Is the file really only downloadable once?

Yes. The moment the recipient hits Reveal, the file is decrypted in their browser, the download starts, and we immediately delete the encrypted blob server-side. Anyone opening the same link afterwards sees "this file has been destroyed". Save it before closing the tab — that's the only chance.

Can induwara.lk read the file or know what it is?

No. The encryption key is generated in your browser and lives only in the URL fragment (the part after #), which browsers never transmit to a server. We receive and store opaque ciphertext we have no key for. We never see the file name, contents, MIME type after decryption, or anything readable.

What's the file size limit and why?

3 MB per file. The limit exists because the file is encrypted client-side and uploaded in a single request — bigger files would time out on slow mobile connections, and we'd need to add chunking/resume logic that introduces complexity (and abuse surface). For typical use-cases — a confidential PDF, a screenshot, a config file — 3 MB is enough.

What file types can I send?

Any. Images, PDFs, ZIPs, documents, text files, code, anything. The encryption is bytes-in, bytes-out — we don't inspect or restrict types. Images get an inline preview on the recipient page; everything else is a download button.

How long does it sit before auto-destruct?

Whatever timer you picked: 1 hour, 24 hours, or 1 week. The server enforces it — even if no one ever opens the link, the encrypted blob is permanently deleted when the window closes. Combined with the read-once behaviour, your file never lingers indefinitely.

How is this different from WeTransfer, Firefox Send, or Dropbox Transfer?

Same outcome — share one file via a link — but with two important differences. First, no signup, no email-collection, no account. Second, the encryption happens in YOUR browser before the upload, with a key we never see. WeTransfer holds your file in plaintext on their servers; we can't read it even with a subpoena because we don't have the key. Closest equivalent in spirit was Firefox Send (now discontinued); this is a free, working alternative.

Can I send a password or just text instead?

Yes — use our companion tool, "Send a One-Time Secret", which is optimised for text (passwords, API keys, notes). Same encryption model, no file overhead.

What if my upload gets interrupted?

Nothing bad happens — the partial upload is discarded server-side and you'll see an error in the composer. Just retry. The recipient never gets a partial file; either the whole encrypted blob is on the server or it isn't.

End-to-end encrypted · Read-once

Send a self-destructing file — encrypted, no signup

Upload any file up to 3 MB, get a one-time link, and the file is encrypted in your browser before it ever leaves. The recipient downloads once; the encrypted blob is destroyed. We never see the file, the key, or the contents. Free, no account, no email.

By Induwara AshinsanaUpdated May 31, 2026

End-to-end encrypted in your browser · 3 MB max

Auto-destruct after

How it works

When you choose a file and click Create one-time file link, your browser generates a random AES-256 key with the native Web Crypto API and places it in the part of the URL after the # — the URL fragment, which browsers never transmit to any server. The file's bytes are encrypted locally with that key before they leave your device, so what reaches our server is opaque ciphertext we have no way to decrypt.

The link you share has two parts: the session identifier (which we know) and the decryption key (which only you and the recipient know, because it's in the fragment). When they open it, their browser downloads the encrypted blob, uses the key from their URL to decrypt it locally, and offers the file as a download. At the same moment, we receive a destroy signal and permanently delete the encrypted blob server-side. No log keeps it. No backup.

That gives you two layers of protection. Read-once means even if someone later finds the link in a chat history, opening it shows nothing — the blob is gone. The server-enforced timer means if no one downloads the file, it still self-destructs after the window you picked. Because we never have the key, there is no point at which a readable copy of your file exists on our side.

The one rule: the link is the key. Anyone who gets the full URL can download the file once. Send it over a channel that's at least somewhat private and prefer the shortest timer that works.

When this is the right tool

Sharing a confidential PDF with a lawyer, accountant, or client — without leaving it in your email forever.
Sending a screenshot containing sensitive info (an invoice, a private message, ID details) without it sitting in chat history.
Handing over a config file, certificate, or key file to a teammate or contractor.
One-time delivery of a design draft, contract, or document you don't want forwarded.
Replacing email attachments when the file is sensitive — your inbox keeps it forever; this doesn't.

Frequently asked questions

Related tools

LiveUtility

QR Code Generator

Generate QR codes for URLs, text, Wi-Fi, vCards, email, phone, or SMS. Customise colours, set error-correction level, add a centre logo. Encoded entirely in your browser, no signup, downloads as PNG or SVG.

Open tool

LiveUtility

Secret Chat

Create an end-to-end encrypted chat, share the link, and message privately with media. Nothing readable is stored and the chat self-destructs on a timer. No signup.

Open tool

LiveUtility

One-Time Secret

Paste a password, API key, or private note and get a self-destructing one-time link. End-to-end encrypted in your browser; our server never sees it. A free Privnote alternative — no signup.

Open tool

Sources & references

File contents are encrypted with AES-GCM-256 via the browser's native Web Crypto API; the key lives only in the URL fragment.

Questions or a bug to report?

Email [email protected].