Secure, zero-knowledge file transfer that keeps your data yours.
CipherDrop is a private file-sharing app built on a simple principle: the server should never be able to read what you send. Every file is encrypted inside your browser with AES-256-GCM before it's ever uploaded — so what lands in the cloud is nothing but unreadable ciphertext. No plaintext, no keys, no exceptions.
The magic is in the link. When you share a file, the decryption key is tucked into the URL's hash fragment (#) — the one part of a URL that browsers never transmit to the server. Only someone with the full link can unlock the file, and the service hosting it is mathematically incapable of peeking inside. Files are stored ephemerally and automatically shredded after a set expiry window, leaving no lingering trace.
- Zero-Knowledge Architecture: The server never sees your plaintext data or your decryption keys.
- Client-Side AES-256-GCM: High-performance cryptographic standards executed entirely within the browser's RAM.
- Key Fragment Logic: Decryption keys are passed through URL hash fragments, ensuring they are never sent to the server.
- Ephemeral Storage: Files are automatically shredded after a set expiry period.
- Frontend: React + Vite
- Database & Storage: Supabase (PostgreSQL / Storage Buckets)
- Cryptography: Web Crypto API (AES-GCM)
- Hosting: Vercel
- Key Generation: A random 256-bit AES key is generated locally.
- Encryption: The file is encrypted in chunks using the Web Crypto API.
- Transmission: Only the encrypted ciphertext is uploaded to Supabase.
- Distribution: The link is shared with the key in the URL hash (
#). Browsers do not transmit this fragment to the server.
- Clone the repository.
- Install dependencies:
npm install - Configure environment variables in
.env:VITE_SUPABASE_URLVITE_SUPABASE_ANON_KEY
- Start the development server:
npm run dev
This project is configured for Vercel. Ensure vercel.json is present for SPA routing and environment variables are set in the Vercel dashboard.