Frequently asked questions

Does Filenymous store my files?

No. Files go directly from one browser to the other (WebRTC). Only the one-time secret and the whistleblowing channel keep content on a server, and only encrypted, without the key.

Who can read my files?

Only people who have the full link (and the password if one is set). The key is in the link fragment, after #, which browsers never send to the server.

Is there a size limit?

No server-imposed limit, since nothing is stored there. The practical limit is how long the sender keeps their tab open.

Is Filenymous an “AirDrop for the web”?

That is the idea, but more open: like AirDrop, sending is direct and needs no account, yet Filenymous works in any modern browser (Windows, macOS, Linux, Android, iOS) and over the internet, not only between nearby Apple devices. Files travel over WebRTC, end-to-end encrypted. Filenymous is not affiliated with Apple.

Do I need an account?

No, neither the sender nor the recipient.

What happens if I close the tab?

The share stops and the link no longer works. With the CLI the share lasts while the process runs; with the extension, while the browser is open.

Has Filenymous been audited? What is its security model?

No external audit yet. The security model (algorithms, what the relay and peers see, threats not covered) is detailed on the Security page: https://filenymous.eu/app/en/security/

Is Filenymous free and open source?

Yes, free and released under the MIT licence on GitHub.

Can I ask an AI assistant to create a secret link?

Technically yes (through the vault API), but the assistant and its provider then see the secret in plain text. For a real secret, create the link yourself in your browser.

Which analytics are used?

Self-hosted, cookieless Umami: only the page path is sent, never the fragment (#…) or the query string, and nothing on secret, report and Sharewall pages.