binding;
+import javafx.beans.property.ObjectProperty;
+import javafx.beans.property.SimpleObjectProperty;
+import javafx.beans.value.ObservableValue;
+import javafx.fxml.FXML;
+import javafx.scene.control.Button;
+
+// unscoped because each cell needs its own controller
+public class ResultListCellController implements FxController {
+
+	private final ResultFixApplier fixApplier;
+	private final ObjectProperty<DiagnosticResult> result;
+	private final Binding<String> description;
+
+	public FontAwesome5IconView iconView;
+	public Button actionButton;
+
+	@Inject
+	public ResultListCellController(ResultFixApplier fixApplier) {
+		this.result = new SimpleObjectProperty<>(null);
+		this.description = EasyBind.wrapNullable(result).map(DiagnosticResult::toString).orElse("");
+		this.fixApplier = fixApplier;
+		result.addListener(this::updateCellContent);
+	}
+
+	private void updateCellContent(ObservableValue<? extends DiagnosticResult> observable, DiagnosticResult oldVal, DiagnosticResult newVal) {
+		iconView.getStyleClass().clear();
+		actionButton.setVisible(false);
+		//TODO: see comment in case WARN
+		actionButton.setManaged(false);
+		switch (newVal.getServerity()) {
+			case INFO -> {
+				iconView.setGlyph(FontAwesome5Icon.INFO_CIRCLE);
+				iconView.getStyleClass().add("glyph-icon-muted");
+			}
+			case GOOD -> {
+				iconView.setGlyph(FontAwesome5Icon.CHECK);
+				iconView.getStyleClass().add("glyph-icon-primary");
+			}
+			case WARN -> {
+				iconView.setGlyph(FontAwesome5Icon.EXCLAMATION_TRIANGLE);
+				iconView.getStyleClass().add("glyph-icon-orange");
+				//TODO: Neither is any fix implemented, nor it is ensured, that only fix is executed at a time with good ui indication
+				//	before both are not fix, do not show the button
+				//actionButton.setVisible(true);
+			}
+			case CRITICAL -> {
+				iconView.setGlyph(FontAwesome5Icon.TIMES);
+				iconView.getStyleClass().add("glyph-icon-red");
+			}
+		}
+	}
+
+	@FXML
+	public void runResultAction() {
+		final var realResult = result.get();
+		if (realResult != null) {
+			fixApplier.fix(realResult);
+		}
+	}
+	/* Getter & Setter */
+
+
+	public DiagnosticResult getResult() {
+		return result.get();
+	}
+
+	public void setResult(DiagnosticResult result) {
+		this.result.set(result);
+	}
+
+	public ObjectProperty<DiagnosticResult> resultProperty() {
+		return result;
+	}
+
+	public String getDescription() {
+		return description.getValue();
+	}
+
+	public Binding<String> descriptionProperty() {
+		return description;
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/health/ResultListCellFactory.java

@@ -0,0 +1,60 @@
+package org.cryptomator.ui.health;
+
+
+import org.cryptomator.cryptofs.health.api.DiagnosticResult;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
+
+import javax.inject.Inject;
+import javafx.fxml.FXMLLoader;
+import javafx.scene.Parent;
+import javafx.scene.control.ContentDisplay;
+import javafx.scene.control.ListCell;
+import javafx.scene.control.ListView;
+import javafx.util.Callback;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+
+@HealthCheckScoped
+public class ResultListCellFactory implements Callback<ListView<DiagnosticResult>, ListCell<DiagnosticResult>> {
+
+	private final FxmlLoaderFactory fxmlLoaders;
+
+	@Inject
+	ResultListCellFactory(@HealthCheckWindow FxmlLoaderFactory fxmlLoaders) {
+		this.fxmlLoaders = fxmlLoaders;
+	}
+
+	@Override
+	public ListCell<DiagnosticResult> call(ListView<DiagnosticResult> param) {
+		try {
+			FXMLLoader fxmlLoader = fxmlLoaders.load("/fxml/health_result_listcell.fxml");
+			return new ResultListCellFactory.Cell(fxmlLoader.getRoot(), fxmlLoader.getController());
+		} catch (IOException e) {
+			throw new UncheckedIOException("Failed to load /fxml/health_result_listcell.fxml.", e);
+		}
+	}
+
+	private static class Cell extends ListCell<DiagnosticResult> {
+
+		private final Parent node;
+		private final ResultListCellController controller;
+
+		public Cell(Parent node, ResultListCellController controller) {
+			this.node = node;
+			this.controller = controller;
+		}
+
+		@Override
+		protected void updateItem(DiagnosticResult item, boolean empty) {
+			super.updateItem(item, empty);
+			if (item == null || empty) {
+				setText(null);
+				setGraphic(null);
+			} else {
+				controller.setResult(item);
+				setContentDisplay(ContentDisplay.GRAPHIC_ONLY);
+				setGraphic(node);
+			}
+		}
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/health/StartController.java

@@ -0,0 +1,127 @@
+package org.cryptomator.ui.health;
+
+import dagger.Lazy;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptofs.VaultConfig;
+import org.cryptomator.cryptofs.VaultConfigLoadException;
+import org.cryptomator.cryptofs.VaultKeyInvalidException;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
+import org.cryptomator.ui.common.ErrorComponent;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.keyloading.KeyLoadingStrategy;
+import org.cryptomator.ui.unlock.UnlockCancelledException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.application.Platform;
+import javafx.fxml.FXML;
+import javafx.scene.Scene;
+import javafx.stage.Stage;
+import java.io.IOException;
+import java.util.Optional;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.atomic.AtomicReference;
+
+@HealthCheckScoped
+public class StartController implements FxController {
+
+	private static final Logger LOG = LoggerFactory.getLogger(StartController.class);
+
+	private final Stage window;
+	private final Optional<VaultConfig.UnverifiedVaultConfig> unverifiedVaultConfig;
+	private final KeyLoadingStrategy keyLoadingStrategy;
+	private final ExecutorService executor;
+	private final AtomicReference<Masterkey> masterkeyRef;
+	private final AtomicReference<VaultConfig> vaultConfigRef;
+	private final Lazy<Scene> checkScene;
+	private final Lazy<ErrorComponent.Builder> errorComponent;
+
+	/* FXML */
+
+	@Inject
+	public StartController(@HealthCheckWindow Vault vault, @HealthCheckWindow Stage window, @HealthCheckWindow KeyLoadingStrategy keyLoadingStrategy, ExecutorService executor, AtomicReference<Masterkey> masterkeyRef, AtomicReference<VaultConfig> vaultConfigRef, @FxmlScene(FxmlFile.HEALTH_CHECK_LIST) Lazy<Scene> checkScene, Lazy<ErrorComponent.Builder> errorComponent) {
+		this.window = window;
+		this.keyLoadingStrategy = keyLoadingStrategy;
+		this.executor = executor;
+		this.masterkeyRef = masterkeyRef;
+		this.vaultConfigRef = vaultConfigRef;
+		this.checkScene = checkScene;
+		this.errorComponent = errorComponent;
+
+		//TODO: this is ugly
+		//idea: delay the loading of the vault config and show a spinner (something like "check/load config") and react to the result of the loading
+		//or: load vault config in a previous step to see if it is loadable.
+		VaultConfig.UnverifiedVaultConfig tmp;
+		try {
+			tmp = vault.getUnverifiedVaultConfig();
+		} catch (IOException e) {
+			e.printStackTrace();
+			tmp =  null;
+		}
+		this.unverifiedVaultConfig = Optional.ofNullable(tmp);
+	}
+
+	@FXML
+	public void close() {
+		LOG.trace("StartController.close()");
+		window.close();
+	}
+
+	@FXML
+	public void next() {
+		LOG.trace("StartController.next()");
+		executor.submit(this::loadKey);
+	}
+
+	private void loadKey() {
+		assert !Platform.isFxApplicationThread();
+		assert unverifiedVaultConfig.isPresent();
+		try (var masterkey = keyLoadingStrategy.loadKey(unverifiedVaultConfig.orElseThrow().getKeyId())) {
+			var unverifiedCfg = unverifiedVaultConfig.get();
+			var verifiedCfg = unverifiedCfg.verify(masterkey.getEncoded(), unverifiedCfg.allegedVaultVersion());
+			vaultConfigRef.set(verifiedCfg);
+			var old = masterkeyRef.getAndSet(masterkey.clone());
+			if (old != null) {
+				old.destroy();
+			}
+			Platform.runLater(this::loadedKey);
+		} catch (MasterkeyLoadingFailedException e) {
+			if (keyLoadingStrategy.recoverFromException(e)) {
+				// retry
+				loadKey();
+			} else {
+				Platform.runLater(() -> loadingKeyFailed(e));
+			}
+		} catch (VaultKeyInvalidException e) {
+			Platform.runLater(() -> loadingKeyFailed(e));
+		} catch (VaultConfigLoadException e) {
+			Platform.runLater(() -> loadingKeyFailed(e));
+		}
+	}
+
+	private void loadedKey() {
+		LOG.debug("Loaded valid key");
+		window.setScene(checkScene.get());
+	}
+
+	private void loadingKeyFailed(Exception e) {
+		if (e instanceof UnlockCancelledException) {
+			// ok
+		} else if (e instanceof VaultKeyInvalidException) {
+			LOG.error("Invalid key"); //TODO: specific error screen
+			errorComponent.get().window(window).cause(e).build().showErrorScene();
+		} else {
+			LOG.error("Failed to load key.", e);
+			errorComponent.get().window(window).cause(e).build().showErrorScene();
+		}
+	}
+
+	public boolean isInvalidConfig() {
+		return unverifiedVaultConfig.isEmpty();
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/KeyLoading.java

