Features & use cases
End-to-end encrypted file transfer with a time to live (TTL) on every link, or permanent storage on Orbit. Your browser encrypts, the server stores ciphertext, the clock runs down.
This page is available in English only.
Use cases
Developers
API keys, .env files, DB credentials. Ship them through a burn-after-reading link; the secret never hits Slack message history, email archives, or data-export bundles. Read the pattern →
Lawyers
Privileged documents to counsel or clients without a third-party cloud keeping a readable copy. Link expires; the document doesn’t sit in someone’s Dropbox waiting for a subpoena. How to do it →
Banking & finance
Wire instructions, KYC packs, and account statements sent between institutions through an encrypted link that expires, instead of an attachment that sits in a mailbox for years.
Healthcare
Lab results, imaging, referral forms. A time-limited link between practices or to a patient, instead of unencrypted email or fax.
Journalists
Source documents delivered end-to-end encrypted, with an expiry you set. Nothing for the source to install or sign up for.
Designers & agencies
Ship PSDs, Figma exports, or raw video cuts to a client through a link that expires on its own, instead of a shared folder that keeps every draft for years.
IT & onboarding
Hand off credentials and config to a new hire or contractor. Burn-after-reading link: the file is used up the moment it is fetched and deleted right after, so no copy lingers in a chat thread or mailbox. The 30-second handoff →
What you get
End-to-end encryption
XChaCha20-Poly1305 over 64 KiB chunks. Argon2id key derivation: 3 passes, 64 MiB memory, 256-bit output. The browser does all the crypto before the first byte reaches the server. Read the internals →
Zero-knowledge server
The server stores the ciphertext (with its salt and nonce) and a small record: the link, size and times, the file’s settings, download counts, hashes of the keys that open or manage it, and an abuse log with your IP as a keyed hash and as an encrypted value we can decrypt for abuse investigation, the user agent, language list and source port, and the country, city and network the IP belonged to at the time. No filename, no key, and the password you set never reaches the server. The privacy policy names the two exceptions: a file sent through a file request carries its password sealed for the requester’s browser, and someone who reports a link may add its password to the report. Without the password, that ciphertext and that record cannot be turned back into the file.
Self-destructing links
TTL from 5 minutes to 7 days on the free tier, up to 30 days or permanent on Orbit. When the clock expires the file is deleted from storage; there is no trash can and no restore path.
Burn after reading
Single-download mode. Opening the page, a chat or mail link preview, or a wrong password do not count. The link is spent the moment the first encrypted byte leaves the server for a request that carries the right password: after that no one can fetch it. If that first transfer breaks, only it can pick up where it stopped, for a few minutes; then the file is deleted. What counts as a read →
Encrypted notes
For a password, an API key or a few lines of text, switch the upload box to Note. The text is encrypted in your browser like a file, and the recipient reads it on the page after entering the password instead of downloading anything. Notes are one-time by default: the server deletes the note the moment it is opened.
Several files, folders and QR codes
Pick or drop several files, or a whole folder, and the browser packs them into one .zip before encrypting it, so the recipient gets one link and one download. After the upload, the link can be shown as a QR code for a phone camera; it is drawn in the browser, and it can carry the password in the part of the URL that is never sent to a server, which makes sending a file to your own phone one scan.
No account for the basics
Free tier: 2 GB per file, 10 uploads/day, 10 GB/day per IP, 7-day max TTL. No signup, no email, no cookie banner. Orbit: 10 GB per file, TTL up to 30 days or permanent, 500 GB storage (up to 2.5 TB with add-ons), early delete and file listing from the dashboard or the CLI, file request links through which others send you files only you can open, and optional email notices. Permanent files are kept as long as your subscription is active.
Command line
A single ttl binary: ttl send encrypts and uploads in one command. Fits in shell pipelines and CI jobs. CLI docs →
How it works
-
Step 1
Encrypt locally
The browser derives a key from your password with Argon2id, then encrypts the file in 64 KiB chunks and uploads ciphertext. Nothing readable leaves the device.
-
Step 2
Share the link
You get a link. Anyone with the link and the password can download until the TTL expires, or, in burn mode, once. The password is not part of the link: send it through a different channel, and keep it, because a lost password cannot be recovered by anyone, including us. On Orbit you can also lock a file so only your own API key can download it.
-
Step 3
Delete
TTL expiry or the first burn download, whichever comes first, unless you delete it sooner: My uploads deletes it early from the browser that uploaded it (or any device you open its status link on), and Orbit can also delete from the dashboard or the CLI. The encrypted object is deleted from storage and its metadata record is removed in a later sweep.
Ready to try it?
Drop a file on the home page. No account, no email, nothing to install.