E2E Share

How Your Files Stay Private

• True end-to-end encryption. Every file chunk is encrypted with AES-256-GCM inside your browser before it ever leaves your device. Only people who know the room password can decrypt it. The server only sees opaque, encrypted bytes — never your actual files.
• Password-based key derivation. Your password is used locally with PBKDF2 (310,000 iterations, SHA-256) to derive two keys: one for verifying peers via HMAC challenge-response and one (AES-KW) for wrapping the room's file encryption key. The password itself is never transmitted — not to the server, not to other peers.
• Zero-knowledge server. The server is a blind relay that forwards encrypted messages between peers. It never sees your password, file names, file contents, or encryption keys. Even if the server were compromised, your data remains unreadable without the password.
• Multi-peer rooms. Multiple people can join a room. The room host generates a random AES-256 file key and securely shares it with verified peers by wrapping it with the password-derived key. Everyone can share and download files from anyone else.
• On-demand streaming. Files are only transferred when someone clicks Download — nothing is stored on the server or cached anywhere. Data flows directly from sender to receiver (through the relay), encrypted the entire way.