@@ -0,0 +1,14 @@
+package org.cryptomator.ui.keyloading;
+
+import javax.inject.Qualifier;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Qualifier
+@Documented
+@Retention(RUNTIME)
+public @interface KeyLoading {
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingComponent.java

@@ -0,0 +1,31 @@
+package org.cryptomator.ui.keyloading;
+
+import dagger.BindsInstance;
+import dagger.Subcomponent;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptolib.api.MasterkeyLoader;
+
+import javafx.stage.Stage;
+import java.util.Map;
+import java.util.function.Supplier;
+
+@KeyLoadingScoped
+@Subcomponent(modules = {KeyLoadingModule.class})
+public interface KeyLoadingComponent {
+
+	@KeyLoading
+	KeyLoadingStrategy keyloadingStrategy();
+
+	@Subcomponent.Builder
+	interface Builder {
+
+		@BindsInstance
+		Builder vault(@KeyLoading Vault vault);
+
+		@BindsInstance
+		Builder window(@KeyLoading Stage window);
+
+		KeyLoadingComponent build();
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingModule.java

@@ -0,0 +1,42 @@
+package org.cryptomator.ui.keyloading;
+
+import dagger.Module;
+import dagger.Provides;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptofs.VaultConfig.UnverifiedVaultConfig;
+import org.cryptomator.ui.common.DefaultSceneFactory;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
+import org.cryptomator.ui.keyloading.masterkeyfile.MasterkeyFileLoadingModule;
+
+import javax.inject.Provider;
+import java.io.IOException;
+import java.net.URI;
+import java.util.Map;
+import java.util.Optional;
+import java.util.ResourceBundle;
+
+@Module(includes = {MasterkeyFileLoadingModule.class})
+abstract class KeyLoadingModule {
+
+	@Provides
+	@KeyLoading
+	@KeyLoadingScoped
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
+	}
+
+	@Provides
+	@KeyLoading
+	@KeyLoadingScoped
+	static KeyLoadingStrategy provideKeyLoaderProvider(@KeyLoading Vault vault, Map<String, Provider<KeyLoadingStrategy>> strategies) {
+		try {
+			String scheme = vault.getUnverifiedVaultConfig().getKeyId().getScheme();
+			var fallback = KeyLoadingStrategy.failed(new IllegalArgumentException("Unsupported key id " + scheme));
+			return strategies.getOrDefault(scheme, () -> fallback).get();
+		} catch (IOException e) {
+			return KeyLoadingStrategy.failed(e);
+		}
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingScoped.java

@@ -0,0 +1,13 @@
+package org.cryptomator.ui.keyloading;
+
+import javax.inject.Scope;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+@Scope
+@Documented
+@Retention(RetentionPolicy.RUNTIME)
+public @interface KeyLoadingScoped {
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/KeyLoadingStrategy.java

@@ -0,0 +1,63 @@
+package org.cryptomator.ui.keyloading;
+
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.cryptomator.cryptolib.api.MasterkeyLoader;
+import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
+
+import java.net.URI;
+
+/**
+ * A reusable, stateful {@link MasterkeyLoader}, that can deal with certain exceptions.
+ */
+@FunctionalInterface
+public interface KeyLoadingStrategy extends MasterkeyLoader {
+
+	/**
+	 * Loads a master key. This might be a long-running operation, as it may require user input or expensive computations.
+	 * <p>
+	 * If loading fails exceptionally, this strategy might be able to {@link #recoverFromException(MasterkeyLoadingFailedException) recover from this exception}, so it can be used in a further attempt.
+	 *
+	 * @param keyId An URI uniquely identifying the source and identity of the key
+	 * @return The raw key bytes. Must not be null
+	 * @throws MasterkeyLoadingFailedException Thrown when it is impossible to fulfill the request
+	 */
+	@Override
+	Masterkey loadKey(URI keyId) throws MasterkeyLoadingFailedException;
+
+	/**
+	 * Allows the loader to try and recover from an exception thrown during the last attempt.
+	 *
+	 * @param exception An exception thrown by {@link #loadKey(URI)}.
+	 * @return <code>true</code> if this component was able to handle the exception and another attempt can be made to load a masterkey
+	 */
+	default boolean recoverFromException(MasterkeyLoadingFailedException exception) {
+		return false;
+	}
+
+	/**
+	 * Release any ressources or do follow-up tasks after loading a key.
+	 *
+	 * @param unlockedSuccessfully <code>true</code> if successfully unlocked a vault with the loaded key
+	 * @implNote This method might be invoked multiple times, depending on whether multiple attempts to load a key are started.
+	 */
+	default void cleanup(boolean unlockedSuccessfully) {
+		// no-op
+	}
+
+	/**
+	 * A key loading strategy that will always fail by throwing a {@link MasterkeyLoadingFailedException}.
+	 *
+	 * @param exception The cause of the failure. If not alreay an {@link MasterkeyLoadingFailedException}, it will get wrapped.
+	 * @return A new KeyLoadingStrategy that will always fail with an {@link MasterkeyLoadingFailedException}.
+	 */
+	static KeyLoadingStrategy failed(Exception exception) {
+		return keyid -> {
+			if (exception instanceof MasterkeyLoadingFailedException e) {
+				throw e;
+			} else {
+				throw new MasterkeyLoadingFailedException("Can not load key", exception);
+			}
+		};
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/MasterkeyFileLoadingFinisher.java

@@ -0,0 +1,62 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import org.cryptomator.common.keychain.KeychainManager;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.keyloading.KeyLoadingScoped;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import java.nio.CharBuffer;
+import java.util.Arrays;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+
+@KeyLoadingScoped
+class MasterkeyFileLoadingFinisher {
+
+	private static final Logger LOG = LoggerFactory.getLogger(MasterkeyFileLoadingFinisher.class);
+
+	private final Vault vault;
+	private final Optional<char[]> storedPassword;
+	private final AtomicReference<char[]> enteredPassword;
+	private final AtomicBoolean shouldSavePassword;
+	private final KeychainManager keychain;
+
+	@Inject
+	MasterkeyFileLoadingFinisher(@KeyLoading Vault vault, @Named("savedPassword") Optional<char[]> storedPassword, AtomicReference<char[]> enteredPassword, @Named("savePassword") AtomicBoolean shouldSavePassword, KeychainManager keychain) {
+		this.vault = vault;
+		this.storedPassword = storedPassword;
+		this.enteredPassword = enteredPassword;
+		this.shouldSavePassword = shouldSavePassword;
+		this.keychain = keychain;
+	}
+
+	public void cleanup(boolean successfullyUnlocked) {
+		if (successfullyUnlocked && shouldSavePassword.get()) {
+			savePasswordToSystemkeychain();
+		}
+		wipePassword(storedPassword.orElse(null));
+		wipePassword(enteredPassword.getAndSet(null));
+	}
+
+	private void savePasswordToSystemkeychain() {
+		if (keychain.isSupported()) {
+			try {
+				keychain.storePassphrase(vault.getId(), CharBuffer.wrap(enteredPassword.get()));
+			} catch (KeychainAccessException e) {
+				LOG.error("Failed to store passphrase in system keychain.", e);
+			}
+		}
+	}
+
+	private void wipePassword(char[] pw) {
+		if (pw != null) {
+			Arrays.fill(pw, ' ');
+		}
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/MasterkeyFileLoadingModule.java

@@ -0,0 +1,123 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import dagger.Binds;
+import dagger.Module;
+import dagger.Provides;
+import dagger.multibindings.IntoMap;
+import dagger.multibindings.StringKey;
+import org.cryptomator.common.keychain.KeychainManager;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.integrations.keychain.KeychainAccessException;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.FxControllerKey;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
+import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.common.UserInteractionLock;
+import org.cryptomator.ui.forgetPassword.ForgetPasswordComponent;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.keyloading.KeyLoadingScoped;
+import org.cryptomator.ui.keyloading.KeyLoadingStrategy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Named;
+import javafx.scene.Scene;
+import java.nio.file.Path;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+
+@Module(subcomponents = {ForgetPasswordComponent.class})
+public abstract class MasterkeyFileLoadingModule {
+
+	private static final Logger LOG = LoggerFactory.getLogger(MasterkeyFileLoadingModule.class);
+
+	public enum PasswordEntry {
+		PASSWORD_ENTERED,
+		CANCELED
+	}
+
+	public enum MasterkeyFileProvision {
+		MASTERKEYFILE_PROVIDED,
+		CANCELED
+	}
+
+	@Provides
+	@KeyLoadingScoped
+	static UserInteractionLock<PasswordEntry> providePasswordEntryLock() {
+		return new UserInteractionLock<>(null);
+	}
+
+	@Provides
+	@KeyLoadingScoped
+	static UserInteractionLock<MasterkeyFileProvision> provideMasterkeyFileProvisionLock() {
+		return new UserInteractionLock<>(null);
+	}
+
+	@Provides
+	@Named("savedPassword")
+	@KeyLoadingScoped
+	static Optional<char[]> provideStoredPassword(KeychainManager keychain, @KeyLoading Vault vault) {
+		if (!keychain.isSupported()) {
+			return Optional.empty();
+		} else {
+			try {
+				return Optional.ofNullable(keychain.loadPassphrase(vault.getId()));
+			} catch (KeychainAccessException e) {
+				LOG.error("Failed to load entry from system keychain.", e);
+				return Optional.empty();
+			}
+		}
+	}
+
+	@Provides
+	@KeyLoadingScoped
+	static AtomicReference<Path> provideUserProvidedMasterkeyPath() {
+		return new AtomicReference<>();
+	}
+
+	@Provides
+	@KeyLoadingScoped
+	static AtomicReference<char[]> providePassword(@Named("savedPassword") Optional<char[]> storedPassword) {
+		return new AtomicReference<>(storedPassword.orElse(null));
+	}
+
+	@Provides
+	@Named("savePassword")
+	@KeyLoadingScoped
+	static AtomicBoolean provideSavePasswordFlag(@Named("savedPassword") Optional<char[]> storedPassword) {
+		return new AtomicBoolean(storedPassword.isPresent());
+	}
+
+	@Provides
+	@FxmlScene(FxmlFile.UNLOCK_ENTER_PASSWORD)
+	@KeyLoadingScoped
+	static Scene provideUnlockScene(@KeyLoading FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.UNLOCK_ENTER_PASSWORD);
+	}
+
+	@Provides
+	@FxmlScene(FxmlFile.UNLOCK_SELECT_MASTERKEYFILE)
+	@KeyLoadingScoped
+	static Scene provideUnlockSelectMasterkeyFileScene(@KeyLoading FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.UNLOCK_SELECT_MASTERKEYFILE);
+	}
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(PassphraseEntryController.class)
+	abstract FxController bindUnlockController(PassphraseEntryController controller);
+
+	@Binds
+	@IntoMap
+	@FxControllerKey(SelectMasterkeyFileController.class)
+	abstract FxController bindUnlockSelectMasterkeyFileController(SelectMasterkeyFileController controller);
+
+	@Binds
+	@IntoMap
+	@KeyLoadingScoped
+	@StringKey(MasterkeyFileLoadingStrategy.SCHEME)
+	abstract KeyLoadingStrategy bindMasterkeyFileLoadingStrategy(MasterkeyFileLoadingStrategy strategy);
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/MasterkeyFileLoadingStrategy.java

