Stash it quietly. Share it instantly.
Post-quantum encrypted file uploads. Self-hosted. Your server, your keys, your data.
Post-quantum encrypted file uploads. Self-hosted. Your server, your keys, your data.
Every file is encrypted with XChaCha20-Poly1305 using a unique per-file key. Keys are sealed with hybrid ML-KEM-1024 + P-384 ECDH post-quantum cryptography. No plaintext ever touches storage.
Hybrid ML-KEM-1024 + P-384 ECDH key encapsulation with SHAKE256 KDF. Algorithm-agile envelope versioning enables future cipher swaps without re-encrypting existing data.
Passwords hashed with Argon2id — memory-hard, GPU-resistant, the winner of the Password Hashing Competition. Passkey/WebAuthn login with no password at all.
Every login, upload, download, and admin action is logged. IPs hashed, emails vault-sealed, zero plaintext in audit records. Searchable, filterable, with configurable retention.
Your server, your data. No third-party cloud. Store on local disk, NAS mount, or S3-compatible bucket. Docker-ready.
Drag entire folder trees. Bad file types silently skipped. Concurrent uploads with retry. Recipients browse folders or download as ZIP.
Files are encrypted in your browser with ML-KEM-1024 + SHAKE256 + XChaCha20-Poly1305 before they ever leave your device. The server only stores ciphertext it cannot decrypt. Only your passkey can unlock your vault.
Create teams, assign roles, and isolate file access. Team admins manage their own members and uploads.
Protect shared bundles with a password. Argon2id-hashed, rate-limited unlock, and session-based access.
Manage users, files, bundles, and 40+ settings across 8 config tabs. Environment tab shows Docker config and runtime info. Export data as CSV. Download database backups.
Trigger webhooks on events like bundle finalization. API keys with scoped permissions. SSRF-safe URL validation.
Set bundles to auto-expire in 1, 7, 30, or 90 days. Or keep them forever. Expired files cleaned up automatically.
Send upload confirmations and admin alerts via SMTP or Resend API. Recipients notified when bundles are ready.
TOTP with authenticator apps. One-time backup codes. Replay-protected. Works alongside passkeys and passwords.
Large files split into 10MB chunks with concurrent transfer, per-file progress, pause, resume, and retry on failure.
Store on local disk, NAS, or any S3-compatible bucket. S3 direct mode with server-side encryption. Pre-signed downloads.
Both encrypted at rest. Vault uploads are end-to-end. Shareable links in seconds.
No login required. Files encrypted on arrival.
Passkey, password, Google, or 2FA. Full audit trail.
No config files. No build step. No npm install. All dependencies vendored. Settings live in the encrypted database. Configure everything from the admin panel.