How send-file.online Works
Technical documentation on our transfer protocol, zero-knowledge encryption, and safety measures.
1. Core Philosophy
send-file.online is designed as a secure transfer tunnel — not as a cloud storage platform, content hosting service, or file archive.
Our mission is focused and intentionally narrow: to enable fast, secure, and temporary data transfer, while minimizing long-term exposure and unnecessary complexity.
Privacy, Not Piracy
Encryption and anonymity are often misunderstood. They are not tools for hiding illegal activity — they are essential safeguards for legitimate, everyday data protection.
Many users need to transfer sensitive information securely:
- Personal and identity documents
- Business contracts and internal files
- Medical or legal records
- Source code and intellectual property
- Large files that do not belong in email attachments
In such cases, long-term storage on third-party platforms creates unnecessary risk. Data exposure increases with time, even when access controls are in place.
Two Levels of Security
send-file.online provides security on two distinct layers. Understanding this difference is important:
- Transport Encryption (always on): All uploads and downloads use secure HTTPS/TLS connections. This encrypts data in transit between your device and our servers, preventing third parties from intercepting the transfer.
- End-to-End File Encryption (optional): When you enable Encrypted Mode, the file is encrypted in your browser before upload. Our servers store only encrypted data, and the decryption key remains on the client side (in the Magic Link fragment).
Why Not “Just ZIP It”?
A common alternative is to create a password-protected archive (ZIP/RAR/7z) and send it separately. This can work — but in practice it is often unreliable: users choose weak passwords, reuse passwords, or use formats/settings that provide limited protection.
Encrypted Mode automates strong encryption correctly and consistently, without extra software and without manual steps.
Ephemeral by Design
Files on send-file.online exist only for the duration required to complete the transfer.
Once the recipient successfully downloads the file — or once the expiration limit is reached — the data is permanently deleted from our systems.
This approach significantly reduces:
- The attack surface for data breaches
- The risk of unauthorized access over time
- The long-term responsibility of storing user content
Why We Do Not Send Emails
send-file.online deliberately does not send download links or notifications by email.
Email-based delivery systems are frequently abused for phishing, malware distribution, and social engineering. Even well-intentioned services can unintentionally become vectors for harmful content.
By not sending emails on behalf of users, we ensure that:
- Our domain cannot be misused for phishing campaigns
- We do not participate in unsolicited message delivery
- Recipients receive links only through channels they trust
Fast by Design
send-file.online is optimized for speed and simplicity. There are no accounts to create, no inboxes to manage, and no background processes slowing things down.
Upload, share the link securely, and the transfer is complete.
This design is intentional. A secure system should not be complicated to be effective.
Minimal Data, Maximum Control
We avoid collecting unnecessary metadata, tracking behavior, or building persistent user profiles.
- No accounts
- No long-term identifiers
- No behavioral tracking
Control remains with the sender and recipient — not with the platform.
Security Through Design
send-file.online follows a simple principle: the safest data is data that does not exist longer than needed.
By combining temporary storage, optional client-side encryption, and minimal metadata retention, we reduce both technical and human risk.
This philosophy reflects centuries of cryptographic evolution — from physical couriers to modern end-to-end encryption — applied to a fast, practical, modern service.
2. File Lifecycle & Limits
send-file.online is designed around the principle that files should exist only as long as they are genuinely needed for a transfer.
Unlike traditional cloud services, we do not offer unlimited storage, permanent links, or long-term file hosting. This is a deliberate security and compliance decision.
Controlled Lifetime
Every uploaded file has a clearly defined lifecycle chosen by the sender at upload time.
- Retention Period: Files can be stored for a limited duration ranging from 1 to 7 days.
- Download Limit: The sender defines how many successful downloads are allowed before the file is automatically removed.
Once either of these limits is reached — expiration time or download count — the file is permanently deleted from our systems and becomes irretrievable.
Why These Limits Exist
These restrictions are not technical limitations — they are safeguards.
Unlimited lifetime and unlimited downloads turn file transfer services into de facto file hosting platforms, which significantly increases the risk of:
- Unauthorized redistribution of copyrighted material
- Mass sharing of files outside the sender’s intent
- Long-term exposure of sensitive data
By enforcing short lifetimes and finite downloads, send-file.online actively discourages piracy, bulk redistribution, and unintended public sharing.
Temporary by Design, Not by Accident
Temporary storage is a core design decision, not an afterthought.
Files are not meant to be indexed, archived, or referenced indefinitely. Each transfer has a clear beginning and a clear end.
This protects both:
- Senders — by limiting long-term exposure
- The platform — by preventing misuse as a hosting service
Download Monitoring & Transparency
To give senders full visibility over the transfer process, send-file.online maintains a real-time download counter for every uploaded file.
This counter allows the uploader to see:
- Whether the file has already been downloaded
- How many successful downloads have occurred
- Whether an attempted pickup failed due to an incorrect decryption key
Each successful download immediately decreases the remaining download limit. Once the limit reaches zero, the file is permanently deleted.
