SecretDrop — Encrypted file sharing for developers

I got tired of the same routine: a client asks for API keys, a freelancer needs database credentials, a coworker needs access to a config file. And every time, the answer was the same — paste it in Slack, send it over email, or throw it in a Google Doc with a vague title.

We all know that's wrong. But the alternatives were either overkill or required everyone to sign up for yet another tool.

So I built SecretDrop.

Two ways to share, both fully encrypted:

Password-Protected Links — Upload your files, set a password, share a link. Everything is encrypted in your browser with AES-256-GCM before it ever touches a server. The recipient opens the link, enters the password, and downloads. No account needed. Done.

End-to-End Encrypted Direct Transfer — Select recipients by email. Files are encrypted with each recipient's public key using ECIES. No passwords to remember or share. No shared secrets. Only the intended recipient can decrypt with their private key, which never leaves their browser unencrypted. Sender identity is verified through digital signatures so recipients always know exactly who sent it.

The server never sees your data. Not the files, not the filenames, not the password. Zero-knowledge architecture, built entirely on WebCrypto standards with no third-party crypto libraries.

Why I built it this way:

Client-side encryption — data is encrypted before it leaves your browser
No recipient account required for password links
Multi-recipient support — send to your whole team in one go
Expiration policies and access analytics built in
Recovery codes so you never get locked out of your keys

I built this because sharing secrets should be as easy as sharing a link — without the gut feeling that you're doing something insecure.

secretdrop.dev

SecretDrop

About