Encrypted file sharing for developers. Upload files, set a password, share a link — everything is encrypted in your browser before it touches a server. Zero-knowledge architecture. No recipient account needed. Or go premium for end-to-end encrypted direct transfers using public-key cryptography.
Share sensitive files without trusting the server.
SecretDrop encrypts everything in your browser before it ever reaches a server. Send API keys, credentials, configs, and documents through password-protected links or end-to-end encrypted direct transfers.
- Upload files and set a password
- Files are encrypted client-side with AES-256-GCM
- Share the link — recipients decrypt in-browser
- No account required for recipients
- Select recipients by email
- Files are encrypted with each recipient's public key (ECIES)
- Only intended recipients can decrypt — no passwords, no shared secrets
- Sender identity verified via digital signatures
- Zero-Knowledge Architecture — The server never sees your plaintext data, filenames, or passwords
- Client-Side Encryption — AES-256-GCM with PBKDF2 key derivation (600,000 iterations)
- No Recipient Account Needed — Password-protected links work for anyone
- Multi-File Bundles — Send multiple files in a single encrypted bundle
- Expiration Policies — Bundles auto-expire based on your settings
- Access Analytics — Track views, downloads, and access attempts
- Built on Web Standards — WebCrypto API, no third-party crypto libraries
| What the server stores | What the server cannot access |
|---|---|
| Encrypted file blobs | Plaintext file contents |
| Encrypted filenames | Original filenames |
| Verification hash + salt | Your password |
| Metadata (title, timestamps) | The encryption key |
Private keys for Direct Transfer are encrypted with your password before storage. They never leave your browser unencrypted.
- React 19, Vite, Tailwind CSS
- NestJS, Supabase (Postgres, Auth, Storage)
- WebCrypto API for all cryptographic operations
- Astro for the marketing site
| Free | Premium | |
|---|---|---|
| Password-protected bundles | 1 active | Unlimited |
| Bundle expiry | 7 days | Custom |
| E2E Direct Transfer | — | Included |
| Access analytics | Basic | Detailed |
| Multi-recipient transfers | — | Included |
- Website: secretdrop.dev
- FAQ: secretdrop.dev/faq
Built for developers who take security seriously.