diff --git a/encfs/BlockFileIO.cpp b/encfs/BlockFileIO.cpp
index 032217d..06a39ae 100644
--- a/encfs/BlockFileIO.cpp
+++ b/encfs/BlockFileIO.cpp
@@ -131,7 +131,7 @@ ssize_t BlockFileIO::read(const IORequest &req) const {
     MemBlock mb;         // in case we need to allocate a temporary block..
     IORequest blockReq;  // for requests we may need to make
     blockReq.dataLen = _blockSize;
-    blockReq.data = NULL;
+    blockReq.data = nullptr;
 
     unsigned char *out = req.data;
     while (size) {
@@ -210,7 +210,7 @@ bool BlockFileIO::write(const IORequest &req) {
   MemBlock mb;
 
   IORequest blockReq;
-  blockReq.data = NULL;
+  blockReq.data = nullptr;
   blockReq.dataLen = _blockSize;
 
   bool ok = true;
diff --git a/encfs/Cipher.cpp b/encfs/Cipher.cpp
index 2e1bed7..8ae0f9a 100644
--- a/encfs/Cipher.cpp
+++ b/encfs/Cipher.cpp
@@ -57,7 +57,7 @@ struct CipherAlg {
 };
 
 typedef multimap<string, CipherAlg> CipherMap_t;
-static CipherMap_t *gCipherMap = NULL;
+static CipherMap_t *gCipherMap = nullptr;
 
 std::list<Cipher::CipherAlgorithm> Cipher::GetAlgorithmList(
     bool includeHidden) {
diff --git a/encfs/CipherFileIO.cpp b/encfs/CipherFileIO.cpp
index 1a16dac..0179db9 100644
--- a/encfs/CipherFileIO.cpp
+++ b/encfs/CipherFileIO.cpp
@@ -441,7 +441,7 @@ int CipherFileIO::truncate(off_t size) {
 
     // can't let BlockFileIO call base->truncate(), since it would be using
     // the wrong size..
-    res = BlockFileIO::truncateBase(size, 0);
+    res = BlockFileIO::truncateBase(size, nullptr);
 
     if (res == 0) base->truncate(size + HEADER_SIZE);
   }
diff --git a/encfs/Context.cpp b/encfs/Context.cpp
index 5585275..fbb8acb 100644
--- a/encfs/Context.cpp
+++ b/encfs/Context.cpp
@@ -29,9 +29,9 @@
 namespace encfs {
 
 EncFS_Context::EncFS_Context() {
-  pthread_cond_init(&wakeupCond, 0);
-  pthread_mutex_init(&wakeupMutex, 0);
-  pthread_mutex_init(&contextMutex, 0);
+  pthread_cond_init(&wakeupCond, nullptr);
+  pthread_mutex_init(&wakeupMutex, nullptr);
+  pthread_mutex_init(&contextMutex, nullptr);
 
   usageCount = 0;
   currentFuseFh = 1;
@@ -109,8 +109,7 @@ void EncFS_Context::renameNode(const char *from, const char *to) {
 
 // putNode stores "node" under key "path" in the "openFiles" map. It
 // increments the reference count if the key already exists.
-void EncFS_Context::putNode(const char *path,
-                                 std::shared_ptr<FileNode> node) {
+void EncFS_Context::putNode(const char *path, std::shared_ptr<FileNode> node) {
   Lock lock(contextMutex);
   auto &list = openFiles[std::string(path)];
   // The length of "list" serves as the reference count.
@@ -120,7 +119,8 @@ void EncFS_Context::putNode(const char *path,
 
 // eraseNode is called by encfs_release in response to the RELEASE
 // FUSE-command we get from the kernel.
-void EncFS_Context::eraseNode(const char *path, std::shared_ptr<FileNode> fnode) {
+void EncFS_Context::eraseNode(const char *path,
+                              std::shared_ptr<FileNode> fnode) {
   Lock lock(contextMutex);
 
   FileMap::iterator it = openFiles.find(std::string(path));
diff --git a/encfs/DirNode.cpp b/encfs/DirNode.cpp
index 1692fd9..5560b75 100644
--- a/encfs/DirNode.cpp
+++ b/encfs/DirNode.cpp
@@ -94,7 +94,7 @@ static bool _nextName(struct dirent *&de, const std::shared_ptr<DIR> &dir,
 }
 
 std::string DirTraverse::nextPlaintextName(int *fileType, ino_t *inode) {
-  struct dirent *de = 0;
+  struct dirent *de = nullptr;
   while (_nextName(de, dir, fileType, inode)) {
     try {
       uint64_t localIv = iv;
@@ -109,9 +109,9 @@ std::string DirTraverse::nextPlaintextName(int *fileType, ino_t *inode) {
 }
 
 std::string DirTraverse::nextInvalid() {
-  struct dirent *de = 0;
+  struct dirent *de = nullptr;
   // find the first name which produces a decoding error...
-  while (_nextName(de, dir, (int *)0, (ino_t *)0)) {
+  while (_nextName(de, dir, (int *)nullptr, (ino_t *)nullptr)) {
     try {
       uint64_t localIv = iv;
       naming->decodePath(de->d_name, &localIv);
@@ -241,7 +241,7 @@ void RenameOp::undo() {
 
 DirNode::DirNode(EncFS_Context *_ctx, const string &sourceDir,
                  const FSConfigPtr &_config) {
-  pthread_mutex_init(&mutex, 0);
+  pthread_mutex_init(&mutex, nullptr);
 
   Lock _lock(mutex);
 
@@ -354,7 +354,7 @@ DirTraverse DirNode::openDir(const char *plaintextPath) {
   string cyName = rootDir + naming->encodePath(plaintextPath);
 
   DIR *dir = ::opendir(cyName.c_str());
-  if (dir == NULL) {
+  if (dir == nullptr) {
     VLOG(1) << "opendir error " << strerror(errno);
     return DirTraverse(shared_ptr<DIR>(), 0, std::shared_ptr<NameIO>());
   } else {
@@ -392,8 +392,8 @@ bool DirNode::genRenameList(list<RenameEl> &renameList, const char *fromP,
       std::shared_ptr<DIR>(opendir(sourcePath.c_str()), DirDeleter());
   if (!dir) return false;
 
-  struct dirent *de = NULL;
-  while ((de = ::readdir(dir.get())) != NULL) {
+  struct dirent *de = nullptr;
+  while ((de = ::readdir(dir.get())) != nullptr) {
     // decode the name using the oldIV
     uint64_t localIV = fromIV;
     string plainName;
@@ -475,8 +475,9 @@ bool DirNode::genRenameList(list<RenameEl> &renameList, const char *fromP,
     will have changed..
 
