SkySend
NewFile requests in 3.0

Share filesonly the recipient can read.

End-to-end encrypted file and note sharing you can host yourself. Everything is encrypted in your browser, and the key travels in the link. No accounts, no tracking.

Get startedOpen source
ch.skysend.app
FileNote3 items · 184.3 MB
q3-board-pack.pdf12.4 MB
contract-signed.pdf2.1 MB
site-photos169.8 MB
7 days5 downloadsPassword

Deleted in 7 days or after 5 downloads, whichever comes first.

Share 3 items
Link readyEncrypted in this browser before upload
https://ch.skysend.app/file/aB3kQ9xZ#Zk3vT0qL8mWc2HxR9bN4yJ6sPa1eFgUd7tKiVo5nC3w
Copy link
AES-GCM keys, made in your browser
256 bit
accounts, trackers or analytics
0
languages, three themes
13
Docker container with SQLite
1
AES-256-GCMHKDF-SHA256HMAC-SHA256Argon2id passwordsHPKE, RFC 9180P-256 key pairs64 KB encrypted recordsWeb Crypto APIKey in the URL fragmentZero knowledge
Docker on AMD64Docker on ARM64Local diskAny S3 bucketAWS S3Cloudflare R2MinIOOIDC sign-inInstallable as an appCLI for LinuxCLI for macOSCLI for Windows13 languages
Features

Everything a private share needs, and nothing that could read it.

Notes made of blocks

Text, passwords, code and SSH keys in one note, in any order. Whoever opens it gets a copy button on every block.

Click to add or remove
Access for MaraBurn after reading
Message

Here is the access to the staging box. This note deletes itself once you have read it.

Server access
Usernamedeploy
Password••••••••••••••
nginx.conf
server {
  listen 443 ssl;
  server_name staging.example.com;
}
New in 3.0

File and note requests

Hand someone an upload link. What they send is encrypted for you alone, and the server cannot open the inbox.

Signed contract and IDOpen for 3 days · up to 5 sendsch.skysend.app/request/Hx2k9PqL#BKz8…
Inbox1 newOnly you can open these
contract-signed.pdf2.1 MB · just now
HPKE (RFC 9180) with P-256 and AES-256-GCM

Shares that delete themselves

An expiry time and a download limit on every share. Whichever runs out first, the ciphertext is gone.

This share is deleted in 7 days or after 5 downloads, whichever comes first.

A password on top

Optional and derived with Argon2id. The link alone then opens nothing.

••••••••••••••••••
Strong

Your disk, or any S3

Either way, the storage only ever holds ciphertext.

/uploads/aB3kQ9xZ.binA folder on the host, mounted into the container.

No accounts

My Links lives in your browser. An optional OIDC sign-in decides who may share.

Three themes, 13 languages

Graphite, Aurora and Midnight, each light and dark, plus your own accent color.

Zero knowledge

The key is in the link. The server never gets it.

Browsers never send the part of a link after the #. SkySend puts a random secret there and derives every key from it in your browser, with HKDF-SHA256.

Read the crypto designTry it on How it works
The secretNever sent

32 random bytes made in your browser. Everything after the # stays on the device, so the server never sees it, not even in its logs.

Secret, 32 bytes
HKDF-SHA256
fileKeyEncrypts the file in 64 KB recordsStays here
metaKeyEncrypts names, sizes and typesStays here
authTokenProves to the server that you hold the linkSent, derived
ownerTokenLets the uploader delete the shareSent, derived
CLI and terminal UI

Same encryption, from your terminal.

Upload, download and write notes from a shell or a script. Run skysend without arguments for the interactive terminal UI. Read the CLI guide.

$curl -fsSL https://skysend.app/install.sh | sh
  • Linux, macOS and Windows, one binary each
  • A JSON flag on the commands for scripts
  • Signs in through OIDC when your instance asks
Terminal
Quick start

Your own instance in two minutes.

One container with SQLite inside. Images for AMD64 and ARM64.

Every environment variableReverse proxyS3 storage
services:
skysend:
image: skyfay/skysend:latest
container_name: skysend
restart: always
ports:
- "3000:3000"
volumes:
- ./data:/data
- ./uploads:/uploads
environment:
- BASE_URL=http://localhost:3000
$ docker compose up -d
Container skysend Started
Openhttp://localhost:3000HTTPS in front before you go public
Public instances

No server? Share on a public one.

Run by the community on the same open code, with their status and limits checked every 30 minutes. The key never reaches them either.

Found something that should not be there?Report a link to the instance that hosts it. The report goes to its abuse contact, who can delete the share.Report a link

Questions

Something missing? Ask on Discord.

No. Every file and note is encrypted in your browser with AES-256-GCM before it is uploaded. The key lives in the part of the link after the #, which browsers never send to a server. The server only ever stores ciphertext.

No. Open an instance and share. My Links keeps your shares in this browser. If you run an instance, you can require an OIDC sign-in before anyone may share or create requests.

The server deletes the encrypted blob once its time runs out or its download limit is used up. A note set to burn after reading is gone after the first view.

SkySend is made to run on your own server as one Docker image. Without a server, use one of the public instances, which run the same open code.

Notes made of blocks: text and Markdown, passwords, code and SSH keys, in any combination. With a request, someone else sends you files or a filled-in note that only you can open.

AGPL-3.0. The whole source, the crypto design included, is on GitHub.

Stop pasting passwords into chat.

Free and open source under AGPL-3.0. Yours to run.

Get startedJoin the Discord