End-to-end encrypted file transfer
Files are encrypted before upload. A password or the link holds the key, and the files are deleted when the link expires.
- A password encrypts the files before upload
- The password is not in the email
- A link without a password keeps the key in the link
- The server cannot read those files
- Turning encryption off still leaves transit and rest encryption
Where the key lives
A password encrypts the files before they leave the browser. It is not in the email. A link without a password keeps the key in the link. We cannot read those files.
Share the password on a separate channel: another message, a call, or in person. Anyone who has both the link and the password can download, so the password is doing its job only if the link and the password travel separately. Keep your own copy. The email cannot be used to look the password up later. The server stores a salted hash for the check, and a wrapped key it cannot unwrap.
What the server still sees
An encrypted transfer hides file names and contents from the server. The upload scan checks the file name and the first few kilobytes before encryption. It cannot detect every kind of malware or every pirated file. That scan is not a promise that every dangerous file is caught. The service is not yet certified.
Files travel over HTTPS. Turning encryption off leaves them encrypted in transit and at rest. That is a different statement from the password path. Transit and rest encryption does not mean the operator cannot read the file. The password path, and the link-fragment path, are the ones where we cannot read those files.
What this page does not say
It does not say the service is certified. An independent operator based in India runs it, and it is not yet certified. It does not say you can pick an EU storage region. It does not say team checkout is open. Studio and Business are Contact sales. Free is still 6 GB for up to 7 days, with no account. Creator, Pro, and a Pass raise the size after payment is confirmed. Encryption does not raise the size cap.
A raw API upload is not encrypted unless you use the JavaScript client, which encrypts by default, or you send ciphertext yourself. The developer page is the reference for that split. The send form in the browser follows the password and link rules on this page. Report a security issue to [email protected]. The disclosure file is published at /.well-known/security.txt. Encryption does not extend the expiry you set, and it does not raise the 6 GB free cap. A longer link still needs Creator or Pro.
Two ways a cloud transfer is protected
| Password or link key | Encryption turned off | |
|---|---|---|
| When it happens | Before the file leaves the browser | On the connection and in storage |
| Can we read the file? | No | Transit and rest encryption is not the same claim |
| Password in the email | No | No password on that path |
| Size cap | Unchanged | Unchanged |
Questions
Does a password encrypt the file?
Yes. A password encrypts the files before they leave the browser. It is not in the email.
What if I do not set a password?
A link without a password keeps the key in the link. We cannot read those files.
Is the service certified?
No. It is not yet certified.
Does encryption make a 6 GB file larger than the cap?
No. Free is still 6 GB. Encryption does not raise the plan limit.