     Returns a list of renamed items on success, a null list on failure.
-*/ std::shared_ptr<RenameOp> DirNode::newRenameOp(const char *fromP,
-                                                  const char *toP) {
+*/
+std::shared_ptr<RenameOp> DirNode::newRenameOp(const char *fromP,
+                                               const char *toP) {
   // Do the rename in two stages to avoid chasing our tail
   // Undo everything if we encounter an error!
   std::shared_ptr<list<RenameEl> > renameList(new list<RenameEl>);
@@ -604,10 +605,12 @@ int DirNode::link(const char *from, const char *to) {
 /*
     The node is keyed by filename, so a rename means the internal node names
     must be changed.
-*/ std::shared_ptr<FileNode> DirNode::renameNode(const char *from,
-                                                 const char *to) {
+*/
+std::shared_ptr<FileNode> DirNode::renameNode(const char *from,
+                                              const char *to) {
   return renameNode(from, to, true);
 }
+
 std::shared_ptr<FileNode> DirNode::renameNode(const char *from, const char *to,
                                               bool forwardMode) {
   std::shared_ptr<FileNode> node = findOrCreate(from);
@@ -637,18 +640,18 @@ std::shared_ptr<FileNode> DirNode::findOrCreate(const char *plainName) {
   std::shared_ptr<FileNode> node;
 
   // See if we already have a FileNode for this path.
-  if (ctx)
-    node = ctx->lookupNode(plainName);
+  if (ctx) node = ctx->lookupNode(plainName);
 
   // If we don't, create a new one.
   if (!node) {
     uint64_t iv = 0;
     string cipherName = naming->encodePath(plainName, &iv);
-	uint64_t fuseFh = ctx->nextFuseFh();
+    uint64_t fuseFh = ctx->nextFuseFh();
     node.reset(new FileNode(this, fsConfig, plainName,
                             (rootDir + cipherName).c_str(), fuseFh));
 
-    if (fsConfig->config->externalIVChaining) node->setName(0, 0, iv);
+    if (fsConfig->config->externalIVChaining)
+      node->setName(nullptr, nullptr, iv);
 
     VLOG(1) << "created FileNode for " << node->cipherName();
   }
@@ -669,10 +672,10 @@ shared_ptr<FileNode> DirNode::lookupNode(const char *plainName,
     "result" is set to -1 on failure, a value >= 0 on success.
 */
 std::shared_ptr<FileNode> DirNode::openNode(const char *plainName,
-                                               const char *requestor, int flags,
-                                               int *result) {
+                                            const char *requestor, int flags,
+                                            int *result) {
   (void)requestor;
-  rAssert(result != NULL);
+  rAssert(result != nullptr);
   Lock _lock(mutex);
 
   std::shared_ptr<FileNode> node = findOrCreate(plainName);
diff --git a/encfs/Error.cpp b/encfs/Error.cpp
index 63ae113..7d75dea 100644
--- a/encfs/Error.cpp
+++ b/encfs/Error.cpp
@@ -18,18 +18,17 @@ void initLogging(bool enable_debug, bool is_daemon) {
   if (is_daemon) {
     prefix = "";
     encfs::rlogAction = el::base::DispatchAction::SysLog;
-  }
-  else {
+  } else {
     el::Loggers::addFlag(el::LoggingFlag::ColoredTerminalOutput);
   }
   if (!enable_debug) {
     suffix = "";
     defaultConf.set(el::Level::Debug, el::ConfigurationType::Enabled, "false");
-  }
-  else {
+  } else {
     el::Loggers::setVerboseLevel(1);
   }
-  defaultConf.setGlobally(el::ConfigurationType::Format, prefix + std::string("%level %msg") + suffix);
+  defaultConf.setGlobally(el::ConfigurationType::Format,
+                          prefix + std::string("%level %msg") + suffix);
   el::Loggers::reconfigureLogger("default", defaultConf);
 }
 
diff --git a/encfs/FileNode.cpp b/encfs/FileNode.cpp
index e407d3b..96e27b9 100644
--- a/encfs/FileNode.cpp
+++ b/encfs/FileNode.cpp
@@ -53,9 +53,10 @@ namespace encfs {
 */
 
 FileNode::FileNode(DirNode *parent_, const FSConfigPtr &cfg,
-                   const char *plaintextName_, const char *cipherName_, uint64_t fuseFh) {
+                   const char *plaintextName_, const char *cipherName_,
+                   uint64_t fuseFh) {
 
-  pthread_mutex_init(&mutex, 0);
+  pthread_mutex_init(&mutex, nullptr);
 
   Lock _lock(mutex);
 
diff --git a/encfs/FileUtils.cpp b/encfs/FileUtils.cpp
index f3a3eb8..ae4adf3 100644
--- a/encfs/FileUtils.cpp
+++ b/encfs/FileUtils.cpp
@@ -111,12 +111,12 @@ struct ConfigInfo {
     // backward compatible support for older versions
     {".encfs5", Config_V5, "ENCFS5_CONFIG", readV5Config, writeV5Config,
      V5SubVersion, V5SubVersionDefault},
-    {".encfs4", Config_V4, NULL, readV4Config, writeV4Config, 0, 0},
+    {".encfs4", Config_V4, nullptr, readV4Config, writeV4Config, 0, 0},
     // no longer support earlier versions
-    {".encfs3", Config_V3, NULL, NULL, NULL, 0, 0},
-    {".encfs2", Config_Prehistoric, NULL, NULL, NULL, 0, 0},
-    {".encfs", Config_Prehistoric, NULL, NULL, NULL, 0, 0},
-    {NULL, Config_None, NULL, NULL, NULL, 0, 0}};
+    {".encfs3", Config_V3, nullptr, nullptr, nullptr, 0, 0},
+    {".encfs2", Config_Prehistoric, nullptr, nullptr, nullptr, 0, 0},
+    {".encfs", Config_Prehistoric, nullptr, nullptr, nullptr, 0, 0},
+    {nullptr, Config_None, nullptr, nullptr, nullptr, 0, 0}};
 
 EncFS_Root::EncFS_Root() {}
 
@@ -188,7 +188,7 @@ bool userAllowMkdir(int promptno, const char *path, mode_t mode) {
   }
   res = fgets(answer, sizeof(answer), stdin);
 
-  if (res != 0 && toupper(answer[0]) == 'Y') {
+  if (res != nullptr && toupper(answer[0]) == 'Y') {
     int result = mkdir(path, mode);
     if (result < 0) {
       perror(_("Unable to create directory: "));
@@ -235,9 +235,9 @@ ConfigType readConfig(const string &rootDir, EncFSConfig *config) {
   ConfigInfo *nm = ConfigFileMapping;
   while (nm->fileName) {
     // allow environment variable to override default config path
-    if (nm->environmentOverride != NULL) {
+    if (nm->environmentOverride != nullptr) {
       char *envFile = getenv(nm->environmentOverride);
-      if (envFile != NULL) {
+      if (envFile != nullptr) {
         if (!fileExists(envFile)) {
           RLOG(ERROR)
               << "fatal: config file specified by environment does not exist: "
@@ -448,10 +448,10 @@ bool saveConfig(ConfigType type, const string &rootDir,
   while (nm->fileName) {
     if (nm->type == type && nm->saveFunc) {
       string path = rootDir + nm->fileName;
-      if (nm->environmentOverride != NULL) {
+      if (nm->environmentOverride != nullptr) {
         // use environment file if specified..
         const char *envFile = getenv(nm->environmentOverride);
-        if (envFile != NULL) path.assign(envFile);
+        if (envFile != nullptr) path.assign(envFile);
       }
 
       try {
@@ -649,7 +649,7 @@ static Cipher::CipherAlgorithm selectCipherAlgorithm() {
     cout << "\n" << _("Enter the number corresponding to your choice: ");
     char answer[10];
     char *res = fgets(answer, sizeof(answer), stdin);
-    int cipherNum = (res == 0 ? 0 : atoi(answer));
+    int cipherNum = (res == nullptr ? 0 : atoi(answer));
     cout << "\n";
 
     if (cipherNum < 1 || cipherNum > (int)algorithms.size()) {
@@ -692,7 +692,7 @@ static Interface selectNameCoding() {
     cout << "\n" << _("Enter the number corresponding to your choice: ");
     char answer[10];
     char *res = fgets(answer, sizeof(answer), stdin);
-    int algNum = (res == 0 ? 0 : atoi(answer));
+    int algNum = (res == nullptr ? 0 : atoi(answer));
     cout << "\n";
 
     if (algNum < 1 || algNum > (int)algorithms.size()) {
@@ -754,7 +754,7 @@ static int selectKeySize(const Cipher::CipherAlgorithm &alg) {
 
   char answer[10];
   char *res = fgets(answer, sizeof(answer), stdin);
-  int keySize = (res == 0 ? 0 : atoi(answer));
+  int keySize = (res == nullptr ? 0 : atoi(answer));
   cout << "\n";
 
   keySize = alg.keyLength.closest(keySize);
@@ -794,7 +794,8 @@ static int selectBlockSize(const Cipher::CipherAlgorithm &alg) {
   char *res = fgets(answer, sizeof(answer), stdin);
   cout << "\n";
 
