Share sensitive information securely with zero-knowledge AES-256 end-to-end encryption. Features include burn after reading, password protection, and customizable expiration times.

From an author:

I wanted to share crypt.fyi - a free, open-source tool I built for securely sharing sensitive data/files. It uses client-side encryption and zero-knowledge architecture.

Key features:

- Zero-knowledge architecture
- End-to-end encryption using AES-256-GCM (actively investigating post-quantum encryption options)
- Self-hostable
- Suite of configurations (password, burn after read, max read count, ip/cidr-allow list, webhooks)
- Strict rate-limiting
- Strict CSP to mitigate supply chain attacks
- Web, cli, and chrome-extension clients
- Fully open source (Github)

The problems I aimed to solve: Many people share sensitive info (passwords, keys, etc.) through email, Slack, or SMS - which often leaves plaintext copies in multiple places. Existing solutions either require accounts, aren’t open source, or have security/privacy/ui/ux/feature/config gaps/limitations.

crypt.fyi is built with privacy-first principles:

- No logging of sensitive data
- No analytics or tracking
- Separation of web and api servers
- All encryption/decryption happens client-side using shared cross-platform cryptography primitives from noble cryptography
- TLS encryption for all traffic
- Encrypted data is automatically destroyed after being read with strong guarantees around once-only reads

The entire codebase is open source and available for review. I’d love to get feedback from the privacy community on how to make it even better!

  • Valmond@lemmy.world
    7·
    4 days ago

    Interesting!

    How do I decrypt the data when I download my friends holiday photos he shared with me?

    How big can they be, can I share my favourite Judas Priest album with my niece?

    This is not a criticism, but was there some specific reason for using GCM?

    Good work!

    • codectl@lemmy.zipEnglish
      1·
      1 day ago

      How do I decrypt the data when I download my friends holiday photos he shared with me?

      They’re decrypted automatically in your browser via the key in the URL and additionally a password (assuming one was set when created). Both the key and password are used to encrypt the contents so the key alone is not sufficient to decrypt the contents. Regardless, it happens automatically entirely in your browser without ever sending the key or password to the API server.

      How big can they be, can I share my favourite Judas Priest album with my niece?

      I have the limit set to ~500kb right now. That’s after encrypting the contents. How large is your favorite Judas Priest album? Maybe I can uptick to accommodate it haha.

      specific reason for using GCM

      Given the different tradeoffs on performance, security, and implementation complexity, GCM seemed like a reasonable choice. I’m making sure to use the OWASP recommended PBKDF iterations 1 2. I’m also looking into post-quantum options recommended by NIST 1.