How It Works
A step-by-step look at the workflows that keep your data secure from end to end.
The Upload Workflow
1. Local Key Generation
When you select a file, your browser generates a random, unique AES-256 key specifically for that file.
2. Local Encryption
The browser encrypts the file using the AES key. The file is now a completely unreadable blob of data.
3. Protecting the AES Key
Your browser encrypts the AES key itself using your personal Public Key (RSA). This ensures only your Private Key can access the AES key later.
4. Upload to Cloud
The encrypted file blob is uploaded to our storage provider, and the encrypted AES key is saved to our database. Unencrypted data never leaves your device.
The Sharing Workflow
1. Fetching Public Keys
When you enter a recipient's username, your browser asks our server for that user's Public Key.
2. Local Decryption
Your browser downloads the encrypted AES key for your file and uses your Private Key to decrypt it locally.
3. Re-encrypting for Recipient
Your browser takes the unencrypted AES key and re-encrypts it, but this time using the recipient's Public Key.
4. Transfer Complete
The new encrypted key is sent to the server. Now, when the recipient logs in, their browser uses their Private Key to unlock the AES key, allowing them to download and view the file.
The Recovery Workflow
Because your Private Key lives in your browser's local storage, logging in on a new computer means you don't have your Private Key. Here is how the 12-word recovery phrase solves this without exposing your key to the server.
1. The Encrypted Backup
When you first generated your keys, your browser used your 12-word phrase to create a strong password. It encrypted your Private Key with this password and sent the encrypted backup to our server.
2. Entering the Phrase
On your new device, you enter the 12-word phrase. Your browser locally recreates the exact same strong password.
3. Restoration
Your browser downloads the encrypted backup from our server, unlocks it using the password derived from your phrase, and restores your Private Key to the new browser's local storage.