-  if (res != 0 && atoi(answer) >= alg.blockSize.min()) blockSize = atoi(answer);
+  if (res != nullptr && atoi(answer) >= alg.blockSize.min())
+    blockSize = atoi(answer);
 
   blockSize = alg.blockSize.closest(blockSize);
 
@@ -893,7 +894,7 @@ static void selectBlockMAC(int *macBytes, int *macRandBytes, bool forceMac) {
   char *res = fgets(answer, sizeof(answer), stdin);
   cout << "\n";
 
-  randSize = (res == 0 ? 0 : atoi(answer));
+  randSize = (res == nullptr ? 0 : atoi(answer));
   if (randSize < 0) randSize = 0;
   if (randSize > 8) randSize = 8;
 
@@ -1462,7 +1463,7 @@ CipherKey EncFSConfig::getUserKey(const std::string &passProg,
     argv[0] = "/bin/sh";
     argv[1] = "-c";
     argv[2] = passProg.c_str();
-    argv[3] = 0;
+    argv[3] = nullptr;
 
     // child process.. run the command and send output to fds[0]
     close(fds[1]);  // we don't use the other half..
@@ -1500,7 +1501,7 @@ CipherKey EncFSConfig::getUserKey(const std::string &passProg,
   string password = readPassword(fds[1]);
   close(fds[1]);
 
-  waitpid(pid, NULL, 0);
+  waitpid(pid, nullptr, 0);
 
   // convert to key..
   result = makeKey(password.c_str(), password.length());
diff --git a/encfs/MACFileIO.cpp b/encfs/MACFileIO.cpp
index cf2760c..092fb1f 100644
--- a/encfs/MACFileIO.cpp
+++ b/encfs/MACFileIO.cpp
@@ -251,7 +251,7 @@ int MACFileIO::truncate(off_t size) {
   int headerSize = macBytes + randBytes;
   int bs = blockSize() + headerSize;
 
-  int res = BlockFileIO::truncateBase(size, 0);
+  int res = BlockFileIO::truncateBase(size, nullptr);
 
   if (res == 0) base->truncate(locWithHeader(size, bs, headerSize));
 
diff --git a/encfs/MemoryPool.cpp b/encfs/MemoryPool.cpp
index 532ac8c..37137bc 100644
--- a/encfs/MemoryPool.cpp
+++ b/encfs/MemoryPool.cpp
@@ -61,15 +61,15 @@ static void freeBlock(BlockList *el) {
 }
 
 static pthread_mutex_t gMPoolMutex = PTHREAD_MUTEX_INITIALIZER;
-static BlockList *gMemPool = NULL;
+static BlockList *gMemPool = nullptr;
 
 MemBlock MemoryPool::allocate(int size) {
   pthread_mutex_lock(&gMPoolMutex);
 
-  BlockList *parent = NULL;
+  BlockList *parent = nullptr;
   BlockList *block = gMemPool;
   // check if we already have a large enough block available..
-  while (block != NULL && block->size < size) {
+  while (block != nullptr && block->size < size) {
     parent = block;
     block = block->next;
   }
@@ -84,7 +84,7 @@ MemBlock MemoryPool::allocate(int size) {
   pthread_mutex_unlock(&gMPoolMutex);
 
   if (!block) block = allocBlock(size);
-  block->next = NULL;
+  block->next = nullptr;
 
   MemBlock result;
   result.data = BLOCKDATA(block);
@@ -115,11 +115,11 @@ void MemoryPool::destroyAll() {
   pthread_mutex_lock(&gMPoolMutex);
 
   BlockList *block = gMemPool;
-  gMemPool = NULL;
+  gMemPool = nullptr;
 
   pthread_mutex_unlock(&gMPoolMutex);
 
-  while (block != NULL) {
+  while (block != nullptr) {
     BlockList *next = block->next;
 
     freeBlock(block);
diff --git a/encfs/NameIO.cpp b/encfs/NameIO.cpp
index 6495586..7dbf9dc 100644
--- a/encfs/NameIO.cpp
+++ b/encfs/NameIO.cpp
@@ -56,7 +56,7 @@ struct NameIOAlg {
 };
 
 typedef multimap<string, NameIOAlg> NameIOMap_t;
-static NameIOMap_t *gNameIOMap = 0;
+static NameIOMap_t *gNameIOMap = nullptr;
 
 list<NameIO::Algorithm> NameIO::GetAlgorithmList(bool includeHidden) {
   AddSymbolReferences();
@@ -195,14 +195,14 @@ std::string NameIO::decodePath(const char *cipherPath) const {
 
 std::string NameIO::_encodePath(const char *plaintextPath, uint64_t *iv) const {
   // if chaining is not enabled, then the iv pointer is not used..
-  if (!chainedNameIV) iv = 0;
+  if (!chainedNameIV) iv = nullptr;
   return recodePath(plaintextPath, &NameIO::maxEncodedNameLen,
                     &NameIO::encodeName, iv);
 }
 
 std::string NameIO::_decodePath(const char *cipherPath, uint64_t *iv) const {
   // if chaining is not enabled, then the iv pointer is not used..
-  if (!chainedNameIV) iv = 0;
+  if (!chainedNameIV) iv = nullptr;
   return recodePath(cipherPath, &NameIO::maxDecodedNameLen, &NameIO::decodeName,
                     iv);
 }
@@ -217,12 +217,12 @@ std::string NameIO::decodePath(const char *path, uint64_t *iv) const {
 
 int NameIO::encodeName(const char *input, int length, char *output,
                        int bufferLength) const {
-  return encodeName(input, length, (uint64_t *)0, output, bufferLength);
+  return encodeName(input, length, (uint64_t *)nullptr, output, bufferLength);
 }
 
 int NameIO::decodeName(const char *input, int length, char *output,
                        int bufferLength) const {
-  return decodeName(input, length, (uint64_t *)0, output, bufferLength);
+  return decodeName(input, length, (uint64_t *)nullptr, output, bufferLength);
 }
 
 std::string NameIO::_encodeName(const char *plaintextName, int length) const {
@@ -232,7 +232,7 @@ std::string NameIO::_encodeName(const char *plaintextName, int length) const {
   BUFFER_INIT_S(codeBuf, 32, (unsigned int)approxLen + 1, bufSize)
 