@@ -0,0 +1,150 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import com.google.common.base.Preconditions;
+import dagger.Lazy;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptolib.api.InvalidPassphraseException;
+import org.cryptomator.cryptolib.api.Masterkey;
+import org.cryptomator.cryptolib.api.MasterkeyLoadingFailedException;
+import org.cryptomator.cryptolib.common.MasterkeyFileAccess;
+import org.cryptomator.ui.common.Animations;
+import org.cryptomator.ui.common.FxmlFile;
+import org.cryptomator.ui.common.FxmlScene;
+import org.cryptomator.ui.common.UserInteractionLock;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.keyloading.KeyLoadingStrategy;
+import org.cryptomator.ui.unlock.UnlockCancelledException;
+
+import javax.inject.Inject;
+import javafx.application.Platform;
+import javafx.scene.Scene;
+import javafx.stage.Stage;
+import javafx.stage.Window;
+import java.net.URI;
+import java.nio.CharBuffer;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.atomic.AtomicReference;
+
+@KeyLoading
+public class MasterkeyFileLoadingStrategy implements KeyLoadingStrategy {
+
+	public static final String SCHEME = "masterkeyfile";
+
+	private final Vault vault;
+	private final MasterkeyFileAccess masterkeyFileAcccess;
+	private final Stage window;
+	private final Lazy<Scene> passphraseEntryScene;
+	private final Lazy<Scene> selectMasterkeyFileScene;
+	private final UserInteractionLock<MasterkeyFileLoadingModule.PasswordEntry> passwordEntryLock;
+	private final UserInteractionLock<MasterkeyFileLoadingModule.MasterkeyFileProvision> masterkeyFileProvisionLock;
+	private final AtomicReference<char[]> password;
+	private final AtomicReference<Path> filePath;
+	private final MasterkeyFileLoadingFinisher finisher;
+
+	private boolean wrongPassword;
+
+	@Inject
+	public MasterkeyFileLoadingStrategy(@KeyLoading Vault vault, MasterkeyFileAccess masterkeyFileAcccess, @KeyLoading Stage window, @FxmlScene(FxmlFile.UNLOCK_ENTER_PASSWORD) Lazy<Scene> passphraseEntryScene, @FxmlScene(FxmlFile.UNLOCK_SELECT_MASTERKEYFILE) Lazy<Scene> selectMasterkeyFileScene, UserInteractionLock<MasterkeyFileLoadingModule.PasswordEntry> passwordEntryLock, UserInteractionLock<MasterkeyFileLoadingModule.MasterkeyFileProvision> masterkeyFileProvisionLock, AtomicReference<char[]> password, AtomicReference<Path> filePath, MasterkeyFileLoadingFinisher finisher) {
+		this.vault = vault;
+		this.masterkeyFileAcccess = masterkeyFileAcccess;
+		this.window = window;
+		this.passphraseEntryScene = passphraseEntryScene;
+		this.selectMasterkeyFileScene = selectMasterkeyFileScene;
+		this.passwordEntryLock = passwordEntryLock;
+		this.masterkeyFileProvisionLock = masterkeyFileProvisionLock;
+		this.password = password;
+		this.filePath = filePath;
+		this.finisher = finisher;
+	}
+
+	@Override
+	public Masterkey loadKey(URI keyId) throws MasterkeyLoadingFailedException {
+		Preconditions.checkArgument(SCHEME.equalsIgnoreCase(keyId.getScheme()), "Only supports keys with scheme " + SCHEME);
+
+		try {
+			Path filePath = vault.getPath().resolve(keyId.getSchemeSpecificPart());
+			if (!Files.exists(filePath)) {
+				filePath = getAlternateMasterkeyFilePath();
+			}
+			CharSequence passphrase = getPassphrase();
+			return masterkeyFileAcccess.load(filePath, passphrase);
+		} catch (InterruptedException e) {
+			Thread.currentThread().interrupt();
+			throw new UnlockCancelledException("Unlock interrupted", e);
+		}
+	}
+
+	@Override
+	public boolean recoverFromException(MasterkeyLoadingFailedException exception) {
+		if (exception instanceof InvalidPassphraseException) {
+			this.wrongPassword = true;
+			password.set(null);
+			return true; // reattempting key load
+		} else {
+			return false; // nothing we can do
+		}
+	}
+
+	@Override
+	public void cleanup(boolean unlockedSuccessfully) {
+		finisher.cleanup(unlockedSuccessfully);
+	}
+
+	private Path getAlternateMasterkeyFilePath() throws UnlockCancelledException, InterruptedException {
+		if (filePath.get() == null) {
+			return switch (askUserForMasterkeyFilePath()) {
+				case MASTERKEYFILE_PROVIDED -> filePath.get();
+				case CANCELED -> throw new UnlockCancelledException("Choosing masterkey file cancelled.");
+			};
+		} else {
+			return filePath.get();
+		}
+	}
+
+	private MasterkeyFileLoadingModule.MasterkeyFileProvision askUserForMasterkeyFilePath() throws InterruptedException {
+		Platform.runLater(() -> {
+			window.setScene(selectMasterkeyFileScene.get());
+			window.show();
+			Window owner = window.getOwner();
+			if (owner != null) {
+				window.setX(owner.getX() + (owner.getWidth() - window.getWidth()) / 2);
+				window.setY(owner.getY() + (owner.getHeight() - window.getHeight()) / 2);
+			} else {
+				window.centerOnScreen();
+			}
+		});
+		return masterkeyFileProvisionLock.awaitInteraction();
+	}
+
+	private CharSequence getPassphrase() throws UnlockCancelledException, InterruptedException {
+		if (password.get() == null) {
+			return switch (askForPassphrase()) {
+				case PASSWORD_ENTERED -> CharBuffer.wrap(password.get());
+				case CANCELED -> throw new UnlockCancelledException("Password entry cancelled.");
+			};
+		} else {
+			// e.g. pre-filled from keychain or previous unlock attempt
+			return CharBuffer.wrap(password.get());
+		}
+	}
+
+	private MasterkeyFileLoadingModule.PasswordEntry askForPassphrase() throws InterruptedException {
+		Platform.runLater(() -> {
+			window.setScene(passphraseEntryScene.get());
+			window.show();
+			Window owner = window.getOwner();
+			if (owner != null) {
+				window.setX(owner.getX() + (owner.getWidth() - window.getWidth()) / 2);
+				window.setY(owner.getY() + (owner.getHeight() - window.getHeight()) / 2);
+			} else {
+				window.centerOnScreen();
+			}
+			if (wrongPassword) {
+				Animations.createShakeWindowAnimation(window).play();
+			}
+		});
+		return passwordEntryLock.awaitInteraction();
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/PassphraseEntryController.java

@@ -1,4 +1,4 @@
-package org.cryptomator.ui.unlock;
+package org.cryptomator.ui.keyloading.masterkeyfile;
 
 import org.cryptomator.common.keychain.KeychainManager;
 import org.cryptomator.common.vaults.Vault;
@@ -7,6 +7,9 @@ import org.cryptomator.ui.common.UserInteractionLock;
 import org.cryptomator.ui.common.WeakBindings;
 import org.cryptomator.ui.controls.NiceSecurePasswordField;
 import org.cryptomator.ui.forgetPassword.ForgetPasswordComponent;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.keyloading.KeyLoadingScoped;
+import org.cryptomator.ui.keyloading.masterkeyfile.MasterkeyFileLoadingModule.PasswordEntry;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,17 +41,17 @@ import java.util.Optional;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 
-@UnlockScoped
-public class UnlockController implements FxController {
+@KeyLoadingScoped
+public class PassphraseEntryController implements FxController {
 
