The problem we're solving

Every day, people send contracts, ID documents, financial records, and medical files through email attachments and cloud drive links. In all of these channels, the service provider in the middle can read everything. Your files sit on their servers in plain text — readable by the provider, by anyone who breaches them, and by anyone with a subpoena.

We believe the safest way to handle sensitive documents is simple: the service that stores your file should have no way to read it. Not as a policy promise — as a technical guarantee.

Our approach: zero-knowledge by design

veilsend encrypts your file in your browser, before anything is uploaded. The passphrase you choose is used to derive an encryption key locally, and it is never sent to our servers. We only ever receive and store ciphertext — data that is mathematically useless without your passphrase.

This means a server breach, a rogue employee, or a legal demand cannot expose your files. There is simply nothing readable on our side to hand over.

How it works

1. Pick a file and a passphrase. Everything happens on this page — no account is needed to understand the flow.
2. Your browser encrypts the file. Using the Web Crypto API, your passphrase derives a key via PBKDF2-HMAC-SHA256 (600,000 iterations, unique random salt per file), and the file is encrypted with AES-256-GCM. The original file never leaves your device.
3. Only ciphertext is uploaded. Our servers store the encrypted container plus basic metadata (file name, size, expiry) — never the passphrase, never the key.
4. Share link and passphrase separately. The recipient opens the link, enters the passphrase, and decryption happens locally in their browser too.

What we can see — and what we can't

Built to disappear

Sensitive files shouldn't live forever. Every file on veilsend has an expiry date — 1 day, 7 days, or longer retention once paid plans are available. Expired files are deleted automatically. No archives, no "recently deleted" folder, no traces.