Locked before it leaves your browser
Your file, and even its name, is sealed on your own machine before anything is sent. What we store is a sealed box, and we hold nothing that opens it.
Private file storage
Files that only open for the right people.
Your files are locked in this browser before they upload, so the server keeps sealed boxes it has no way to open. And every file carries a level, so people see what they're cleared for and nothing else.
Encrypted in your browser
No filenames on the server
Free and open source
Free to use, open to read, and yours to run on your own server
Free forever
No ads
No trackers
Open source
Yours to host
Features
What it does for you.
In everyday terms. The parts that deserve a longer explanation are further down, including the ones that are not to our advantage.
Every file has a level
Files are filed by sensitivity, from everyday to restricted. You choose the level you're working at, and you see what that level reaches — no more.
Seniority isn't the same as need-to-know
Being cleared to the highest level does not quietly open a project you were never brought into. Both have to line up before a file opens.
What you can't see, you can't tell is there
A file above your level doesn't appear greyed out, and nothing says "access denied". It looks exactly like a file that was never there — because the alternative tells you something.
Share a link that still checks who you are
Send someone a link and it only opens for people cleared for that file. Forward it to anyone else and they get nothing — not a login prompt, nothing. The link is half the key; being cleared is the other half.
One recovery code, kept by you
You get a code when you sign up. Write it down: it is the only way back in if the passphrase goes, and it is shown exactly once because we never keep it.
Run it on your own hardware
Two containers and a config file. No account with us, nothing that phones home, and the whole thing is open to read before you trust it.
How it works
1
2
3
Three things to know.
There is no setup wizard and nothing to configure. The whole model is these three ideas.
Your passphrase makes the keys
Keys are built on your device from a passphrase that is never sent anywhere. You also get a one-time recovery code, because a passphrase alone would make a bad day permanent.
You choose the level you're working at
Before you do anything, you say which level you're at. Everything you create is filed there, and the list only shows what that level reaches.
Files are sealed here, filed there
Uploading seals the file in your browser first. Downloading unseals it in your browser too. In between, the server is holding something it cannot read.
Straight answers
Where the limits are.
Every system like this has edges. Here are ours, in the same size type as everything else on this page.
A web page is only as trustworthy as the server that sent it
This page's code arrives from the same host that stores your files, so a host that had been compromised could send code that quietly copies your keys. That is true of every website that encrypts in the browser. A signed app you install once is what removes the assumption, and we don't have one yet.
What we can and cannot promiseWe can see the shape of your files, not what's in them
To hand you the right file, the server has to know how many there are, how big, when they changed, and what level each one carries. It cannot read a filename or a byte of content. Both of those things are true at once.
Exactly what's storedLose both secrets and the files are gone
There is no reset link and no back door, which is the same property that keeps us out. If the passphrase and the recovery code are both lost, nobody — including us — can open your files again.
How recovery worksNo outside security audit has happened yet. The code is open and tested and the design is published, but a paid review by a security firm is a different kind of assurance, and one we would like to fund.
Self-hosting
Your server, your rules.
Postgres and one application container. Nothing reaches out to us, and there is no account with us to make.
# fill in three secrets, then:
docker compose up --build
# the app refuses to start if its database
# role could bypass the level checks
docker compose up --build
# the app refuses to start if its database
# role could bypass the level checks