-	private static final Logger LOG = LoggerFactory.getLogger(UnlockController.class);
+	private static final Logger LOG = LoggerFactory.getLogger(PassphraseEntryController.class);
 
 	private final Stage window;
 	private final Vault vault;
 	private final AtomicReference<char[]> password;
 	private final AtomicBoolean savePassword;
 	private final Optional<char[]> savedPassword;
-	private final UserInteractionLock<UnlockModule.PasswordEntry> passwordEntryLock;
+	private final UserInteractionLock<PasswordEntry> passwordEntryLock;
 	private final ForgetPasswordComponent.Builder forgetPassword;
 	private final KeychainManager keychain;
 	private final ObjectBinding<ContentDisplay> unlockButtonContentDisplay;
@@ -66,7 +69,7 @@ public class UnlockController implements FxController {
 	public Animation unlockAnimation;
 
 	@Inject
-	public UnlockController(@UnlockWindow Stage window, @UnlockWindow Vault vault, AtomicReference<char[]> password, @Named("savePassword") AtomicBoolean savePassword, @Named("savedPassword") Optional<char[]> savedPassword, UserInteractionLock<UnlockModule.PasswordEntry> passwordEntryLock, ForgetPasswordComponent.Builder forgetPassword, KeychainManager keychain) {
+	public PassphraseEntryController(@KeyLoading Stage window, @KeyLoading Vault vault, AtomicReference<char[]> password, @Named("savePassword") AtomicBoolean savePassword, @Named("savedPassword") Optional<char[]> savedPassword, UserInteractionLock<PasswordEntry> passwordEntryLock, ForgetPasswordComponent.Builder forgetPassword, KeychainManager keychain) {
 		this.window = window;
 		this.vault = vault;
 		this.password = password;
@@ -138,7 +141,7 @@ public class UnlockController implements FxController {
 		// if not already interacted, mark this workflow as cancelled:
 		if (passwordEntryLock.awaitingInteraction().get()) {
 			LOG.debug("Unlock canceled by user.");
-			passwordEntryLock.interacted(UnlockModule.PasswordEntry.CANCELED);
+			passwordEntryLock.interacted(PasswordEntry.CANCELED);
 		}
 	}
 
@@ -154,7 +157,7 @@ public class UnlockController implements FxController {
 		if (oldPw != null) {
 			Arrays.fill(oldPw, ' ');
 		}
-		passwordEntryLock.interacted(UnlockModule.PasswordEntry.PASSWORD_ENTERED);
+		passwordEntryLock.interacted(PasswordEntry.PASSWORD_ENTERED);
 		startUnlockAnimation();
 	}
 

main/ui/src/main/java/org/cryptomator/ui/keyloading/masterkeyfile/SelectMasterkeyFileController.java

@@ -0,0 +1,67 @@
+package org.cryptomator.ui.keyloading.masterkeyfile;
+
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.common.UserInteractionLock;
+import org.cryptomator.ui.keyloading.KeyLoading;
+import org.cryptomator.ui.keyloading.KeyLoadingScoped;
+import org.cryptomator.ui.keyloading.masterkeyfile.MasterkeyFileLoadingModule.MasterkeyFileProvision;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+import javafx.fxml.FXML;
+import javafx.stage.FileChooser;
+import javafx.stage.Stage;
+import javafx.stage.WindowEvent;
+import java.io.File;
+import java.nio.file.Path;
+import java.util.ResourceBundle;
+import java.util.concurrent.atomic.AtomicReference;
+
+@KeyLoadingScoped
+public class SelectMasterkeyFileController implements FxController {
+
+	private static final Logger LOG = LoggerFactory.getLogger(SelectMasterkeyFileController.class);
+
+	private final Stage window;
+	private final AtomicReference<Path> masterkeyPath;
+	private final UserInteractionLock<MasterkeyFileProvision> masterkeyFileProvisionLock;
+	private final ResourceBundle resourceBundle;
+
+	@Inject
+	public SelectMasterkeyFileController(@KeyLoading Stage window, AtomicReference<Path> masterkeyPath, UserInteractionLock<MasterkeyFileProvision> masterkeyFileProvisionLock, ResourceBundle resourceBundle) {
+		this.window = window;
+		this.masterkeyPath = masterkeyPath;
+		this.masterkeyFileProvisionLock = masterkeyFileProvisionLock;
+		this.resourceBundle = resourceBundle;
+		this.window.setOnHiding(this::windowClosed);
+	}
+
+	@FXML
+	public void cancel() {
+		window.close();
+	}
+
+	private void windowClosed(WindowEvent windowEvent) {
+		// if not already interacted, mark this workflow as cancelled:
+		if (masterkeyFileProvisionLock.awaitingInteraction().get()) {
+			LOG.debug("Unlock canceled by user.");
+			masterkeyFileProvisionLock.interacted(MasterkeyFileProvision.CANCELED);
+		}
+	}
+
+	@FXML
+	public void proceed() {
+		LOG.trace("proceed()");
+		FileChooser fileChooser = new FileChooser();
+		fileChooser.setTitle(resourceBundle.getString("unlock.chooseMasterkey.filePickerTitle"));
+		fileChooser.getExtensionFilters().add(new FileChooser.ExtensionFilter("Cryptomator Masterkey", "*.cryptomator"));
+		File masterkeyFile = fileChooser.showOpenDialog(window);
+		if (masterkeyFile != null) {
+			LOG.debug("Chose masterkey file: {}", masterkeyFile);
+			masterkeyPath.set(masterkeyFile.toPath());
+			masterkeyFileProvisionLock.interacted(MasterkeyFileProvision.MASTERKEYFILE_PROVIDED);
+		}
+	}
+
+}

main/ui/src/main/java/org/cryptomator/ui/launcher/AppLaunchEventHandler.java

@@ -1,5 +1,6 @@
 package org.cryptomator.ui.launcher;
 
+import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
 import org.cryptomator.ui.fxapp.FxApplication;
 import org.slf4j.Logger;
@@ -9,6 +10,7 @@ import javax.inject.Inject;
 import javax.inject.Named;
 import javax.inject.Singleton;
 import javafx.application.Platform;
+import java.io.IOException;
 import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.util.concurrent.BlockingQueue;
@@ -55,7 +57,7 @@ class AppLaunchEventHandler {
 			case REVEAL_APP -> fxApplicationStarter.get().thenAccept(FxApplication::showMainWindow);
 			case OPEN_FILE -> fxApplicationStarter.get().thenRun(() -> {
 				Platform.runLater(() -> {
-					event.getPathsToOpen().forEach(this::addVault);
+					event.getPathsToOpen().forEach(this::addOrRevealVault);
 				});
 			});
 			default -> LOG.warn("Unsupported event type: {}", event.getType());
@@ -63,16 +65,21 @@ class AppLaunchEventHandler {
 	}
 
 	// TODO dedup MainWindowController...
-	private void addVault(Path potentialVaultPath) {
+	private void addOrRevealVault(Path potentialVaultPath) {
 		assert Platform.isFxApplicationThread();
 		try {
+			final Vault v;
 			if (potentialVaultPath.getFileName().toString().equals(MASTERKEY_FILENAME)) {
-				vaultListManager.add(potentialVaultPath.getParent());
+				v = vaultListManager.add(potentialVaultPath.getParent());
 			} else {
-				vaultListManager.add(potentialVaultPath);
+				v = vaultListManager.add(potentialVaultPath);
+			}
+
+			if (v.isUnlocked()) {
+				fxApplicationStarter.get().thenAccept(app -> app.getVaultService().reveal(v));
 			}
 			LOG.debug("Added vault {}", potentialVaultPath);
-		} catch (NoSuchFileException e) {
+		} catch (IOException e) {
 			LOG.error("Failed to add vault " + potentialVaultPath, e);
 		}
 	}

main/ui/src/main/java/org/cryptomator/ui/launcher/AppLifecycleListener.java

@@ -1,6 +1,7 @@
 package org.cryptomator.ui.launcher;
 
 import org.cryptomator.common.ShutdownHook;
+import org.cryptomator.common.vaults.LockNotCompletedException;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.common.vaults.Volume;
@@ -24,11 +25,13 @@ import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.atomic.AtomicBoolean;
 
+import static org.cryptomator.common.vaults.VaultState.Value.*;
+
 @Singleton
 public class AppLifecycleListener {
 
 	private static final Logger LOG = LoggerFactory.getLogger(AppLifecycleListener.class);
-	public static final Set<VaultState> STATES_ALLOWING_TERMINATION = EnumSet.of(VaultState.LOCKED, VaultState.NEEDS_MIGRATION, VaultState.MISSING, VaultState.ERROR);
+	public static final Set<VaultState.Value> STATES_ALLOWING_TERMINATION = EnumSet.of(LOCKED, NEEDS_MIGRATION, MISSING, ERROR);
 
 	private final FxApplicationStarter fxApplicationStarter;
 	private final CountDownLatch shutdownLatch;
@@ -127,6 +130,8 @@ public class AppLifecycleListener {
 					vault.lock(true);
 				} catch (Volume.VolumeException e) {
 					LOG.error("Failed to unmount vault " + vault.getPath(), e);
+				} catch (LockNotCompletedException e) {
+					LOG.error("Failed to lock vault " + vault.getPath(), e);
 				}
 			}
 		}

main/ui/src/main/java/org/cryptomator/ui/lock/LockModule.java

@@ -6,7 +6,7 @@ import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
@@ -40,8 +40,8 @@ abstract class LockModule {
 	@Provides
 	@LockWindow
 	@LockScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -63,15 +63,15 @@ abstract class LockModule {
 	@Provides
 	@FxmlScene(FxmlFile.LOCK_FORCED)
 	@LockScoped
-	static Scene provideForceLockScene(@LockWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/lock_forced.fxml");
+	static Scene provideForceLockScene(@LockWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.LOCK_FORCED);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.LOCK_FAILED)
 	@LockScoped
-	static Scene provideLockFailedScene(@LockWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/lock_failed.fxml");
+	static Scene provideLockFailedScene(@LockWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.LOCK_FAILED);
 	}
 
