How it works
Four parties: you, in your browser; the recipient, in theirs; the server, which stores ciphertext; and this site, which serves pages and code and receives nothing. Here is what each holds at every step.
Sending a file as a transfer
| Step | Where it happens | You hold | The server holds |
|---|---|---|---|
| 1. You drop a file | your browser | the file | nothing |
| 2. The name is wrapped in front of the file in an envelope | your browser | file and name, as one buffer | nothing |
| 3. A fresh AES-256-GCM key is made and the buffer is encrypted | your browser | the key, the ciphertext | nothing |
| 4. The ciphertext is uploaded: create, upload, complete | your browser to the server | the key | the ciphertext, its size, the time, a hashed IP, a content type hint |
5. The link is built with the key after #, and drawn as a QR code | your browser | the link | nothing: browsers never send the fragment |
| 6. You hand the link over, by any channel | you to the recipient | the link, in your keys | the ciphertext |
| 7. The recipient opens it: download, decrypt, unwrap | their browser | the ciphertext, and a download count |
The server could not read the file at any step, and never learned its name. Security: what the server sees is the full list.
Sending into a vault instead
Steps 1 to 3 are the same, per file. Instead of one transfer, the files are committed into a vault: each file becomes an encrypted object, the folder listing is itself encrypted entry by entry, a commit points at the tree, and the whole thing is published with a compare-and-swap so that two devices never overwrite each other. The link carries the read key, derived one way from the vault key: it opens every file and every version, and can change nothing. The vault key stays in your keys. Vaults and keys has the rest.
Three ways to hand over
| Form | Carries | Good for |
|---|---|---|
| A link with the key | #id/key, a 43-character random key | a link in a message; a QR code on a screen |
| A friendly token | river-cloud-3847: the id and the key both derive from it | saying it aloud, typing it on a phone, a smaller QR code; links that expire |
| A link and a key, separately | #id by one channel, the key by another | when one channel alone should not be enough |
QR codes and friendly tokens explains the trade each makes.
What runs where
The pages are this site's. The code they run is api.send.sgit.ai v0.1.1, pinned by address, with a manifest of every file's hash copied into this repository and checked by the gate. The server is whichever SG/Send host you choose in Settings: the hosted one at send.sgraph.ai, your own, or one in memory on your laptop.