Share a file without creating an account

Email attachments and chat uploads can remain in inboxes, archives, notifications, and backups long after a handoff is complete. SecretShare is designed for temporary delivery instead. Choose the File tab, select one file up to 150 MB, set an expiration, optionally add a passphrase, and create the encrypted link.

The file is read and encrypted as a single payload in the browser. Its original name, media type, and contents are encrypted together with AES-GCM. Only ciphertext, an initialization vector, a salt, and expiration metadata are uploaded. The binary ciphertext is uploaded without base64 expansion. This is intended for temporary handoffs—not collaboration, backups, or permanent document storage.

How the encrypted file link works

  1. Your browser creates the key. A 256-bit key is generated locally. If you provide a passphrase, it is used as additional key material and the recipient must enter the same value.
  2. The file is encrypted locally. SecretShare encrypts the file bytes and metadata before making the upload request.
  3. The link separates storage from the key. The record identifier is placed in the path while the decryption key is placed after #. Browsers do not include URL fragments in normal HTTP requests.
  4. The recipient confirms retrieval. Opening the landing page checks whether the record is available. Selecting “Open and destroy” consumes it, preventing a chat preview bot from burning the link.
  5. The browser decrypts the download. After retrieving the ciphertext, the recipient's browser decrypts it and creates a local download.

Important limit: SecretShare accepts one text secret or one file per link, and files are limited to 150 MB. For larger files, use a purpose-built encrypted transfer service or an approved organizational storage system.

Good uses for one-time encrypted file sharing

  • Sharing a Word document (.doc or .docx) or Excel spreadsheet (.xls or .xlsx) through a one-time download.
  • Delivering a temporary .env file to a contractor before rotating its values.
  • Passing a bootstrap SSH key during a controlled onboarding process.
  • Sending a small certificate bundle, recovery-code export, or private configuration file.
  • Moving sensitive information outside a long-lived ticket or chat history.

A one-time link reduces persistence, but it does not control what the recipient does after download. Scope credentials narrowly, verify the recipient through a trusted channel, rotate temporary access, and prefer workload identity or a managed vault when systems need repeated access.

Threat model and practical safeguards

Client-side encryption protects the stored payload from being readable with the server's stored record alone. It does not remove every risk: anyone with the complete URL can attempt retrieval, a compromised endpoint can expose content, and users must trust the JavaScript served by the site. An optional passphrase reduces reliance on the link alone when the passphrase is delivered separately.

Use the shortest practical expiration. SecretShare offers one-hour, 24-hour, and seven-day time limits, plus one-open behavior. If the link is sent to the wrong person or appears in a public place, treat the underlying credential as exposed and rotate it rather than relying only on deletion.

Encrypted file sharing FAQ

What is the maximum file size?

150 MB. The browser reads and encrypts the whole file, so large transfers require enough device memory and may take longer on mobile or slower connections.

Can I upload Word and Excel files?

Yes. SecretShare accepts Word files such as .doc and .docx, Excel files such as .xls and .xlsx, and other file types up to 150 MB. It preserves the filename and media type inside the encrypted payload.

Does SecretShare store the filename?

The filename and media type are inside the encrypted payload. The server stores the encrypted record and operational metadata needed for expiry and one-time retrieval.

Can a link-preview bot download the file?

A normal page request can inspect availability but cannot consume the payload. Retrieval requires the explicit confirmation action.

Should I send the passphrase with the link?

No. When you use the optional passphrase, send it through a separate channel so possession of one message is not sufficient.

Encrypt a file up to 150 MB and create its one-time link.

Send a file