Skip to content
Skip to content

Zero-knowledge encryption

We can't read your files.
That's the whole point

Encrypted on your device with AES-256-GCM. The key never leaves. We store ciphertext and nothing else, not even folder names.

Start freeRead the docs
Your device
Trusted zone
  • Passphrase entered here, stays here
  • Your key is derived locally
  • Files and their names are encrypted
  • Plaintext never leaves
Encryption boundary
Our servers
Ciphertext only
  • Encrypted blobs, that's it
  • No passphrase, no derived key
  • No plaintext file contents
  • No readable file or folder names

The guarantees

What we can and can't see

Not a privacy policy promise. A cryptographic one: enforced by where the keys live and what code runs where.

  • Encrypted on your device

    Compression and AES-256-GCM encryption happen in your browser, on your machine, before a single byte goes over the wire.

  • Your key never travels

    Your encryption key is derived from your passphrase on your own device and stays there. It is never sent to us.

  • A unique key per file

    Each file gets its own random content key, wrapped by your passphrase key. One file's key can never unlock another.

  • Even folder names are sealed

    File names and folder names are encrypted client-side too. The server can't read your files, their names, or how you organized them.

  • The server only sees ciphertext

    On our side there are no keys and no plaintext: only opaque encrypted blobs we couldn't open even if compelled to.

  • Tamper-evident by design

    AES-256-GCM authenticates every chunk. If ciphertext is altered in transit or at rest, decryption fails loudly instead of returning garbage.

Envelope encryption

How a file gets sealed

Every upload runs the same four steps, entirely on your device.

  1. 01

    Derive your key

    Your passphrase and a random salt are stretched into a strong key encryption key. This happens locally and the key never leaves your device.

  2. 02

    Seal each file with its own key

    A fresh random content key is generated per file and used to encrypt it. That content key is then wrapped (encrypted) with your passphrase-derived key.

  3. 03

    Encrypt folder names, then chunk

    Folder names are encrypted client-side too. The encrypted file is then split into chunks, each individually authenticated.

  4. 04

    Upload ciphertext only

    Only the wrapped key and the encrypted chunks ever leave your device. The server stores blobs it has no way to read.

// what actually lands on the server
wrapped_key 8e30dd·91ac0c·77ae3f·b8d40e, sealed under your passphrase
name 9f2a1c·b8d40e·7c5b13·f0e2a9, sealed
chunk[0] a4f9c1·0c77ae·3f5b2a·4f9c1e. AES-256-GCM
chunk[1] 4d1b6c·77ae3f·5b2a4f·9c1e0c. AES-256-GCM
✓ no passphrase. no derived key. no plaintext. no readable names.

The honest trade-off

Lose your passphrase and even we can't recover it

True zero-knowledge has a price, and we won't pretend otherwise. Because your key is derived from your passphrase and never reaches us, we have no “reset password and get your files back” button. If you lose your passphrase, your data stays encrypted forever: to you and to everyone else.

That is exactly the property that makes the rest of these promises real. A provider who can recover your files for you can also be compelled to hand them over. We can't do either.

Read the security model
  • Choose a strong passphrase you won't forget. It is the one key to everything.
  • Previews and downloads are decrypted in your browser, then discarded.
  • Sharing wraps a file's key for the recipient, without ever exposing your passphrase.
  • Password-protected folders add a second key, separate from your vault.

Related

Get started today

Encryption you don't have to trust us about

Free and open source. Bring a storage account you already own and encrypt your first file in under a minute.

Start free