   // code the name
-  int codedLen = encodeName(plaintextName, length, 0, codeBuf, bufSize);
+  int codedLen = encodeName(plaintextName, length, nullptr, codeBuf, bufSize);
   rAssert(codedLen <= approxLen);
   rAssert(codeBuf[codedLen] == '\0');
 
@@ -251,7 +251,7 @@ std::string NameIO::_decodeName(const char *encodedName, int length) const {
   BUFFER_INIT_S(codeBuf, 32, (unsigned int)approxLen + 1, bufSize)
 
   // code the name
-  int codedLen = decodeName(encodedName, length, 0, codeBuf, bufSize);
+  int codedLen = decodeName(encodedName, length, nullptr, codeBuf, bufSize);
   rAssert(codedLen <= approxLen);
   rAssert(codeBuf[codedLen] == '\0');
 
diff --git a/encfs/SSL_Cipher.cpp b/encfs/SSL_Cipher.cpp
index f2f8294..51e5ccf 100644
--- a/encfs/SSL_Cipher.cpp
+++ b/encfs/SSL_Cipher.cpp
@@ -36,8 +36,8 @@
 #include "Interface.h"
 #include "Mutex.h"
 #include "Range.h"
-#include "SSL_Compat.h"
 #include "SSL_Cipher.h"
+#include "SSL_Compat.h"
 #include "intl/gettext.h"
 
 using namespace std;
@@ -66,7 +66,7 @@ inline int MIN(int a, int b) { return (a < b) ? a : b; }
 int BytesToKey(int keyLen, int ivLen, const EVP_MD *md,
                const unsigned char *data, int dataLen, unsigned int rounds,
                unsigned char *key, unsigned char *iv) {
-  if (data == NULL || dataLen == 0)
+  if (data == nullptr || dataLen == 0)
     return 0;  // OpenSSL returns nkey here, but why?  It is a failure..
 
   unsigned char mdBuf[EVP_MAX_MD_SIZE];
@@ -79,13 +79,13 @@ int BytesToKey(int keyLen, int ivLen, const EVP_MD *md,
   EVP_MD_CTX_init(cx);
 
   for (;;) {
-    EVP_DigestInit_ex(cx, md, NULL);
+    EVP_DigestInit_ex(cx, md, nullptr);
     if (addmd++) EVP_DigestUpdate(cx, mdBuf, mds);
     EVP_DigestUpdate(cx, data, dataLen);
     EVP_DigestFinal_ex(cx, mdBuf, &mds);
 
     for (unsigned int i = 1; i < rounds; ++i) {
-      EVP_DigestInit_ex(cx, md, NULL);
+      EVP_DigestInit_ex(cx, md, nullptr);
       EVP_DigestUpdate(cx, mdBuf, mds);
       EVP_DigestFinal_ex(cx, mdBuf, &mds);
     }
@@ -125,13 +125,13 @@ int TimedPBKDF2(const char *pass, int passlen, const unsigned char *salt,
   timeval start, end;
 
   for (;;) {
-    gettimeofday(&start, 0);
+    gettimeofday(&start, nullptr);
     int res =
         PKCS5_PBKDF2_HMAC_SHA1(pass, passlen, const_cast<unsigned char *>(salt),
                                saltlen, iter, keylen, out);
     if (res != 1) return -1;
 
-    gettimeofday(&end, 0);
+    gettimeofday(&end, nullptr);
 
     long delta = time_diff(end, start);
     if (delta < desiredPDFTime / 8) {
@@ -189,8 +189,8 @@ static std::shared_ptr<Cipher> NewAESCipher(const Interface &iface,
 
   keyLen = AESKeyRange.closest(keyLen);
 
-  const EVP_CIPHER *blockCipher = 0;
-  const EVP_CIPHER *streamCipher = 0;
+  const EVP_CIPHER *blockCipher = nullptr;
+  const EVP_CIPHER *streamCipher = nullptr;
 
   switch (keyLen) {
     case 128:
@@ -244,7 +244,7 @@ class SSLKey : public AbstractCipherKey {
 SSLKey::SSLKey(int keySize_, int ivLength_) {
   this->keySize = keySize_;
   this->ivLength = ivLength_;
-  pthread_mutex_init(&mutex, 0);
+  pthread_mutex_init(&mutex, nullptr);
   buffer = (unsigned char *)OPENSSL_malloc(keySize + ivLength);
   memset(buffer, 0, keySize + ivLength);
 
@@ -272,7 +272,7 @@ SSLKey::~SSLKey() {
 
   keySize = 0;
   ivLength = 0;
-  buffer = 0;
+  buffer = nullptr;
 
   EVP_CIPHER_CTX_free(block_enc);
   EVP_CIPHER_CTX_free(block_dec);
@@ -295,10 +295,10 @@ void initKey(const std::shared_ptr<SSLKey> &key, const EVP_CIPHER *_blockCipher,
   Lock lock(key->mutex);
   // initialize the cipher context once so that we don't have to do it for
   // every block..
-  EVP_EncryptInit_ex(key->block_enc, _blockCipher, NULL, NULL, NULL);
-  EVP_DecryptInit_ex(key->block_dec, _blockCipher, NULL, NULL, NULL);
-  EVP_EncryptInit_ex(key->stream_enc, _streamCipher, NULL, NULL, NULL);
-  EVP_DecryptInit_ex(key->stream_dec, _streamCipher, NULL, NULL, NULL);
+  EVP_EncryptInit_ex(key->block_enc, _blockCipher, nullptr, nullptr, nullptr);
+  EVP_DecryptInit_ex(key->block_dec, _blockCipher, nullptr, nullptr, nullptr);
+  EVP_EncryptInit_ex(key->stream_enc, _streamCipher, nullptr, nullptr, nullptr);
+  EVP_DecryptInit_ex(key->stream_dec, _streamCipher, nullptr, nullptr, nullptr);
 
   EVP_CIPHER_CTX_set_key_length(key->block_enc, _keySize);
   EVP_CIPHER_CTX_set_key_length(key->block_dec, _keySize);
@@ -310,12 +310,12 @@ void initKey(const std::shared_ptr<SSLKey> &key, const EVP_CIPHER *_blockCipher,
   EVP_CIPHER_CTX_set_padding(key->stream_enc, 0);
   EVP_CIPHER_CTX_set_padding(key->stream_dec, 0);
 
-  EVP_EncryptInit_ex(key->block_enc, NULL, NULL, KeyData(key), NULL);
-  EVP_DecryptInit_ex(key->block_dec, NULL, NULL, KeyData(key), NULL);
-  EVP_EncryptInit_ex(key->stream_enc, NULL, NULL, KeyData(key), NULL);
-  EVP_DecryptInit_ex(key->stream_dec, NULL, NULL, KeyData(key), NULL);
+  EVP_EncryptInit_ex(key->block_enc, nullptr, nullptr, KeyData(key), nullptr);
+  EVP_DecryptInit_ex(key->block_dec, nullptr, nullptr, KeyData(key), nullptr);
+  EVP_EncryptInit_ex(key->stream_enc, nullptr, nullptr, KeyData(key), nullptr);
+  EVP_DecryptInit_ex(key->stream_dec, nullptr, nullptr, KeyData(key), nullptr);
 
-  HMAC_Init_ex(key->mac_ctx, KeyData(key), _keySize, EVP_sha1(), 0);
+  HMAC_Init_ex(key->mac_ctx, KeyData(key), _keySize, EVP_sha1(), nullptr);
 }
 
