DeadDrop
End-to-end encrypted, single-use file and text transfer.
Encrypted in your browser. Downloaded once, then gone forever.
Track downloads (optional)
Save this token — it lets you check who downloaded this drop from the Status tab. It won't be shown again.
Your browser does the encryption.
Your password is stretched into a 256-bit key with Argon2id, and every chunk of your file or pasted text is sealed with AES-256-GCM before it leaves the tab. The password and the derived key never touch the network.
The server only sees ciphertext.
Drop key, encrypted chunks, encrypted metadata — but never the filename, the text, the contents, or anything that could be decrypted without the password. Admin access to the server doesn't grant access to your drop.
Single-use by default.
After one successful download, the drop is gone. The "Allow multiple downloads" option keeps it available to anyone with the link and password until expiry, capped at 200 downloads per drop.
Drops expire.
You pick 1 hour, 24 hours, or 7 days. After that the ciphertext is wiped by a background cleanup pass — nothing about your drop survives.
Probes can't tell real drops from fake ones.
Every challenge response — for a real drop or for a key nobody ever uploaded — has the same shape and is HMAC-signed with a short-lived, single-use nonce. A wire-observer of one download can't replay the bytes against the next.
Want the wire format and threat model in detail? Read the source on GitLab.
Want larger upload limits or scriptable transfers? Download CLI (Linux x86-64) -- Download CLI (Windows x86-64)