Send files only they can open

Yes. Your browser generates a random 256-bit key, encrypts every file with AES-256-GCM in 5 MB chunks, and uploads only the ciphertext. The decryption key is embedded in the link fragment and never transmitted to the server. We have zero ability to read your files.

No. The encryption key exists only in the URL you share. URL fragments (everything after the #) are never sent to the server by any browser — this is a guarantee of the HTTP specification, not a StenVault promise. Without the key, the server holds meaningless bytes.

The link contains the decryption key. Anyone with the full link can decrypt the files — treat it like a password. For extra protection, you can set a password on the transfer. The recipient then needs both the link and the password to decrypt.

You choose the expiry when you create the transfer — from 1 hour to 30 days. After expiry, the encrypted data is permanently deleted from our servers. There is no recovery once a transfer expires.

No. Sending and receiving work without an account. Anonymous transfers support files up to 5 GB. With a free StenVault account you can send up to 10 GB, set custom expiry, and track your transfer history.

Yes. Send is free for everyone, including anonymous users. No credit card, no trial, no ads. StenVault is funded by optional paid plans for the full vault product — Send exists to let anyone experience zero-knowledge encryption firsthand.

WeTransfer encrypts files in transit (TLS) but stores them unencrypted on their servers. WeTransfer can read your files, comply with data requests, or be breached. StenVault Send encrypts files on your device before upload and never holds the decryption key — even under compulsion, we cannot produce your plaintext.

Send uses AES-256-GCM, a symmetric cipher that NIST and the NSA's CNSA 2.0 suite consider adequate for a post-quantum world. Grover's algorithm — the strongest known quantum attack on symmetric ciphers — would reduce AES-256 to roughly AES-128 equivalent strength, which remains well above security thresholds. Send does not use asymmetric post-quantum cryptography because there is no key exchange to protect — the key travels inside the link, never over the network. StenVault Drive — the main vault — goes further with hybrid post-quantum key exchange (ML-KEM-768 + X25519) and signatures (ML-DSA-65 + Ed25519) for long-term file storage.