 SSL_Cipher::SSL_Cipher(const Interface &iface_, const Interface &realIface_,
@@ -401,7 +401,7 @@ CipherKey SSL_Cipher::newKey(const char *password, int passwdLength) {
     }
   } else {
     // for backward compatibility with filesystems created with 1:0
-    bytes = EVP_BytesToKey(_blockCipher, EVP_sha1(), NULL,
+    bytes = EVP_BytesToKey(_blockCipher, EVP_sha1(), nullptr,
                            (unsigned char *)password, passwdLength, 16,
                            KeyData(key), IVData(key));
   }
@@ -456,7 +456,7 @@ static uint64_t _checksum_64(SSLKey *key, const unsigned char *data,
   unsigned char md[EVP_MAX_MD_SIZE];
   unsigned int mdLen = EVP_MAX_MD_SIZE;
 
-  HMAC_Init_ex(key->mac_ctx, 0, 0, 0, 0);
+  HMAC_Init_ex(key->mac_ctx, nullptr, 0, nullptr, nullptr);
   HMAC_Update(key->mac_ctx, data, dataLen);
   if (chainedIV) {
     // toss in the chained IV as well
@@ -637,7 +637,7 @@ void SSL_Cipher::setIVec(unsigned char *ivec, uint64_t seed,
     }
 
     // combine ivec and seed with HMAC
-    HMAC_Init_ex(key->mac_ctx, 0, 0, 0, 0);
+    HMAC_Init_ex(key->mac_ctx, nullptr, 0, nullptr, nullptr);
     HMAC_Update(key->mac_ctx, ivec, _ivLength);
     HMAC_Update(key->mac_ctx, md, 8);
     HMAC_Final(key->mac_ctx, md, &mdLen);
@@ -732,7 +732,7 @@ bool SSL_Cipher::streamEncode(unsigned char *buf, int size, uint64_t iv64,
   shuffleBytes(buf, size);
 
   setIVec(ivec, iv64, key);
-  EVP_EncryptInit_ex(key->stream_enc, NULL, NULL, NULL, ivec);
+  EVP_EncryptInit_ex(key->stream_enc, nullptr, nullptr, nullptr, ivec);
   EVP_EncryptUpdate(key->stream_enc, buf, &dstLen, buf, size);
   EVP_EncryptFinal_ex(key->stream_enc, buf + dstLen, &tmpLen);
 
@@ -740,7 +740,7 @@ bool SSL_Cipher::streamEncode(unsigned char *buf, int size, uint64_t iv64,
   shuffleBytes(buf, size);
 
   setIVec(ivec, iv64 + 1, key);
-  EVP_EncryptInit_ex(key->stream_enc, NULL, NULL, NULL, ivec);
+  EVP_EncryptInit_ex(key->stream_enc, nullptr, nullptr, nullptr, ivec);
   EVP_EncryptUpdate(key->stream_enc, buf, &dstLen, buf, size);
   EVP_EncryptFinal_ex(key->stream_enc, buf + dstLen, &tmpLen);
 
@@ -766,7 +766,7 @@ bool SSL_Cipher::streamDecode(unsigned char *buf, int size, uint64_t iv64,
   int dstLen = 0, tmpLen = 0;
 
   setIVec(ivec, iv64 + 1, key);
-  EVP_DecryptInit_ex(key->stream_dec, NULL, NULL, NULL, ivec);
+  EVP_DecryptInit_ex(key->stream_dec, nullptr, nullptr, nullptr, ivec);
   EVP_DecryptUpdate(key->stream_dec, buf, &dstLen, buf, size);
   EVP_DecryptFinal_ex(key->stream_dec, buf + dstLen, &tmpLen);
 
@@ -774,7 +774,7 @@ bool SSL_Cipher::streamDecode(unsigned char *buf, int size, uint64_t iv64,
   flipBytes(buf, size);
 
   setIVec(ivec, iv64, key);
-  EVP_DecryptInit_ex(key->stream_dec, NULL, NULL, NULL, ivec);
+  EVP_DecryptInit_ex(key->stream_dec, nullptr, nullptr, nullptr, ivec);
   EVP_DecryptUpdate(key->stream_dec, buf, &dstLen, buf, size);
   EVP_DecryptFinal_ex(key->stream_dec, buf + dstLen, &tmpLen);
 
@@ -808,7 +808,7 @@ bool SSL_Cipher::blockEncode(unsigned char *buf, int size, uint64_t iv64,
   int dstLen = 0, tmpLen = 0;
   setIVec(ivec, iv64, key);
 
-  EVP_EncryptInit_ex(key->block_enc, NULL, NULL, NULL, ivec);
+  EVP_EncryptInit_ex(key->block_enc, nullptr, nullptr, nullptr, ivec);
   EVP_EncryptUpdate(key->block_enc, buf, &dstLen, buf, size);
   EVP_EncryptFinal_ex(key->block_enc, buf + dstLen, &tmpLen);
   dstLen += tmpLen;
@@ -840,7 +840,7 @@ bool SSL_Cipher::blockDecode(unsigned char *buf, int size, uint64_t iv64,
   int dstLen = 0, tmpLen = 0;
   setIVec(ivec, iv64, key);
 
-  EVP_DecryptInit_ex(key->block_dec, NULL, NULL, NULL, ivec);
+  EVP_DecryptInit_ex(key->block_dec, nullptr, nullptr, nullptr, ivec);
   EVP_DecryptUpdate(key->block_dec, buf, &dstLen, buf, size);
   EVP_DecryptFinal_ex(key->block_dec, buf + dstLen, &tmpLen);
   dstLen += tmpLen;
diff --git a/encfs/XmlReader.cpp b/encfs/XmlReader.cpp
index 285a7ef..8016d9c 100644
--- a/encfs/XmlReader.cpp
+++ b/encfs/XmlReader.cpp
@@ -22,8 +22,8 @@
 
 #include <algorithm>  // for remove_if
 #include <cstring>    // for NULL
-#include <memory>     // for shared_ptr
 #include <fstream>    // for ifstream
+#include <memory>     // for shared_ptr
 #include <sstream>    // for ostringstream
 
 #include <tinyxml2.h>  // for XMLElement, XMLNode, XMLDocument (ptr only)
@@ -121,7 +121,7 @@ bool XmlValue::read(const char *path, Interface *out) const {
 
 std::string safeValueForNode(const tinyxml2::XMLElement *element) {
   std::string value;
-  if (element == NULL) return value;
+  if (element == nullptr) return value;
 
   const tinyxml2::XMLNode *child = element->FirstChild();
   if (child) {
@@ -180,13 +180,13 @@ bool XmlReader::load(const char *fileName) {
 
 XmlValuePtr XmlReader::operator[](const char *name) const {
   tinyxml2::XMLNode *node = pd->doc->FirstChildElement(name);
-  if (node == NULL) {
+  if (node == nullptr) {
     RLOG(ERROR) << "Xml node " << name << " not found";
     return XmlValuePtr(new XmlValue());
   }
 
   tinyxml2::XMLElement *element = node->ToElement();
-  if (element == NULL) {
+  if (element == nullptr) {
     RLOG(ERROR) << "Xml node " << name << " not element";
     return XmlValuePtr(new XmlValue());
   }
diff --git a/encfs/autosprintf.cpp b/encfs/autosprintf.cpp
index c32aa8f..7281825 100644
--- a/encfs/autosprintf.cpp
+++ b/encfs/autosprintf.cpp
@@ -38,13 +38,13 @@ namespace gnu {
 autosprintf::autosprintf(const char *format, ...) {
   va_list args;
   va_start(args, format);
-  if (vasprintf(&str, format, args) < 0) str = NULL;
+  if (vasprintf(&str, format, args) < 0) str = nullptr;
   va_end(args);
 }
 