This mechanism serves two important purposes:
- It informs the sender when the recipient has successfully retrieved the file
- It helps detect unintended link sharing or guessing attempts
The counter tracks only the minimal information required to operate the service. It does not identify who attempted the download and does not log personal data.
3. Controlled Extensions (“Last Chance”)
send-file.online is designed around strict, automatic expiration. In rare cases, however, real-world conditions require limited flexibility.
A recipient may be temporarily unavailable, experience a failed download due to a network issue, or miss the original transfer window.
A Safety Net — Not a Default
To prevent unnecessary re-uploads while preserving the temporary nature of the service, send-file.online provides a controlled “Last Chance” extension.
This feature is intentionally limited and exists solely to complete an already initiated transfer — not to prolong availability indefinitely.
How Extensions Work
If a file is approaching its expiration or its remaining download limit, a short extension may be triggered:
- By the uploader, using their active session
- Optionally by the recipient, if explicitly enabled
Each extension:
- Adds +1 day to the remaining retention period
- Adds +1 additional download opportunity
Strict Extension Limits
To prevent abuse, extensions are capped at a maximum of three uses per file.
Once this limit is reached, the file follows the standard lifecycle and is permanently deleted.
Why Extensions Are Restricted
Unlimited renewal would effectively transform a temporary transfer service into a hosting platform.
By enforcing hard limits, send-file.online remains optimized for intentional, one-to-one data delivery — not broadcasting, mirroring, or redistribution.
4. The “Magic Link” Encryption
Traditional secure file sharing often requires you to manually compress files into a password-protected ZIP archive before sending them. This process is tedious, error-prone, and technically demanding.
send-file.online automates this entire process directly in your browser. No additional software, no manual steps, no cryptographic knowledge required.
How it works
When you enable Encrypted Mode, encryption happens locally using the Web Crypto API with modern AES-256-GCM encryption.
- Automatic Encryption: Your browser generates a strong random encryption key and encrypts the file before it is uploaded.
-
The Magic Link:
We generate a shareable link that looks like this:
send-file.online/pickup.html?code=ABC#YOUR-KEY-123 -
The Secret:
The part after the
#(the decryption key) is processed exclusively by the browser. By design, browsers do not send URL fragments to servers.
Encrypted vs. Non-Encrypted Transfers
Encryption in send-file.online works on two distinct levels.
1. Transport Encryption (Always On)
All transfers — encrypted or not — are protected using secure HTTPS/TLS connections. This means that data is always encrypted while traveling between your device and our servers.
This prevents third parties from intercepting or reading files in transit.
2. End-to-End File Encryption (Optional)
When Encrypted Mode is enabled, an additional layer of security is applied. The file itself is encrypted before upload, and can only be decrypted by someone who possesses the full Magic Link.
Password vs. Encryption Key
Unlike traditional ZIP archives, send-file.online does not rely on user-chosen passwords.
Instead, the system generates a high-entropy cryptographic key automatically and embeds it into the Magic Link.
This avoids common mistakes such as weak passwords, password reuse, or insecure password sharing.
What We Can and Cannot Access
When Encrypted Mode is enabled:
- Stored: Encrypted file data and minimal technical metadata
- Not stored: Decryption keys or plaintext file contents
Even the service operator cannot decrypt files without the Magic Link.
Sharing the Magic Link Safely
Because the decryption key is part of the link, treat the Magic Link as sensitive information.
- Share it only with the intended recipient
- Avoid public or searchable channels
- Prefer secure messaging or direct communication
Encryption protects your file on the server — link handling remains under your control.
5. Infrastructure Security
Security at send-file.online does not rely on a single mechanism. It is built as a layered system designed to minimize risk even if one component fails. This approach is commonly referred to as Defense in Depth.
Our infrastructure is designed to protect data both in transit and at rest, while limiting the potential impact of misconfiguration, hardware failure, or malicious activity.
Encrypted Storage
All physical storage devices used by send-file.online employ full-disk encryption based on LUKS / dm-crypt.
- Encrypted Drives: Data stored on disk is encrypted automatically. Without access to encryption keys, the contents are unreadable.
- Physical Threat Mitigation: Even in the unlikely event of physical theft, drives cannot be mounted or analyzed.
Network Segmentation & Isolation
The infrastructure is segmented into clearly separated security zones. Each component is granted only the access required to perform its specific role.
- Upload servers: Handle file transfers and terminate TLS connections
- Storage layer: Stores encrypted file data only
- Metadata services: Isolated systems with minimal exposure
Direct communication between these layers is restricted by strict firewall rules and internal access controls.
Controlled Access & Hardening
Administrative access to infrastructure components is tightly controlled and audited.
- No public administrative interfaces
- Restricted SSH access with key-based authentication
- Minimal exposed services
Systems are hardened to reduce attack surface and unnecessary software components are removed.
