Sending files is limited to invited accounts. To receive a file you don't need an account: just open the link you were sent.
With an account you get transfer tracking, larger files and your own storage space. You can also send without an account.
Account activation
Account: . Choose a password, then link an authenticator app (two-factor authentication is required).
Your file is encrypted in this browser before it leaves. The key travels in the link and never reaches our servers, and the file is erased after the last download.
Keep this tab open: encryption happens here, on your device.
Encrypted and verified. Only people with the link can open it.
The highlighted part is the decryption key. It is never sent to our servers: don't cut it off.
Track downloads and delete the transfer, even from another device. It contains the key: don't share it.
Someone sent you an encrypted file
Checking the link...
This is the last download allowed: the file will be erased from our servers right after.
Each block is verified before it is written to your disk. Keep this page open.
The download has started.
Decryption happens in your browser. The integrity of every block is checked before it is saved.
Erased transfers no longer count. File names are only known to this device: the server never sees them.
No transfers yet.
This page works without logging in, thanks to the management link. Keep it to yourself.
Usual file-sharing services can read what you upload: they hold the keys. Here encryption happens on your device with AES-256-GCM, and the key is kept in the part of the link that browsers never send. The server stores only encrypted blocks it cannot open, which is what you want for evidence, samples, reports or secrets.
Drop a file, pick an expiry and the number of downloads.
It is encrypted and uploaded in sealed 4 MB blocks.
Share the link; send the optional password another way.
No. Files are encrypted in your browser with AES-256-GCM before upload. The decryption key is part of the link fragment (after the #), which browsers never send to the server. The server only stores encrypted blocks and does not know the file name, its type or its content.
No. Opening the link is enough: the file is downloaded, decrypted and verified in your browser.
The sender chooses an expiry (from 1 hour to 7 days) and a number of allowed downloads. The encrypted data is erased as soon as the last download completes or the expiry passes, whichever comes first. The sender can also delete it at any time.
The password is combined with the key in the link (PBKDF2-SHA-512), so both are needed to decrypt. Share it through a different channel than the link. A wrong password is detected locally and does not use up a download.
Each 4 MB block is sealed and numbered. Any modification, reordering or truncation makes decryption fail, and the download stops before anything corrupted is saved.
Invited accounts, protected by a password and mandatory two-factor authentication (TOTP), can send files and follow or delete them from the 'My transfers' page. Sending without an account may also be open, with smaller limits.