 /* Copy constructor.  Necessary because the destructor is nontrivial.  */
 autosprintf::autosprintf(const autosprintf &src) {
-  str = (src.str != NULL ? strdup(src.str) : NULL);
+  str = (src.str != nullptr ? strdup(src.str) : nullptr);
 }
 
 /* Destructor: frees the temporarily allocated string.  */
@@ -52,13 +52,13 @@ autosprintf::~autosprintf() { free(str); }
 
 /* Conversion to string.  */
 autosprintf::operator char *() const {
-  if (str != NULL) {
+  if (str != nullptr) {
     size_t length = strlen(str) + 1;
     char *copy = new char[length];
     memcpy(copy, str, length);
     return copy;
   } else
-    return NULL;
+    return nullptr;
 }
 autosprintf::operator std::string() const {
   return std::string(str ? str : "(error in autosprintf)");
diff --git a/encfs/base64.cpp b/encfs/base64.cpp
index 1c69164..cc6eb19 100644
--- a/encfs/base64.cpp
+++ b/encfs/base64.cpp
@@ -105,7 +105,7 @@ static void changeBase2Inline(unsigned char *src, int srcLen, int src2Pow,
 void changeBase2Inline(unsigned char *src, int srcLen, int src2Pow, int dst2Pow,
                        bool outputPartialLastByte) {
   changeBase2Inline(src, srcLen, src2Pow, dst2Pow, outputPartialLastByte, 0, 0,
-                    0);
+                    nullptr);
 }
 
 // character set for ascii b64:
diff --git a/encfs/encfs.cpp b/encfs/encfs.cpp
index 65993be..855863f 100644
--- a/encfs/encfs.cpp
+++ b/encfs/encfs.cpp
@@ -76,7 +76,7 @@ static EncFS_Context *context() {
  * if the argument is NULL.
  */
 static bool isReadOnly(EncFS_Context *ctx) {
-  if (ctx == NULL) ctx = (EncFS_Context *)fuse_get_context()->private_data;
+  if (ctx == nullptr) ctx = (EncFS_Context *)fuse_get_context()->private_data;
 
   return ctx->opts->readOnly;
 }
@@ -112,20 +112,22 @@ static int withCipherPath(const char *opName, const char *path,
 }
 
 static void checkCanary(std::shared_ptr<FileNode> fnode) {
-  if(fnode->canary == CANARY_OK) {
+  if (fnode->canary == CANARY_OK) {
     return;
   }
-  if(fnode->canary == CANARY_RELEASED) {
+  if (fnode->canary == CANARY_RELEASED) {
     // "fnode" may have been released after it was retrieved by
     // lookupFuseFh. This is not an error. std::shared_ptr will release
     // the memory only when all operations on the FileNode have been
     // completed.
     return;
   }
-  if(fnode->canary == CANARY_DESTROYED) {
-    RLOG(ERROR) << "canary=CANARY_DESTROYED. FileNode accessed after it was destroyed.";
+  if (fnode->canary == CANARY_DESTROYED) {
+    RLOG(ERROR)
+        << "canary=CANARY_DESTROYED. FileNode accessed after it was destroyed.";
   } else {
-    RLOG(ERROR) << "canary=0x" << std::hex << fnode->canary << ". Memory corruption?";
+    RLOG(ERROR) << "canary=0x" << std::hex << fnode->canary
+                << ". Memory corruption?";
   }
   throw Error("dead canary");
 }
@@ -214,7 +216,7 @@ int _do_getattr(FileNode *fnode, struct stat *stbuf) {
 }
 
 int encfs_getattr(const char *path, struct stat *stbuf) {
-  return withFileNode("getattr", path, NULL, bind(_do_getattr, _1, stbuf));
+  return withFileNode("getattr", path, nullptr, bind(_do_getattr, _1, stbuf));
 }
 
 int encfs_fgetattr(const char *path, struct stat *stbuf,
@@ -366,7 +368,7 @@ int _do_rmdir(EncFS_Context *, const string &cipherPath) {
 }
 
 int encfs_rmdir(const char *path) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("rmdir", path, bind(_do_rmdir, _1, _2));
 }
 
@@ -485,7 +487,7 @@ int _do_chmod(EncFS_Context *, const string &cipherPath, mode_t mode) {
 }
 
 int encfs_chmod(const char *path, mode_t mode) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("chmod", path, bind(_do_chmod, _1, _2, mode));
 }
 
@@ -495,19 +497,19 @@ int _do_chown(EncFS_Context *, const string &cyName, uid_t u, gid_t g) {
 }
 
 int encfs_chown(const char *path, uid_t uid, gid_t gid) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("chown", path, bind(_do_chown, _1, _2, uid, gid));
 }
 
 int _do_truncate(FileNode *fnode, off_t size) { return fnode->truncate(size); }
 
 int encfs_truncate(const char *path, off_t size) {
-  if (isReadOnly(NULL)) return -EROFS;
-  return withFileNode("truncate", path, NULL, bind(_do_truncate, _1, size));
+  if (isReadOnly(nullptr)) return -EROFS;
+  return withFileNode("truncate", path, nullptr, bind(_do_truncate, _1, size));
 }
 
 int encfs_ftruncate(const char *path, off_t size, struct fuse_file_info *fi) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withFileNode("ftruncate", path, fi, bind(_do_truncate, _1, size));
 }
 
@@ -517,7 +519,7 @@ int _do_utime(EncFS_Context *, const string &cyName, struct utimbuf *buf) {
 }
 
 int encfs_utime(const char *path, struct utimbuf *buf) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("utime", path, bind(_do_utime, _1, _2, buf));
 }
 
@@ -538,7 +540,7 @@ int _do_utimens(EncFS_Context *, const string &cyName,
 }
 
 int encfs_utimens(const char *path, const struct timespec ts[2]) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("utimens", path, bind(_do_utimens, _1, _2, ts));
 }
 
@@ -641,7 +643,7 @@ int _do_fsync(FileNode *fnode, int dataSync) {
 }
 
 int encfs_fsync(const char *path, int dataSync, struct fuse_file_info *file) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withFileNode("fsync", path, file, bind(_do_fsync, _1, dataSync));
 }
 
@@ -654,7 +656,7 @@ int _do_write(FileNode *fnode, unsigned char *ptr, size_t size, off_t offset) {
 
 int encfs_write(const char *path, const char *buf, size_t size, off_t offset,
                 struct fuse_file_info *file) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withFileNode("write", path, file,
                       bind(_do_write, _1, (unsigned char *)buf, size, offset));
 }
@@ -666,7 +668,7 @@ int encfs_statfs(const char *path, struct statvfs *st) {
   int res = -EIO;
   try {
     (void)path;  // path should always be '/' for now..
-    rAssert(st != NULL);
+    rAssert(st != nullptr);
     string cyName = ctx->rootCipherDir;
 
