Free encrypted file sharing, with optional passwords
A private file shouldn’t become readable to the service carrying it. New Ferndrop browser links encrypt files and filenames before they leave your device.
By Ferndrop · Reviewed
Ferndrop’s browser link transfers use end-to-end encryption: your browser encrypts the contents and file list before upload, and the recipient’s browser decrypts them. Files can total up to 10 GB. You can add a password and choose when the link expires, without creating an account.
Where the key goes
Think of the stored upload as a locked parcel. Ferndrop stores the encrypted parcel; the complete sharing link carries the information needed to open it.
For a link without a password, the secret is in the URL fragment: the part after #. Browsers don’t include that fragment in the HTTP request to our server. The receiving page reads it locally and decrypts the files. Copy the whole link, not just the address before the #.
The format uses Web Crypto AES-256-GCM for the files and manifest. A password, if you choose one, derives a key using PBKDF2-SHA256 with 600,000 iterations to protect the sharing secret. These are implementation details, not a claim of an independent security audit.
How to share a password-protected file
- Add your files on the home page.
- Expand Link options. Enter a password of at least 10 characters; a long, unique passphrase is a better choice than a familiar name with a number.
- Choose an expiry, and optionally a download limit.
- Choose Get a link and wait for the upload to finish.
- Share the complete link. Send the password separately, ideally through another communication channel.
The password is not sent to our server. It unlocks the sharing secret in the recipient’s browser. If you lose the password or the complete link, we cannot recover them.
A password doesn’t identify a person. Anyone who gets both the full link and the password can use them. If you need access restricted to named employees, an organisation-approved system with identity-based access may fit better.
Expiry and download limits
A link lasts 48 hours by default. You can choose 1 hour, 24 hours or 7 days before uploading. The sender can delete it sooner from My transfers in the same browser, while the local transfer details are still available.
You can also set a completed-download allowance. It counts saved files or a ZIP through the supported download flow; it does not prove there was only one recipient. Neither expiry nor a download limit can erase a copy someone has already saved or stop them copying it.
What encryption doesn’t hide
- Operational details. Our service still needs transfer identifiers, encrypted byte sizes, expiry and usage counts to run the transfer.
- Network access. Hosting and network providers handle connection information. We use changing, salted IP hashes for abuse limits. When email verification is enabled, the address is used for access and abuse prevention.
- Your devices and messages. Someone with access to your browser, email or the full sharing link may have access to the file. Local upload-recovery and transfer-management details are sensitive on a shared computer.
- The file itself. Encryption is not a virus scan. We do not check that a received file is safe to open.
Ferndrop is a website: the browser runs code delivered by the service. End-to-end encryption does not remove the need to trust that code or protect a compromised device. Read the privacy policy for retention, providers and the distinction between new encrypted browser links and legacy links.
What about sending directly?
Send directly uses an encrypted WebRTC data channel and does not store your files. It first tries to connect the browsers; a relay can forward encrypted traffic when a direct route fails, for transfers up to 10 GB. On a direct route, peers can learn one another’s IP address. Both pages must stay open.
The password option above applies to stored links. For direct sending, protect the private room link and share it only with the intended recipient. See how browser-to-browser sending works.
Limits to plan around
Stored links allow up to 10 GB and 1,000 files. Link uploads and relay fallback share a 25 GB sending allowance per UTC day, with network and verified-email checks where applicable. Starts are rate limited. Direct connections have no fixed file-size or daily byte limit, but depend on browser support, free disk space and a connection that stays alive.