The key rides in the fragment
The decryption key lives in the part of the URL after the #: which browsers never send to a server. We literally can't receive it.
Encrypted sharing
Share a file
not the keys to everything
Each link carries its own key in the URL fragment, which a browser never sends. The server only ever holds ciphertext.
Share link
End-to-endhttps://zcrypt.cloud/s/3kQ9pX2v#key=8f4a…d20e
/s/3kQ9pX2vsent to the server
#key=…stays in the browser
Password
On
Expires
7 days
Downloads
5 left
Revoke
Anytime
You decide who, how long, how many
Sharing without surrendering control. Set the terms on every link, and pull it back the moment you want to.
Optional password
Add a password on top of the link. Even someone holding the URL needs the secret you share separately to open it.
Expiry dates
Set a link to stop working after a date or duration. When it lapses, the door closes on its own, no cleanup required.
Download limits
Cap how many times a link can be used. Once the count is spent, the link is dead even if someone still has it.
Revoke anytime
Change your mind? Kill a link instantly from your vault. The ciphertext stays, but no one can open it again.
No account for recipients
Whoever you send it to just opens the link. The file is decrypted in their browser, never on our servers, never in the clear on the wire.
The secret in the #
Why we can't read your shares
A URL fragment (everything after the #) is processed only by the browser and is never included in the request sent to a server. We put the decryption key there on purpose. The server hands over encrypted bytes; the recipient's browser uses the key from the fragment to decrypt them locally. The plaintext never exists on our side.
- Decryption key lives only in the URL fragment
- Fragments are never transmitted to the server
- Recipients decrypt in-browser, with no account
- Optional password adds a second, separate secret
// what the server sees on open
GET /s/3kQ9pX2v
returns ciphertext blob, sealed
#key=… not in request
decrypt happens in: the browser
✓ no key on the wire. no plaintext on the server.
More ways to send
Sharing a vault file is one path. For the throwaway and the one-time, there are two more.
Anonymous Send
Drop a file without an account and get a single link to pass along. It's built to burn after reading, once it's been picked up, it's gone. Good for the thing you want to hand off and forget.
Encrypted Pad
Write a one-time note, encrypt it, and share the link. The recipient reads it once, then it's burned. For a password, an address, a short message that shouldn't linger in anyone's inbox.
Get started today
Share like the server isn't watching
Free and open source. Hand someone a file without handing it to us.