 	// ------------------

main/ui/src/main/java/org/cryptomator/ui/lock/LockWorkflow.java

@@ -1,9 +1,11 @@
 package org.cryptomator.ui.lock;
 
 import dagger.Lazy;
+import org.cryptomator.common.vaults.LockNotCompletedException;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultState;
 import org.cryptomator.common.vaults.Volume;
+import org.cryptomator.ui.common.ErrorComponent;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.UserInteractionLock;
@@ -35,21 +37,23 @@ public class LockWorkflow extends Task<Void> {
 	private final UserInteractionLock<LockModule.ForceLockDecision> forceLockDecisionLock;
 	private final Lazy<Scene> lockForcedScene;
 	private final Lazy<Scene> lockFailedScene;
+	private final ErrorComponent.Builder errorComponent;
 
 	@Inject
-	public LockWorkflow(@LockWindow Stage lockWindow, @LockWindow Vault vault, UserInteractionLock<LockModule.ForceLockDecision> forceLockDecisionLock, @FxmlScene(FxmlFile.LOCK_FORCED) Lazy<Scene> lockForcedScene, @FxmlScene(FxmlFile.LOCK_FAILED) Lazy<Scene> lockFailedScene) {
+	public LockWorkflow(@LockWindow Stage lockWindow, @LockWindow Vault vault, UserInteractionLock<LockModule.ForceLockDecision> forceLockDecisionLock, @FxmlScene(FxmlFile.LOCK_FORCED) Lazy<Scene> lockForcedScene, @FxmlScene(FxmlFile.LOCK_FAILED) Lazy<Scene> lockFailedScene, ErrorComponent.Builder errorComponent) {
 		this.lockWindow = lockWindow;
 		this.vault = vault;
 		this.forceLockDecisionLock = forceLockDecisionLock;
 		this.lockForcedScene = lockForcedScene;
 		this.lockFailedScene = lockFailedScene;
+		this.errorComponent = errorComponent;
 	}
 
 	@Override
-	protected Void call() throws Volume.VolumeException, InterruptedException {
+	protected Void call() throws Volume.VolumeException, InterruptedException, LockNotCompletedException {
 		try {
 			vault.lock(false);
-		} catch (Volume.VolumeException e) {
+		} catch (Volume.VolumeException | LockNotCompletedException e) {
 			LOG.debug("Regular lock of {} failed.", vault.getDisplayName(), e);
 			var decision = askUserForAction();
 			switch (decision) {
@@ -77,29 +81,29 @@ public class LockWorkflow extends Task<Void> {
 		return forceLockDecisionLock.awaitInteraction();
 	}
 
-	@Override
-	protected void scheduled() {
-		vault.setState(VaultState.PROCESSING);
-	}
-
 	@Override
 	protected void succeeded() {
 		LOG.info("Lock of {} succeeded.", vault.getDisplayName());
-		vault.setState(VaultState.LOCKED);
+		vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.LOCKED);
 	}
 
 	@Override
 	protected void failed() {
-		LOG.warn("Failed to lock {}.", vault.getDisplayName());
-		vault.setState(VaultState.UNLOCKED);
-		lockWindow.setScene(lockFailedScene.get());
-		lockWindow.show();
+		final var throwable = super.getException();
+		LOG.warn("Lock of {} failed.", vault.getDisplayName(), throwable);
+		vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.UNLOCKED);
+		if (throwable instanceof Volume.VolumeException) {
+			lockWindow.setScene(lockFailedScene.get());
+			lockWindow.show();
+		} else {
+			errorComponent.cause(throwable).window(lockWindow).build().showErrorScene();
+		}
 	}
 
 	@Override
 	protected void cancelled() {
 		LOG.debug("Lock of {} canceled.", vault.getDisplayName());
-		vault.setState(VaultState.UNLOCKED);
+		vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.UNLOCKED);
 	}
 
 }

main/ui/src/main/java/org/cryptomator/ui/mainwindow/MainWindowController.java

@@ -3,6 +3,8 @@ package org.cryptomator.ui.mainwindow;
 import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
+import org.cryptomator.cryptofs.CryptoFileSystemProvider;
+import org.cryptomator.cryptofs.DirStructure;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.wrongfilealert.WrongFileAlertComponent;
 import org.slf4j.Logger;
@@ -20,6 +22,7 @@ import javafx.scene.input.TransferMode;
 import javafx.scene.layout.StackPane;
 import javafx.stage.Stage;
 import java.io.File;
+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
@@ -27,6 +30,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 
 import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
+import static org.cryptomator.common.Constants.VAULTCONFIG_FILENAME;
 
 @MainWindowScoped
 public class MainWindowController implements FxController {
@@ -91,23 +95,21 @@ public class MainWindowController implements FxController {
 	}
 
 	private boolean containsVault(Path path) {
-		if (path.getFileName().toString().equals(MASTERKEY_FILENAME)) {
-			return true;
-		} else if (Files.isDirectory(path) && Files.exists(path.resolve(MASTERKEY_FILENAME))) {
-			return true;
-		} else {
+		try {
+			return CryptoFileSystemProvider.checkDirStructureForVault(path, VAULTCONFIG_FILENAME, MASTERKEY_FILENAME) != DirStructure.UNRELATED;
+		} catch (IOException e) {
 			return false;
 		}
 	}
 
 	private void addVault(Path pathToVault) {
 		try {
-			if (pathToVault.getFileName().toString().equals(MASTERKEY_FILENAME)) {
+			if (pathToVault.getFileName().toString().equals(VAULTCONFIG_FILENAME)) {
 				vaultListManager.add(pathToVault.getParent());
 			} else {
 				vaultListManager.add(pathToVault);
 			}
-		} catch (NoSuchFileException e) {
+		} catch (IOException e) {
 			LOG.debug("Not a vault: {}", pathToVault);
 		}
 	}

main/ui/src/main/java/org/cryptomator/ui/mainwindow/MainWindowModule.java

@@ -6,12 +6,13 @@ import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.addvaultwizard.AddVaultWizardComponent;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
 import org.cryptomator.ui.common.FxmlScene;
 import org.cryptomator.ui.common.StageFactory;
+import org.cryptomator.ui.health.HealthCheckComponent;
 import org.cryptomator.ui.migration.MigrationComponent;
 import org.cryptomator.ui.removevault.RemoveVaultComponent;
 import org.cryptomator.ui.vaultoptions.VaultOptionsComponent;
@@ -27,7 +28,7 @@ import javafx.stage.StageStyle;
 import java.util.Map;
 import java.util.ResourceBundle;
 
-@Module(subcomponents = {AddVaultWizardComponent.class, MigrationComponent.class, RemoveVaultComponent.class, VaultOptionsComponent.class, VaultStatisticsComponent.class, WrongFileAlertComponent.class})
+@Module(subcomponents = {AddVaultWizardComponent.class, HealthCheckComponent.class, MigrationComponent.class, RemoveVaultComponent.class, VaultOptionsComponent.class, VaultStatisticsComponent.class, WrongFileAlertComponent.class})
 abstract class MainWindowModule {
 
 	@Provides
@@ -39,8 +40,8 @@ abstract class MainWindowModule {
 	@Provides
 	@MainWindow
 	@MainWindowScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, MainWindowSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, MainWindowSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -60,8 +61,8 @@ abstract class MainWindowModule {
 	@Provides
 	@FxmlScene(FxmlFile.MAIN_WINDOW)
 	@MainWindowScoped
-	static Scene provideMainScene(@MainWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/main_window.fxml");
+	static Scene provideMainScene(@MainWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MAIN_WINDOW);
 	}
 
 	// ------------------
@@ -86,6 +87,11 @@ abstract class MainWindowModule {
 	@FxControllerKey(VaultListController.class)
 	abstract FxController bindVaultListController(VaultListController controller);
 
+	@Binds
+	@IntoMap
+	@FxControllerKey(VaultListContextMenuController.class)
+	abstract FxController bindVaultListContextMenuController(VaultListContextMenuController controller);
+
 	@Binds
 	@IntoMap
 	@FxControllerKey(VaultDetailController.class)

main/ui/src/main/java/org/cryptomator/ui/mainwindow/MainWindowTitleController.java

@@ -95,7 +95,7 @@ public class MainWindowTitleController implements FxController {
 
 	@FXML
 	public void showDonationKeyPreferences() {
-		application.showPreferencesWindow(SelectedPreferencesTab.DONATION_KEY);
+		application.showPreferencesWindow(SelectedPreferencesTab.CONTRIBUTE);
 	}
 
 	/* Getter/Setter */

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultDetailController.java

@@ -32,7 +32,8 @@ public class VaultDetailController implements FxController {
 		this.anyVaultSelected = vault.isNotNull();
 	}
 
-	private FontAwesome5Icon getGlyphForVaultState(VaultState state) {
+	// TODO deduplicate w/ VaultListCellController
+	private FontAwesome5Icon getGlyphForVaultState(VaultState.Value state) {
 		if (state != null) {
 			return switch (state) {
 				case LOCKED -> FontAwesome5Icon.LOCK;

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultDetailLockedController.java

