Building a True Zero-Knowledge File Sharing Tool with Client-Side Encryption

#javascript #encryption #privacy #webdev

Building a True Zero-Knowledge File Sharing Tool with Client-Side Encryption

Most “secure” file sharing tools still hold the encryption keys or can decrypt your files on their servers. I wanted something different — a tool where even I, as the operator, mathematically cannot access the contents.

So I built SendShield Files.

The Core Idea

Files are encrypted entirely in the browser before they ever leave the user’s device. The decryption key never reaches the server.

How it works

The browser generates a random file key.
The file is split into 16 MiB chunks and encrypted with AES-256-GCM using the Web Cryptography API.
The decryption key is placed only in the URL fragment (#key=...).
According to RFC 3986, the fragment is never sent to the server in the HTTP request.
The server only stores ciphertext.

Result: zero-knowledge architecture. We cannot decrypt your files even if we wanted to.

Two Main Flows

1. Send a File

Choose a file + optional expiration (10 minutes to 90 days).
Optionally add an Argon2id passphrase.
Browser encrypts → share the link (key stays in the fragment).

2. Request Files (Drop Portal)

Create a request link.
Uploaders encrypt files with your X25519 public key in their own browsers.
Only you can decrypt the submissions.
Useful when you need people to send you sensitive documents without sharing a password.