     VLOG(1) << "doing statfs of " << cyName;
@@ -704,7 +706,7 @@ int _do_setxattr(EncFS_Context *, const string &cyName, const char *name,
 }
 int encfs_setxattr(const char *path, const char *name, const char *value,
                    size_t size, int flags) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
   return withCipherPath("setxattr", path,
                         bind(_do_setxattr, _1, _2, name, value, size, flags));
 }
@@ -762,7 +764,7 @@ int _do_removexattr(EncFS_Context *, const string &cyName, const char *name) {
 }
 
 int encfs_removexattr(const char *path, const char *name) {
-  if (isReadOnly(NULL)) return -EROFS;
+  if (isReadOnly(nullptr)) return -EROFS;
 
   return withCipherPath("removexattr", path,
                         bind(_do_removexattr, _1, _2, name));
diff --git a/encfs/main.cpp b/encfs/main.cpp
index 93b6a50..3b10884 100644
--- a/encfs/main.cpp
+++ b/encfs/main.cpp
@@ -161,7 +161,8 @@ static void FuseUsage() {
 
   int argc = 2;
   const char *argv[] = {"...", "-h"};
-  fuse_main(argc, const_cast<char **>(argv), (fuse_operations *)NULL, NULL);
+  fuse_main(argc, const_cast<char **>(argv), (fuse_operations *)nullptr,
+            nullptr);
 }
 
 #define PUSHARG(ARG)                        \
@@ -202,35 +203,35 @@ static bool processArgs(int argc, char *argv[],
 
   // leave a space for mount point, as FUSE expects the mount point before
   // any flags
-  out->fuseArgv[1] = NULL;
+  out->fuseArgv[1] = nullptr;
   ++out->fuseArgc;
 
   // TODO: can flags be internationalized?
   static struct option long_options[] = {
-      {"fuse-debug", 0, 0, 'd'},   // Fuse debug mode
-      {"forcedecode", 0, 0, 'D'},  // force decode
+      {"fuse-debug", 0, nullptr, 'd'},   // Fuse debug mode
+      {"forcedecode", 0, nullptr, 'D'},  // force decode
       // {"foreground", 0, 0, 'f'}, // foreground mode (no daemon)
-      {"fuse-help", 0, 0, 'H'},         // fuse_mount usage
-      {"idle", 1, 0, 'i'},              // idle timeout
-      {"anykey", 0, 0, 'k'},            // skip key checks
-      {"no-default-flags", 0, 0, 'N'},  // don't use default fuse flags
-      {"ondemand", 0, 0, 'm'},          // mount on-demand
-      {"delaymount", 0, 0, 'M'},        // delay initial mount until use
-      {"public", 0, 0, 'P'},            // public mode
-      {"extpass", 1, 0, 'p'},           // external password program
+      {"fuse-help", 0, nullptr, 'H'},         // fuse_mount usage
+      {"idle", 1, nullptr, 'i'},              // idle timeout
+      {"anykey", 0, nullptr, 'k'},            // skip key checks
+      {"no-default-flags", 0, nullptr, 'N'},  // don't use default fuse flags
+      {"ondemand", 0, nullptr, 'm'},          // mount on-demand
+      {"delaymount", 0, nullptr, 'M'},        // delay initial mount until use
+      {"public", 0, nullptr, 'P'},            // public mode
+      {"extpass", 1, nullptr, 'p'},           // external password program
       // {"single-thread", 0, 0, 's'},  // single-threaded mode
-      {"stdinpass", 0, 0, 'S'},  // read password from stdin
-      {"syslogtag", 1, 0, 't'},         // syslog tag
-      {"annotate", 0, 0,
-       LONG_OPT_ANNOTATE},                  // Print annotation lines to stderr
-      {"nocache", 0, 0, LONG_OPT_NOCACHE},  // disable caching
-      {"verbose", 0, 0, 'v'},               // verbose mode
-      {"version", 0, 0, 'V'},               // version
-      {"reverse", 0, 0, 'r'},               // reverse encryption
-      {"standard", 0, 0, '1'},              // standard configuration
-      {"paranoia", 0, 0, '2'},              // standard configuration
-      {"require-macs", 0, 0, LONG_OPT_REQUIRE_MAC},  // require MACs
-      {0, 0, 0, 0}};
+      {"stdinpass", 0, nullptr, 'S'},  // read password from stdin
+      {"syslogtag", 1, nullptr, 't'},  // syslog tag
+      {"annotate", 0, nullptr,
+       LONG_OPT_ANNOTATE},  // Print annotation lines to stderr
+      {"nocache", 0, nullptr, LONG_OPT_NOCACHE},  // disable caching
+      {"verbose", 0, nullptr, 'v'},               // verbose mode
+      {"version", 0, nullptr, 'V'},               // version
+      {"reverse", 0, nullptr, 'r'},               // reverse encryption
+      {"standard", 0, nullptr, '1'},              // standard configuration
+      {"paranoia", 0, nullptr, '2'},              // standard configuration
+      {"require-macs", 0, nullptr, LONG_OPT_REQUIRE_MAC},  // require MACs
+      {nullptr, 0, nullptr, 0}};
 
   while (1) {
     int option_index = 0;
@@ -283,7 +284,7 @@ static bool processArgs(int argc, char *argv[],
         PUSHARG("-d");
         break;
       case 'i':
-        out->idleTimeout = strtol(optarg, (char **)NULL, 10);
+        out->idleTimeout = strtol(optarg, (char **)nullptr, 10);
         out->opts->idleTracking = true;
         break;
       case 'k':
@@ -358,7 +359,7 @@ static bool processArgs(int argc, char *argv[],
 #if defined(HAVE_XATTR)
         // "--verbose" has to be passed before "--version" for this to work.
         if (out->isVerbose) {
-            cerr << "Compiled with : HAVE_XATTR" << endl;
+          cerr << "Compiled with : HAVE_XATTR" << endl;
         }
 #endif
         exit(EXIT_SUCCESS);
@@ -503,7 +504,8 @@ void *encfs_init(fuse_conn_info *conn) {
     VLOG(1) << "starting idle monitoring thread";
     ctx->running = true;
 
-    int res = pthread_create(&ctx->monitorThread, 0, idleMonitor, (void *)ctx);
+    int res =
+        pthread_create(&ctx->monitorThread, nullptr, idleMonitor, (void *)ctx);
     if (res != 0) {
       RLOG(ERROR) << "error starting idle monitor thread, "
                      "res = "
@@ -533,7 +535,7 @@ int main(int argc, char *argv[]) {
   // we've processed it and only allowed through what we support.
   std::shared_ptr<EncFS_Args> encfsArgs(new EncFS_Args);
   for (int i = 0; i < MaxFuseArgs; ++i)
-    encfsArgs->fuseArgv[i] = NULL;  // libfuse expects null args..
+    encfsArgs->fuseArgv[i] = nullptr;  // libfuse expects null args..
 
   if (argc == 1 || !processArgs(argc, argv, encfsArgs)) {
     usage(argv[0]);
@@ -681,7 +683,7 @@ int main(int argc, char *argv[]) {
       pthread_cond_signal(&ctx->wakeupCond);
       pthread_mutex_unlock(&ctx->wakeupMutex);
       VLOG(1) << "joining with idle monitoring thread";
-      pthread_join(ctx->monitorThread, 0);
+      pthread_join(ctx->monitorThread, nullptr);
       VLOG(1) << "join done";
     }
   }
@@ -715,7 +717,8 @@ static void *idleMonitor(void *_arg) {
 
   bool unmountres = false;
 
