Encrypted file transfer: what "encrypted" actually means
Three very different things hide behind the same word.
1. Encrypted in transit (TLS)
Protects the connection between you and the server. Every website has it. The server sees the plaintext.
2. Encrypted at rest
The disk is encrypted; the provider holds the key. Protects against stolen hardware, not against the provider, its staff, subpoenas or a breach of its systems.
3. End-to-end / zero-knowledge
The key is generated on your device and never shared with the service. Only the sender and the recipient can decrypt. The provider stores noise. This is how LimeShare works: AES-256-GCM in your browser, per-file keys derived with HKDF, an authenticated streaming format (LSC1) that detects truncation or tampering, and the key carried in the URL fragment that browsers never send to servers.
How to check a service's claim
- Can you recover files if you lose the link or password? If yes, they have the key.
- Do they show previews or thumbnails on their site? Then they decrypt server-side.
- Is the client code published so the encryption can be inspected? It should be.
Details of our implementation: security model · how it works.