@@ -5,6 +5,8 @@ import org.cryptomator.common.keychain.KeychainManager;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.fxapp.FxApplication;
+import org.cryptomator.ui.health.HealthCheckComponent;
+import org.cryptomator.ui.vaultoptions.SelectedVaultOptionsTab;
 import org.cryptomator.ui.vaultoptions.VaultOptionsComponent;
 
 import javax.inject.Inject;
@@ -12,6 +14,7 @@ import javafx.beans.binding.BooleanExpression;
 import javafx.beans.property.ObjectProperty;
 import javafx.beans.property.ReadOnlyObjectProperty;
 import javafx.beans.property.SimpleBooleanProperty;
+import javafx.event.ActionEvent;
 import javafx.fxml.FXML;
 import javafx.stage.Stage;
 import java.util.Optional;
@@ -27,7 +30,7 @@ public class VaultDetailLockedController implements FxController {
 	private final BooleanExpression passwordSaved;
 
 	@Inject
-	VaultDetailLockedController(ObjectProperty<Vault> vault, FxApplication application, VaultOptionsComponent.Builder vaultOptionsWindow, KeychainManager keychain, @MainWindow Stage mainWindow) {
+	VaultDetailLockedController(ObjectProperty<Vault> vault, FxApplication application,  VaultOptionsComponent.Builder vaultOptionsWindow, KeychainManager keychain, @MainWindow Stage mainWindow) {
 		this.vault = vault;
 		this.application = application;
 		this.vaultOptionsWindow = vaultOptionsWindow;
@@ -47,7 +50,12 @@ public class VaultDetailLockedController implements FxController {
 
 	@FXML
 	public void showVaultOptions() {
-		vaultOptionsWindow.vault(vault.get()).build().showVaultOptionsWindow();
+		vaultOptionsWindow.vault(vault.get()).build().showVaultOptionsWindow(SelectedVaultOptionsTab.ANY);
+	}
+
+	@FXML
+	public void showKeyVaultOptions() {
+		vaultOptionsWindow.vault(vault.get()).build().showVaultOptionsWindow(SelectedVaultOptionsTab.KEY);
 	}
 
 	/* Getter/Setter */

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellController.java

@@ -24,7 +24,8 @@ public class VaultListCellController implements FxController {
 				.map(this::getGlyphForVaultState);
 	}
 
-	private FontAwesome5Icon getGlyphForVaultState(VaultState state) {
+	// TODO deduplicate w/ VaultDetailController
+	private FontAwesome5Icon getGlyphForVaultState(VaultState.Value state) {
 		if (state != null) {
 			return switch (state) {
 				case LOCKED -> FontAwesome5Icon.LOCK;

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultListCellFactory.java

@@ -1,7 +1,7 @@
 package org.cryptomator.ui.mainwindow;
 
 import org.cryptomator.common.vaults.Vault;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.controls.DraggableListCell;
 
 import javax.inject.Inject;
@@ -17,10 +17,10 @@ import java.io.UncheckedIOException;
 @MainWindowScoped
 public class VaultListCellFactory implements Callback<ListView<Vault>, ListCell<Vault>> {
 
-	private final FXMLLoaderFactory fxmlLoaders;
+	private final FxmlLoaderFactory fxmlLoaders;
 
 	@Inject
-	VaultListCellFactory(@MainWindow FXMLLoaderFactory fxmlLoaders) {
+	VaultListCellFactory(@MainWindow FxmlLoaderFactory fxmlLoaders) {
 		this.fxmlLoaders = fxmlLoaders;
 	}
 

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultListContextMenuController.java

@@ -0,0 +1,128 @@
+package org.cryptomator.ui.mainwindow;
+
+import com.tobiasdiez.easybind.EasyBind;
+import com.tobiasdiez.easybind.optional.ObservableOptionalValue;
+import com.tobiasdiez.easybind.optional.OptionalBinding;
+import org.cryptomator.common.keychain.KeychainManager;
+import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.common.vaults.VaultState;
+import org.cryptomator.ui.common.FxController;
+import org.cryptomator.ui.fxapp.FxApplication;
+import org.cryptomator.ui.removevault.RemoveVaultComponent;
+import org.cryptomator.ui.vaultoptions.SelectedVaultOptionsTab;
+import org.cryptomator.ui.vaultoptions.VaultOptionsComponent;
+
+import javax.inject.Inject;
+import javafx.beans.binding.Binding;
+import javafx.beans.property.ObjectProperty;
+import javafx.fxml.FXML;
+import javafx.stage.Stage;
+import java.util.EnumSet;
+import java.util.Optional;
+
+import static org.cryptomator.common.vaults.VaultState.Value.*;
+
+@MainWindowScoped
+public class VaultListContextMenuController implements FxController {
+
+	private final ObservableOptionalValue<Vault> selectedVault;
+	private final Stage mainWindow;
+	private final FxApplication application;
+	private final KeychainManager keychain;
+	private final RemoveVaultComponent.Builder removeVault;
+	private final VaultOptionsComponent.Builder vaultOptionsWindow;
+	private final OptionalBinding<VaultState.Value> selectedVaultState;
+	private final Binding<Boolean> selectedVaultPassphraseStored;
+	private final Binding<Boolean> selectedVaultRemovable;
+	private final Binding<Boolean> selectedVaultUnlockable;
+	private final Binding<Boolean> selectedVaultLockable;
+
+	@Inject
+	VaultListContextMenuController(ObjectProperty<Vault> selectedVault, @MainWindow Stage mainWindow, FxApplication application, KeychainManager keychain, RemoveVaultComponent.Builder removeVault, VaultOptionsComponent.Builder vaultOptionsWindow) {
+		this.selectedVault = EasyBind.wrapNullable(selectedVault);
+		this.mainWindow = mainWindow;
+		this.application = application;
+		this.keychain = keychain;
+		this.removeVault = removeVault;
+		this.vaultOptionsWindow = vaultOptionsWindow;
+
+		this.selectedVaultState = this.selectedVault.mapObservable(Vault::stateProperty);
+		this.selectedVaultPassphraseStored = this.selectedVault.map(this::isPasswordStored).orElse(false);
+		this.selectedVaultRemovable = selectedVaultState.map(EnumSet.of(LOCKED, MISSING, ERROR, NEEDS_MIGRATION)::contains).orElse(false);
+		this.selectedVaultUnlockable = selectedVaultState.map(LOCKED::equals).orElse(false);
+		this.selectedVaultLockable = selectedVaultState.map(UNLOCKED::equals).orElse(false);
+	}
+
+	private boolean isPasswordStored(Vault vault) {
+		return keychain.getPassphraseStoredProperty(vault.getId()).get();
+	}
+
+	@FXML
+	public void didClickRemoveVault() {
+		selectedVault.ifValuePresent(v -> {
+			removeVault.vault(v).build().showRemoveVault();
+		});
+	}
+
+	@FXML
+	public void didClickShowVaultOptions() {
+		selectedVault.ifValuePresent(v -> {
+			vaultOptionsWindow.vault(v).build().showVaultOptionsWindow(SelectedVaultOptionsTab.ANY);
+		});
+	}
+
+	@FXML
+	public void didClickUnlockVault() {
+		selectedVault.ifValuePresent(v -> {
+			application.startUnlockWorkflow(v, Optional.of(mainWindow));
+		});
+	}
+
+	@FXML
+	public void didClickLockVault() {
+		selectedVault.ifValuePresent(v -> {
+			application.startLockWorkflow(v, Optional.of(mainWindow));
+		});
+	}
+
+	@FXML
+	public void didClickRevealVault() {
+		selectedVault.ifValuePresent(v -> {
+			application.getVaultService().reveal(v);
+		});
+	}
+
+	// Getter and Setter
+
+	public Binding<Boolean> selectedVaultUnlockableProperty() {
+		return selectedVaultUnlockable;
+	}
+
+	public boolean isSelectedVaultUnlockable() {
+		return selectedVaultUnlockable.getValue();
+	}
+
+	public Binding<Boolean> selectedVaultLockableProperty() {
+		return selectedVaultLockable;
+	}
+
+	public boolean isSelectedVaultLockable() {
+		return selectedVaultLockable.getValue();
+	}
+
+	public Binding<Boolean> selectedVaultRemovableProperty() {
+		return selectedVaultRemovable;
+	}
+
+	public boolean isSelectedVaultRemovable() {
+		return selectedVaultRemovable.getValue();
+	}
+
+	public Binding<Boolean> selectedVaultPassphraseStoredProperty() {
+		return selectedVaultPassphraseStored;
+	}
+
+	public boolean isSelectedVaultPassphraseStored() {
+		return selectedVaultPassphraseStored.getValue();
+	}
+}

main/ui/src/main/java/org/cryptomator/ui/mainwindow/VaultListController.java

@@ -1,12 +1,11 @@
 package org.cryptomator.ui.mainwindow;
 
+import org.apache.commons.lang3.SystemUtils;
 import org.cryptomator.common.vaults.Vault;
 import org.cryptomator.common.vaults.VaultListManager;
 import org.cryptomator.ui.addvaultwizard.AddVaultWizardComponent;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.removevault.RemoveVaultComponent;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javafx.beans.binding.Bindings;
@@ -17,30 +16,43 @@ import javafx.collections.ListChangeListener;
 import javafx.collections.ObservableList;
 import javafx.fxml.FXML;
 import javafx.scene.control.ListView;
+import javafx.scene.input.ContextMenuEvent;
+import javafx.scene.input.KeyCode;
+import javafx.scene.input.KeyEvent;
+import javafx.scene.input.MouseEvent;
+import javafx.stage.Stage;
+import java.util.EnumSet;
+
+import static org.cryptomator.common.vaults.VaultState.Value.ERROR;
+import static org.cryptomator.common.vaults.VaultState.Value.LOCKED;
+import static org.cryptomator.common.vaults.VaultState.Value.MISSING;
+import static org.cryptomator.common.vaults.VaultState.Value.NEEDS_MIGRATION;
 
