Drop.

Security documentation and threat model →

Free sharing, built by me.

I built Drop as a free, browser-based, end-to-end encrypted file and text sharing service. I’m Alexander, the independent developer behind zentr.dev. No account is required for ordinary temporary sharing. I do not put advertisements, paid tiers, tracking scripts, or analytics in Drop. Sending a file should not require a side quest.

Limits and compatibility

I currently allow uploads up to 10 GiB (10,737,418,240 bytes) total per drop, across up to 20 nonempty files. A single file can use that entire allowance. File encryption uses 32 MiB chunks; uploads send up to four 4 MiB transport parts at once across chunk boundaries and encrypt the next chunk while uploading. The text limit is 1 MiB in UTF-8 bytes. Available storage, network conditions, and browser memory can impose practical limits below the maximum. I cannot make your phone’s memory bigger by believing in it.

I make ordinary drops expire 30 minutes after upload completes. Incomplete upload sessions expire 30 minutes after they begin. Access is denied at expiry, and periodic cleanup removes expired data. Short URL records also last 30 minutes and cannot extend the target drop’s lifetime.

Modern desktop and mobile browsers with HTTPS and Web Crypto are supported. On iOS, supported images and videos have a Save to Photos button that opens the native share sheet where available; saving options depend on the browser and file type. Browsers without streaming file-save support must buffer the decrypted file in memory, so very large mobile downloads may fail. Previews have a shared 64 MiB budget per page.

Frequently asked questions

Is Drop end-to-end encrypted?

New file and text drops are encrypted on the sending device with AES-256-GCM and decrypted on the receiving device. The encrypted manifest hides filenames and MIME types. The full share link carries the key after #, which browsers do not send in HTTP requests. URL shortening itself is not encrypted.

Can I share large files for free?

Yes. Up to 10 GiB total and 20 files per temporary drop, subject to available storage and device resources. Uploading and downloading are free.

Does Drop require an account?

No account is required to create or download ordinary temporary drops.

Can recipients download files while the sender is offline?

Yes. Once the upload completes, recipients can download while the sender is offline, until the drop expires. The service and its connection must remain available.

How long do shared files remain available?

Ordinary temporary drops remain available for 30 minutes after upload completion. Downloading does not reset that timer.

Where are encrypted files stored?

Encrypted chunks and manifests are stored in private project storage on the service’s private host, not on the sender’s device alone. Delivery uses Cloudflare Tunnel. Storage receives ciphertext, sizes, chunk counts, identifiers, and timing information, but new clients do not send plaintext filenames, file contents, or decryption keys.

Who runs Drop?

I do. I independently build and operate Drop as part of zentr.dev. Support is me too; the departments share a chair.

Short links and URL safety

New shortened Drop links retain their decryption key in the fragment: /l/abcde#key. Only the destination without its fragment is stored. A five-character code alone cannot decrypt a drop. The destination remains visible to the shortening service, and a malicious redirect could capture a fragment on the destination page. Prefer the original full Drop link for sensitive sharing.

Older shortened links created before this security update stored the full destination including its key; those links do not provide the same end-to-end confidentiality. Compatibility is retained until they expire. Recreate sensitive shares using a new full link.

I check public URL destinations locally against downloaded Phishing.Database, OpenPhish, CERT Polska, and MetaMask feeds. A confirmed match blocks shortening; unknown or unlisted destinations are allowed. These checks are not a guarantee of safety, and new abuse may be missed.