About — nofile.in

How it works

When you add a file, your browser generates a random AES-256-GCM key and encrypts the file in chunks.
Only the encrypted chunks are uploaded, along with the file name, type, size, and the expiry you chose.
The key is placed in the link after the #. Browsers don't send that part to servers, so it stays between you and whoever you share the link with.
When someone opens the link, their browser fetches the encrypted chunks and decrypts them locally.

Without the key, the file can't be opened — not by us, and not by anyone who finds the link without the part after #.

What the server stores

The encrypted file chunks
File name, type, size, and expiry
A salted hash of the download password, if you set one
Upload time and a download counter

The list of your uploads and their deletion tokens is kept in your browser's local storage, not on the server.

Logs, cookies, and analytics

Server logs record the time, IP address, HTTP method, and path of requests, which we keep to handle abuse and legal requests. Decryption keys are never in those logs because they're never sent. There are no analytics scripts, no tracking cookies, and no third-party requests. Session cookies are only used if the server is configured with sign-in.

Expiry and deletion

Files are removed when they reach the expiry you picked, or right after the first download if you chose that option. You can also delete a file yourself from the Files page; deletion removes the encrypted data immediately.

Reporting abuse

Use the Report button on any file page, or email shubham@hostmycode.in with the link. Reports are reviewed promptly and files that break the law or these terms are removed.

Terms of use

You're responsible for what you upload. Don't use nofile.in for malware, illegal content, or anything that violates someone else's rights.

Contact

Questions and security reports: shubham@nofile.in

nofile.in runs on Lufi, free software licensed under the AGPL.