DDoS Protection & Availability
Availability is a critical part of security. Denial-of-service attacks are designed to make services unavailable, not to steal data.
send-file.online employs advanced traffic filtering and rate-limiting mechanisms to absorb and mitigate large-scale attacks.
- Automated traffic analysis
- Rate limiting for abusive patterns
- Separation of trusted and untrusted traffic
Minimal Logging Philosophy
Infrastructure-level logging is kept deliberately minimal and focused on operational health, not user behavior.
Logs are used to:
- Detect infrastructure failures
- Respond to active attacks
- Maintain service stability
They are not used for profiling, tracking, or long-term analysis of user activity.
Security as a Process
Infrastructure security is not a one-time setup. It is an ongoing process that evolves as new threats and technologies emerge.
By combining encryption, isolation, access control, and operational discipline, send-file.online aims to reduce risk at every stage of the file transfer lifecycle.
6. Secure Download Protocol
Downloading encrypted files on send-file.online is designed to be both secure and efficient. We do not simply deliver a file blindly to the recipient.
Instead, the system verifies that the recipient possesses the correct decryption key before transferring the full file. This protects bandwidth, prevents unnecessary downloads, and avoids user frustration.
Client-Side Decryption
Encrypted files are never decrypted on our servers. Decryption happens entirely within the recipient’s web browser.
The encrypted data is streamed from the server, decrypted locally using the key contained in the Magic Link, and written to the final file only on the user’s device.
The Verification Handshake
When a recipient opens a Magic Link, the download process begins with a lightweight verification step.
- Header Request: The browser requests a small verification chunk (approximately 4 KB) from the server. This contains encrypted data and authentication information.
-
Local Decryption Attempt:
Using the key stored in the URL fragment
(the part after
#), the browser attempts to decrypt this chunk locally. - Integrity Check: AES-GCM authentication verifies whether the data was decrypted correctly and has not been tampered with.
-
Decision Point:
— Incorrect Key: The process stops immediately. No further data is downloaded.
— Correct Key: The browser automatically proceeds to stream and decrypt the full file.
Streaming & On-the-Fly Decryption
Once the key is verified, the file is downloaded as a stream. Data is decrypted chunk by chunk as it arrives.
This approach has several advantages:
- No need to download the full encrypted file before decryption
- Lower memory usage for large files
- Immediate detection of corrupted or incomplete transfers
If the connection is interrupted, the process can fail safely without exposing partial plaintext.
Efficiency & Abuse Prevention
The handshake mechanism also serves
send-file.online is built around the principle of
data minimization.
Simply put: we cannot lose, misuse, or leak data
that we do not collect or store in the first place.
This approach reduces both technical risk
and long-term responsibility,
while giving users greater control over their information.
When encrypted mode is enabled,
send-file.online operates as a
zero-knowledge system.
We do not know the contents of encrypted files.
To the platform, encrypted data appears as
indistinguishable random noise.
Without access to the decryption key —
which never reaches our servers —
file contents cannot be reconstructed,
inspected, or indexed.
send-file.online does not build user profiles
or track behavior across sessions or websites.
We intentionally avoid:
We do not use tools such as
Google Analytics, Facebook Pixel,
or similar behavioral tracking services.
While we minimize data collection,
a complete absence of logging
would make it impossible
to operate a secure and stable service.
For this reason, we retain a limited set
of operational logs
strictly for technical and security purposes.
These logs may include:
These logs are used exclusively to:
Operational logs are retained
for the shortest time necessary.
They are automatically rotated,
anonymized where possible,
and permanently deleted
according to predefined retention policies.
Rather than relying on promises or policies,
send-file.online embeds privacy
directly into its architecture.
By combining:
the platform reduces the amount of information
that exists at any given moment —
and therefore the potential impact
of any security incident.
send-file.online is built to protect privacy —
but privacy does not mean the absence of responsibility.
We are committed to operating a secure,
lawful, and abuse-resistant service.
Illegal content, malware distribution,
and misuse of the platform are not tolerated.
Our ability to enforce policies depends on
the technical context of the transfer.
In cases involving serious criminal activity
(such as child exploitation, terrorism,
or credible threats of harm),
send-file.online complies with applicable laws
and lawful requests from competent authorities.
Where legally required,
we may preserve available technical metadata
relevant to an investigation.
We do not retain file contents
beyond their defined lifecycle,
and encrypted content remains inaccessible.
To protect the service and its users,
we reserve the right to:
These measures are applied proportionally
and are designed to prevent systemic abuse
rather than punish legitimate use.
By using send-file.online,
users agree to comply with our
Terms of Service
and applicable laws.
7. Data Minimization
Zero-Knowledge by Design
No Personal Profiles
Operational Logs (and Why They Exist)
Limited Retention of Logs
Privacy as a Structural Property
8. Safety & Compliance
Scope of Enforcement
Multi-Layered Protection System
Cooperation with Authorities
Enforcement Actions