-  // We will notify when FS will be unmounted, so notify that it has just been mounted
+  // We will notify when FS will be unmounted, so notify that it has just been
+  // mounted
   RLOG(INFO) << "Filesystem mounted: " << arg->opts->mountPoint;
 
   pthread_mutex_lock(&ctx->wakeupMutex);
@@ -751,7 +754,7 @@ static void *idleMonitor(void *_arg) {
             << timeoutCycles;
 
     struct timeval currentTime;
-    gettimeofday(&currentTime, 0);
+    gettimeofday(&currentTime, nullptr);
     struct timespec wakeupTime;
     wakeupTime.tv_sec = currentTime.tv_sec + ActivityCheckInterval;
     wakeupTime.tv_nsec = currentTime.tv_usec * 1000;
@@ -760,13 +763,14 @@ static void *idleMonitor(void *_arg) {
 
   pthread_mutex_unlock(&ctx->wakeupMutex);
 
-  // If we are here FS has been unmounted, so if we did not unmount ourselves (manual, kill...), notify
+  // If we are here FS has been unmounted, so if we did not unmount ourselves
+  // (manual, kill...), notify
   if (!unmountres)
     RLOG(INFO) << "Filesystem unmounted: " << arg->opts->mountPoint;
 
   VLOG(1) << "Idle monitoring thread exiting";
 
-  return 0;
+  return nullptr;
 }
 
 static bool unmountFS(EncFS_Context *ctx) {
@@ -778,9 +782,9 @@ static bool unmountFS(EncFS_Context *ctx) {
     ctx->setRoot(std::shared_ptr<DirNode>());
     return false;
   } else {
-    // Time to unmount!
+// Time to unmount!
 #if FUSE_USE_VERSION < 30
-    fuse_unmount(arg->opts->mountPoint.c_str(), NULL);
+    fuse_unmount(arg->opts->mountPoint.c_str(), nullptr);
 #else
     fuse_unmount(fuse_get_context()->fuse);
 #endif
diff --git a/encfs/openssl.cpp b/encfs/openssl.cpp
index 801a105..d859f1c 100644
--- a/encfs/openssl.cpp
+++ b/encfs/openssl.cpp
@@ -37,7 +37,7 @@ namespace encfs {
 
 unsigned long pthreads_thread_id() { return (unsigned long)pthread_self(); }
 
-static pthread_mutex_t *crypto_locks = NULL;
+static pthread_mutex_t *crypto_locks = nullptr;
 void pthreads_locking_callback(int mode, int n, const char *caller_file,
                                int caller_line) {
   (void)caller_file;
@@ -47,7 +47,7 @@ void pthreads_locking_callback(int mode, int n, const char *caller_file,
     VLOG(1) << "Allocating " << CRYPTO_num_locks() << " locks for OpenSSL";
     crypto_locks = new pthread_mutex_t[CRYPTO_num_locks()];
     for (int i = 0; i < CRYPTO_num_locks(); ++i)
-      pthread_mutex_init(crypto_locks + i, 0);
+      pthread_mutex_init(crypto_locks + i, nullptr);
   }
 
   if (mode & CRYPTO_LOCK) {
@@ -62,7 +62,7 @@ void pthreads_locking_cleanup() {
     for (int i = 0; i < CRYPTO_num_locks(); ++i)
       pthread_mutex_destroy(crypto_locks + i);
     delete[] crypto_locks;
-    crypto_locks = NULL;
+    crypto_locks = nullptr;
   }
 }
 
diff --git a/encfs/readpassphrase.cpp b/encfs/readpassphrase.cpp
index daf4a56..a439e67 100644
--- a/encfs/readpassphrase.cpp
+++ b/encfs/readpassphrase.cpp
@@ -76,7 +76,7 @@ char *readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags) {
   /* I suppose we could alloc on demand in this case (XXX). */
   if (bufsiz == 0) {
     errno = EINVAL;
-    return (NULL);
+    return (nullptr);
   }
 
 restart:
@@ -87,7 +87,7 @@ restart:
   if ((input = output = open(_PATH_TTY, O_RDWR)) == -1) {
     if (flags & RPP_REQUIRE_TTY) {
       errno = ENOTTY;
-      return (NULL);
+      return (nullptr);
     }
     input = STDIN_FILENO;
     output = STDERR_FILENO;
@@ -142,13 +142,13 @@ restart:
   /* Restore old terminal settings and signals. */
   if (memcmp(&term, &oterm, sizeof(term)) != 0)
     (void)tcsetattr(input, _T_FLUSH, &oterm);
-  (void)sigaction(SIGINT, &saveint, NULL);
-  (void)sigaction(SIGHUP, &savehup, NULL);
-  (void)sigaction(SIGQUIT, &savequit, NULL);
-  (void)sigaction(SIGTERM, &saveterm, NULL);
-  (void)sigaction(SIGTSTP, &savetstp, NULL);
-  (void)sigaction(SIGTTIN, &savettin, NULL);
-  (void)sigaction(SIGTTOU, &savettou, NULL);
+  (void)sigaction(SIGINT, &saveint, nullptr);
+  (void)sigaction(SIGHUP, &savehup, nullptr);
+  (void)sigaction(SIGQUIT, &savequit, nullptr);
+  (void)sigaction(SIGTERM, &saveterm, nullptr);
+  (void)sigaction(SIGTSTP, &savetstp, nullptr);
+  (void)sigaction(SIGTTIN, &savettin, nullptr);
+  (void)sigaction(SIGTTOU, &savettou, nullptr);
   if (input != STDIN_FILENO) (void)close(input);
 
   /*
@@ -167,7 +167,7 @@ restart:
   }
 
   errno = save_errno;
-  return (nr == -1 ? NULL : buf);
+  return (nr == -1 ? nullptr : buf);
 }
 #endif /* HAVE_READPASSPHRASE */
 
diff --git a/encfs/test.cpp b/encfs/test.cpp
index e850db3..dff8bbf 100644
--- a/encfs/test.cpp
+++ b/encfs/test.cpp
@@ -173,11 +173,12 @@ bool runTests(const std::shared_ptr<Cipher> &cipher, bool verbose) {
     cfg.assignKeyData(keyBuf, encodedKeySize);
 
     // save config
-    //Creation of a temporary file should be more platform independent. On c++17 we could use std::filesystem.
+    // Creation of a temporary file should be more platform independent. On
+    // c++17 we could use std::filesystem.
     string name = "/tmp/encfstestXXXXXX";
     int tmpFd = mkstemp(&name[0]);
     rAssert(-1 != tmpFd);
-    //mkstemp opens the temporary file, but we only need its name -> close it
+    // mkstemp opens the temporary file, but we only need its name -> close it
     rAssert(0 == close(tmpFd));
     {
       auto ok = writeV6Config(name.c_str(), &cfg);
@@ -190,9 +191,9 @@ bool runTests(const std::shared_ptr<Cipher> &cipher, bool verbose) {
       auto ok = readV6Config(name.c_str(), &cfg2, nullptr);
       rAssert(ok == true);
     }
-    //delete the temporary file where we stored the config
+    // delete the temporary file where we stored the config
     rAssert(0 == unlink(name.c_str()));
-    
+
     // check..
     rAssert(cfg.cipherIface.implements(cfg2.cipherIface));
     rAssert(cfg.keySize == cfg2.keySize);