 @MainWindowScoped
 public class VaultListController implements FxController {
 
-	private static final Logger LOG = LoggerFactory.getLogger(VaultListController.class);
 
+	private final Stage mainWindow;
 	private final ObservableList<Vault> vaults;
 	private final ObjectProperty<Vault> selectedVault;
 	private final VaultListCellFactory cellFactory;
 	private final AddVaultWizardComponent.Builder addVaultWizard;
-	private final RemoveVaultComponent.Builder removeVault;
-	private final BooleanBinding noVaultSelected;
 	private final BooleanBinding emptyVaultList;
+	private final RemoveVaultComponent.Builder removeVaultDialogue;
+
 	public ListView<Vault> vaultList;
 
 	@Inject
-	VaultListController(ObservableList<Vault> vaults, ObjectProperty<Vault> selectedVault, VaultListCellFactory cellFactory, AddVaultWizardComponent.Builder addVaultWizard, RemoveVaultComponent.Builder removeVault) {
+	VaultListController(@MainWindow Stage mainWindow, ObservableList<Vault> vaults, ObjectProperty<Vault> selectedVault, VaultListCellFactory cellFactory, AddVaultWizardComponent.Builder addVaultWizard, RemoveVaultComponent.Builder removeVaultDialogue) {
+		this.mainWindow = mainWindow;
 		this.vaults = vaults;
 		this.selectedVault = selectedVault;
 		this.cellFactory = cellFactory;
 		this.addVaultWizard = addVaultWizard;
-		this.removeVault = removeVault;
-		this.noVaultSelected = selectedVault.isNull();
+		this.removeVaultDialogue = removeVaultDialogue;
+
 		this.emptyVaultList = Bindings.isEmpty(vaults);
+
 		selectedVault.addListener(this::selectedVaultDidChange);
 	}
 
@@ -56,6 +68,41 @@ public class VaultListController implements FxController {
 				}
 			}
 		});
+		vaultList.addEventFilter(MouseEvent.MOUSE_RELEASED, this::deselect);
+		vaultList.addEventFilter(ContextMenuEvent.CONTEXT_MENU_REQUESTED, request -> {
+			if (selectedVault.get() == null) {
+				request.consume();
+			}
+		});
+		vaultList.addEventFilter(KeyEvent.KEY_PRESSED, keyEvent -> {
+			if (keyEvent.getCode() == KeyCode.DELETE) {
+				pressedShortcutToRemoveVault();
+				keyEvent.consume();
+			}
+		});
+		if (SystemUtils.IS_OS_MAC) {
+			vaultList.addEventFilter(KeyEvent.KEY_PRESSED, keyEvent -> {
+				if (keyEvent.getCode() == KeyCode.BACK_SPACE) {
+					pressedShortcutToRemoveVault();
+					keyEvent.consume();
+				}
+			});
+		}
+
+		//register vault selection shortcut to the main window
+		mainWindow.addEventFilter(KeyEvent.KEY_RELEASED, keyEvent -> {
+			if (keyEvent.isShortcutDown() && keyEvent.getCode().isDigitKey()) {
+				vaultList.getSelectionModel().select(Integer.parseInt(keyEvent.getText()) - 1);
+				keyEvent.consume();
+			}
+		});
+	}
+
+	private void deselect(MouseEvent released) {
+		if (released.getY() > (vaultList.getItems().size() * vaultList.fixedCellSizeProperty().get())) {
+			vaultList.getSelectionModel().clearSelection();
+			released.consume();
+		}
 	}
 
 	private void selectedVaultDidChange(@SuppressWarnings("unused") ObservableValue<? extends Vault> observableValue, @SuppressWarnings("unused") Vault oldValue, Vault newValue) {
@@ -70,13 +117,10 @@ public class VaultListController implements FxController {
 		addVaultWizard.build().showAddVaultWizard();
 	}
 
-	@FXML
-	public void didClickRemoveVault() {
-		Vault v = selectedVault.get();
-		if (v != null) {
-			removeVault.vault(v).build().showRemoveVault();
-		} else {
-			LOG.debug("Cannot remove a vault if none is selected.");
+	private void pressedShortcutToRemoveVault() {
+		final var vault = selectedVault.get();
+		if (vault != null && EnumSet.of(LOCKED, MISSING, ERROR, NEEDS_MIGRATION).contains(vault.getState())) {
+			removeVaultDialogue.vault(vault).build().showRemoveVault();
 		}
 	}
 
@@ -90,11 +134,4 @@ public class VaultListController implements FxController {
 		return emptyVaultList.get();
 	}
 
-	public BooleanBinding noVaultSelectedProperty() {
-		return noVaultSelected;
-	}
-
-	public boolean isNoVaultSelected() {
-		return noVaultSelected.get();
-	}
 }

main/ui/src/main/java/org/cryptomator/ui/migration/MigrationModule.java

@@ -6,7 +6,7 @@ import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.cryptofs.common.FileSystemCapabilityChecker;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
@@ -30,8 +30,8 @@ abstract class MigrationModule {
 	@Provides
 	@MigrationWindow
 	@MigrationScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -56,36 +56,36 @@ abstract class MigrationModule {
 	@Provides
 	@FxmlScene(FxmlFile.MIGRATION_START)
 	@MigrationScoped
-	static Scene provideMigrationStartScene(@MigrationWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/migration_start.fxml");
+	static Scene provideMigrationStartScene(@MigrationWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MIGRATION_START);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.MIGRATION_RUN)
 	@MigrationScoped
-	static Scene provideMigrationRunScene(@MigrationWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/migration_run.fxml");
+	static Scene provideMigrationRunScene(@MigrationWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MIGRATION_RUN);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.MIGRATION_SUCCESS)
 	@MigrationScoped
-	static Scene provideMigrationSuccessScene(@MigrationWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/migration_success.fxml");
+	static Scene provideMigrationSuccessScene(@MigrationWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MIGRATION_SUCCESS);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.MIGRATION_CAPABILITY_ERROR)
 	@MigrationScoped
-	static Scene provideMigrationCapabilityErrorScene(@MigrationWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/migration_capability_error.fxml");
+	static Scene provideMigrationCapabilityErrorScene(@MigrationWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MIGRATION_CAPABILITY_ERROR);
 	}
 
 	@Provides
 	@FxmlScene(FxmlFile.MIGRATION_IMPOSSIBLE)
 	@MigrationScoped
-	static Scene provideMigrationImpossibleScene(@MigrationWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/migration_impossible.fxml");
+	static Scene provideMigrationImpossibleScene(@MigrationWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.MIGRATION_IMPOSSIBLE);
 	}
 
 	// ------------------

main/ui/src/main/java/org/cryptomator/ui/migration/MigrationRunController.java

@@ -26,6 +26,7 @@ import javax.inject.Named;
 import javafx.application.Platform;
 import javafx.beans.binding.Bindings;
 import javafx.beans.binding.ObjectBinding;
+import javafx.beans.binding.ObjectExpression;
 import javafx.beans.property.BooleanProperty;
 import javafx.beans.property.DoubleProperty;
 import javafx.beans.property.ObjectProperty;
@@ -43,6 +44,7 @@ import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.TimeUnit;
 
 import static org.cryptomator.common.Constants.MASTERKEY_FILENAME;
+import static org.cryptomator.common.Constants.VAULTCONFIG_FILENAME;
 
 @MigrationScoped
 public class MigrationRunController implements FxController {
@@ -89,7 +91,12 @@ public class MigrationRunController implements FxController {
 		if (keychain.isSupported()) {
 			loadStoredPassword();
 		}
-		migrationButtonDisabled.bind(vault.stateProperty().isNotEqualTo(VaultState.NEEDS_MIGRATION).or(passwordField.textProperty().isEmpty()));
+
+		migrationButtonDisabled.bind(ObjectExpression.objectExpression(vault.stateProperty())
+				.isNotEqualTo(VaultState.Value.NEEDS_MIGRATION)
+				.or(passwordField.textProperty().isEmpty()));
+
+		window.setOnHiding(event -> passwordField.wipe());
 	}
 
