Your file goes through no server
When you create a link, your browser connects to our matchmaking server. That server does one thing only: introduce your device to the recipient's. Then both browsers open a direct connection (WebRTC) and the file goes from one to the other.
We never receive the content of your files. We can't read it, keep it or pass it on. That's also why your page must stay open while sending.
End-to-end encrypted
The direct connection between both browsers is encrypted with DTLS, the same protocol your browser uses for video calls. Nobody on the network can read what goes through.
On the Pro and Max plans, you can add enhanced encryption: every piece of the file is encrypted a second time with AES-256-GCM, using a key only the two browsers know.
A key hidden in your link
Every link contains, after the “#”, a random 128-bit key. Browsers never send that part of the address to our server.
It's used to verify the pairing: each browser proves to the other that it knows the key by signing the fingerprints of the connection. If anyone tried to slip in between you, including us, the check would fail and the transfer would stop.
When the recipient uses the 6-digit code instead of the link, the connection is still encrypted, but this extra check isn't possible: the “Pairing verified” note isn't shown then.
Password checked between the two devices
A transfer password (Pro and Max) is never sent, neither to us nor to the recipient. It's transformed slowly and irreversibly (PBKDF2), then both browsers check that they get the same result. With enhanced encryption, it's also part of the encryption key: without it, the data stays unreadable.
After 5 wrong attempts, the transfer locks.
Every file is checked on arrival
The sender computes the SHA-256 fingerprint of each file while sending, and the recipient computes it again on arrival. If a single byte differs, the file is discarded and you're told.
What we keep
To run accounts and plans, we keep your email, your password in hashed form (Argon2id), your plan and, for each transfer: its date, the number of files, their total size and the number of recipients. With history (Pro and Max), the name of the first file is also kept so you can find your transfers.
Details are in our privacy policy.
Your account
You can turn on two-factor authentication with an app (Google Authenticator, 1Password, Authy…) and keep backup codes. Two-factor secrets are encrypted in our database. Sign-in attempts are rate-limited so nobody can guess a password or a code.
Found a vulnerability? Write to us: we answer every report.