The term is used loosely. Here is the concrete definition we hold ourselves to, and how each part is implemented.
“A definition you can check, not a label you have to trust.”
For technical buyers and careful users comparing end-to-end encryption claims across transfer products.
Argon2id derives your master key locally; it never reaches a server in usable form.
XChaCha20-Poly1305 gives confidentiality and tamper detection: modified ciphertext fails rather than opening.
X25519 seals the file key to each recipient, so decryption ability is granted individually.
For public links, the key sits in the URL fragment, which browsers do not transmit to servers.
Links expire within 24 hours at most, can cap views and can be revoked instantly.
Published subprocessors, storage regions, transparency reporting and an append-only audit trail.
First, key generation happens on endpoints. Second, the server never receives a key that decrypts content. Third, each recipient's access is granted by sealing a key to them specifically. Fourth, integrity is authenticated, so tampering is detected rather than silently accepted. A product missing any one of these is not end-to-end encrypted, whatever the landing page says.
Server-side encryption with customer-managed keys held by the provider; password-protected download pages in front of readable files; end-to-end encryption for the transfer but plaintext at rest afterwards; and encryption applied only to file contents while names, structure and previews stay readable.
Metadata such as timing, sizes and recipients; endpoints that are already compromised; and anything a legitimate recipient chooses to redistribute. Honest products enumerate these limits — ours are described in the public threat model.
No. The passphrase participates in deriving key material through Argon2id; it is not stored, and it is not an access check performed by a server on a readable file.
Because browsers never send the fragment to the server. The recipient's browser uses it locally to decrypt, so the operator never sees it.
No. Files are encrypted on your device with XChaCha20-Poly1305 before the upload starts, using keys derived locally with Argon2id. Our servers hold ciphertext only, so there is no preview, no scanning and no staff view of your transfer.
No. They open the link in any browser, type the passphrase you shared separately, and the file is decrypted locally on their machine. Nothing to install, nothing to sign up for.
Public share links always expire within 24 hours at most, and you can make them shorter, limit the number of views, or revoke them instantly. Expiry is enforced by the system, not by a reminder.
Uploads are chunked, resumable and verified after upload, so multi-gigabyte transfers survive a dropped connection, a closed laptop or a hotel network. You resume instead of starting again.
Yes. The free plan includes 1 GB with exactly the same zero-knowledge architecture as paid plans, so you can test a real client hand-off before paying anything.
Because we cannot read your data, we cannot reset it for you. Each account creates a Recovery Kit — a printable PDF with a QR code — to store offline. That is the same property that keeps anyone else, including us, out of your account.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