 	@FXML
@@ -101,7 +108,7 @@ public class MigrationRunController implements FxController {
 	public void migrate() {
 		LOG.info("Migrating vault {}", vault.getPath());
 		CharSequence password = passwordField.getCharacters();
-		vault.setState(VaultState.PROCESSING);
+		vault.stateProperty().transition(VaultState.Value.NEEDS_MIGRATION, VaultState.Value.PROCESSING);
 		passwordField.setDisable(true);
 		ScheduledFuture<?> progressSyncTask = scheduler.scheduleAtFixedRate(() -> {
 			Platform.runLater(() -> {
@@ -110,15 +117,15 @@ public class MigrationRunController implements FxController {
 		}, 0, MIGRATION_PROGRESS_UPDATE_MILLIS, TimeUnit.MILLISECONDS);
 		Tasks.create(() -> {
 			Migrators migrators = Migrators.get();
-			migrators.migrate(vault.getPath(), MASTERKEY_FILENAME, password, this::migrationProgressChanged, this::migrationRequiresInput);
-			return migrators.needsMigration(vault.getPath(), MASTERKEY_FILENAME);
+			migrators.migrate(vault.getPath(), VAULTCONFIG_FILENAME, MASTERKEY_FILENAME, password, this::migrationProgressChanged, this::migrationRequiresInput);
+			return migrators.needsMigration(vault.getPath(), VAULTCONFIG_FILENAME, MASTERKEY_FILENAME);
 		}).onSuccess(needsAnotherMigration -> {
 			if (needsAnotherMigration) {
 				LOG.info("Migration of '{}' succeeded, but another migration is required.", vault.getDisplayName());
-				vault.setState(VaultState.NEEDS_MIGRATION);
+				vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.NEEDS_MIGRATION);
 			} else {
 				LOG.info("Migration of '{}' succeeded.", vault.getDisplayName());
-				vault.setState(VaultState.LOCKED);
+				vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.LOCKED);
 				passwordField.wipe();
 				window.setScene(successScene.get());
 			}
@@ -127,20 +134,20 @@ public class MigrationRunController implements FxController {
 			passwordField.setDisable(false);
 			passwordField.selectAll();
 			passwordField.requestFocus();
-			vault.setState(VaultState.NEEDS_MIGRATION);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.NEEDS_MIGRATION);
 		}).onError(FileSystemCapabilityChecker.MissingCapabilityException.class, e -> {
 			LOG.error("Underlying file system not supported.", e);
-			vault.setState(VaultState.NEEDS_MIGRATION);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.NEEDS_MIGRATION);
 			missingCapability.set(e.getMissingCapability());
 			window.setScene(capabilityErrorScene.get());
 		}).onError(FileNameTooLongException.class, e -> {
 			LOG.error("Migration failed because the underlying file system does not support long filenames.", e);
-			vault.setState(VaultState.NEEDS_MIGRATION);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.NEEDS_MIGRATION);
 			errorComponent.cause(e).window(window).returnToScene(startScene.get()).build().showErrorScene();
 			window.setScene(impossibleScene.get());
 		}).onError(Exception.class, e -> { // including RuntimeExceptions
 			LOG.error("Migration failed for technical reasons.", e);
-			vault.setState(VaultState.NEEDS_MIGRATION);
+			vault.stateProperty().transition(VaultState.Value.PROCESSING, VaultState.Value.NEEDS_MIGRATION);
 			errorComponent.cause(e).window(window).returnToScene(startScene.get()).build().showErrorScene();
 		}).andFinally(() -> {
 			passwordField.setDisable(false);

main/ui/src/main/java/org/cryptomator/ui/preferences/GeneralPreferencesController.java

@@ -157,8 +157,8 @@ public class GeneralPreferencesController implements FxController {
 
 
 	@FXML
-	public void showDonationTab() {
-		selectedTabProperty.set(SelectedPreferencesTab.DONATION_KEY);
+	public void showContributeTab() {
+		selectedTabProperty.set(SelectedPreferencesTab.CONTRIBUTE);
 	}
 
 	@FXML

main/ui/src/main/java/org/cryptomator/ui/preferences/PreferencesController.java

@@ -26,7 +26,7 @@ public class PreferencesController implements FxController {
 	public Tab generalTab;
 	public Tab volumeTab;
 	public Tab updatesTab;
-	public Tab donationKeyTab;
+	public Tab contributeTab;
 	public Tab aboutTab;
 
 	@Inject
@@ -52,7 +52,7 @@ public class PreferencesController implements FxController {
 		return switch (selectedTab) {
 			case UPDATES -> updatesTab;
 			case VOLUME -> volumeTab;
-			case DONATION_KEY -> donationKeyTab;
+			case CONTRIBUTE -> contributeTab;
 			case GENERAL -> generalTab;
 			case ABOUT -> aboutTab;
 			case ANY -> updateAvailable.get() ? updatesTab : generalTab;

main/ui/src/main/java/org/cryptomator/ui/preferences/PreferencesModule.java

@@ -5,7 +5,7 @@ import dagger.Module;
 import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
@@ -32,8 +32,8 @@ abstract class PreferencesModule {
 	@Provides
 	@PreferencesWindow
 	@PreferencesScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -49,8 +49,8 @@ abstract class PreferencesModule {
 	@Provides
 	@FxmlScene(FxmlFile.PREFERENCES)
 	@PreferencesScoped
-	static Scene providePreferencesScene(@PreferencesWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/preferences.fxml");
+	static Scene providePreferencesScene(@PreferencesWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.PREFERENCES);
 	}
 
 	// ------------------
@@ -77,8 +77,8 @@ abstract class PreferencesModule {
 
 	@Binds
 	@IntoMap
-	@FxControllerKey(DonationKeyPreferencesController.class)
-	abstract FxController bindDonationKeyPreferencesController(DonationKeyPreferencesController controller);
+	@FxControllerKey(SupporterCertificateController.class)
+	abstract FxController bindSupporterCertificatePreferencesController(SupporterCertificateController controller);
 
 	@Binds
 	@IntoMap

main/ui/src/main/java/org/cryptomator/ui/preferences/SelectedPreferencesTab.java

@@ -22,9 +22,9 @@ public enum SelectedPreferencesTab {
 	UPDATES,
 
 	/**
-	 * Show donation key tab
+	 * Show contribute tab
 	 */
-	DONATION_KEY,
+	CONTRIBUTE,
 
 	/**
 	 * Show about tab

main/ui/src/main/java/org/cryptomator/ui/preferences/SupporterCertificateController.java

@@ -14,17 +14,17 @@ import javafx.scene.control.TextArea;
 import javafx.scene.control.TextFormatter;
 
 @PreferencesScoped
-public class DonationKeyPreferencesController implements FxController {
+public class SupporterCertificateController implements FxController {
 
-	private static final String DONATION_URI = "https://store.cryptomator.org/desktop";
+	private static final String SUPPORTER_URI = "https://store.cryptomator.org/desktop";
 
 	private final Application application;
 	private final LicenseHolder licenseHolder;
 	private final Settings settings;
-	public TextArea donationKeyField;
+	public TextArea supporterCertificateField;
 
 	@Inject
-	DonationKeyPreferencesController(Application application, LicenseHolder licenseHolder, Settings settings) {
+	SupporterCertificateController(Application application, LicenseHolder licenseHolder, Settings settings) {
 		this.application = application;
 		this.licenseHolder = licenseHolder;
 		this.settings = settings;
@@ -32,9 +32,9 @@ public class DonationKeyPreferencesController implements FxController {
 
 	@FXML
 	public void initialize() {
-		donationKeyField.setText(licenseHolder.getLicenseKey().orElse(null));
-		donationKeyField.textProperty().addListener(this::registrationKeyChanged);
-		donationKeyField.setTextFormatter(new TextFormatter<>(this::checkVaultNameLength));
+		supporterCertificateField.setText(licenseHolder.getLicenseKey().orElse(null));
+		supporterCertificateField.textProperty().addListener(this::registrationKeyChanged);
+		supporterCertificateField.setTextFormatter(new TextFormatter<>(this::checkVaultNameLength));
 	}
 
 	private TextFormatter.Change checkVaultNameLength(TextFormatter.Change change) {
@@ -53,8 +53,8 @@ public class DonationKeyPreferencesController implements FxController {
 	}
 
 	@FXML
-	public void getDonationKey() {
-		application.getHostServices().showDocument(DONATION_URI);
+	public void getSupporterCertificate() {
+		application.getHostServices().showDocument(SUPPORTER_URI);
 	}
 
 	public LicenseHolder getLicenseHolder() {

main/ui/src/main/java/org/cryptomator/ui/quit/QuitModule.java

@@ -5,7 +5,7 @@ import dagger.Module;
 import dagger.Provides;
 import dagger.multibindings.IntoMap;
 import org.cryptomator.ui.common.DefaultSceneFactory;
-import org.cryptomator.ui.common.FXMLLoaderFactory;
+import org.cryptomator.ui.common.FxmlLoaderFactory;
 import org.cryptomator.ui.common.FxController;
 import org.cryptomator.ui.common.FxControllerKey;
 import org.cryptomator.ui.common.FxmlFile;
@@ -25,8 +25,8 @@ abstract class QuitModule {
 	@Provides
 	@QuitWindow
 	@QuitScoped
-	static FXMLLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
-		return new FXMLLoaderFactory(factories, sceneFactory, resourceBundle);
+	static FxmlLoaderFactory provideFxmlLoaderFactory(Map<Class<? extends FxController>, Provider<FxController>> factories, DefaultSceneFactory sceneFactory, ResourceBundle resourceBundle) {
+		return new FxmlLoaderFactory(factories, sceneFactory, resourceBundle);
 	}
 
 	@Provides
@@ -43,8 +43,8 @@ abstract class QuitModule {
 	@Provides
 	@FxmlScene(FxmlFile.QUIT)
 	@QuitScoped
-	static Scene provideQuitScene(@QuitWindow FXMLLoaderFactory fxmlLoaders) {
-		return fxmlLoaders.createScene("/fxml/quit.fxml");
+	static Scene provideQuitScene(@QuitWindow FxmlLoaderFactory fxmlLoaders) {
+		return fxmlLoaders.createScene(FxmlFile.QUIT);
 	}
 
 	// ------------------

main/ui/src/main/java/org/cryptomator/ui/recoverykey/RecoveryKeyCreationController.java

@@ -2,6 +2,7 @@ package org.cryptomator.ui.recoverykey;
 
 import dagger.Lazy;
 import org.cryptomator.common.vaults.Vault;
+import org.cryptomator.cryptolib.api.CryptoException;
 import org.cryptomator.cryptolib.api.InvalidPassphraseException;
 import org.cryptomator.ui.common.Animations;
 import org.cryptomator.ui.common.ErrorComponent;
@@ -80,7 +81,7 @@ public class RecoveryKeyCreationController implements FxController {
 		}
 
 		@Override
-		protected String call() throws IOException {
+		protected String call() throws IOException, CryptoException {
 			return recoveryKeyFactory.createRecoveryKey(vault.getPath(), passwordField.getCharacters());
 		}