SkySend
End-to-end encrypted, self-hostable file and note sharing, built for speed and security.
Website •
Documentation •
Quick Start •
Public Instances •
Changelog •
Roadmap
### What is SkySend?
SkySend shares files and notes so that only the recipient can read them. Everything is encrypted in the browser before it leaves the device, and the key travels in the fragment of the share link, which browsers never send to a server. The server stores ciphertext and nothing else.
It runs as one Docker container with SQLite and needs no accounts. Host your own instance, or use one of the [public instances](https://docs.skysend.app/instances), and if you run one yourself, you can [add it to the list](https://docs.skysend.app/instances).
Inspired by [timvisee/send](https://github.com/timvisee/send), the community fork of Mozilla Send, and by [PrivateBin](https://privatebin.info/), SkySend is built from scratch with higher security standards, more features and a minimal, maintainable codebase. Its whole crypto design is [documented](https://docs.skysend.app/developer-guide/crypto/).
## ✨ Highlights
- **Zero knowledge** - AES-256-GCM in the browser, and the key never leaves the share link
- **Files and folders** - single files, several at once or a whole folder, zipped in the browser, with size and file limits you set yourself
- **Notes made of blocks** - text and Markdown, passwords with a generator, code with highlighting and SSH keys, combined in one note
- **File and note requests** - send someone an upload link, and the files or the note they send are encrypted for you alone
- **Shares that delete themselves** - expiry times, download and view limits, and burn after reading
- **Password protection** - an optional password on top of the link, derived with Argon2id
- **A CLI for the terminal** - upload, download and notes with the same encryption, plus an interactive TUI
- **No accounts** - My Links lives in the browser, and optional OIDC sign-in limits who may share
- **Runs anywhere** - local storage or any S3-compatible bucket, 13 languages and three themes
## 🔒 Security Design
| Component | Algorithm |
| :--- | :--- |
| Secret key | 256-bit random, in the URL fragment only |
| Key derivation | HKDF-SHA256, a separate key for content, metadata and auth |
| File encryption | AES-256-GCM, streamed in 64 KB records |
| Note and metadata encryption | AES-256-GCM with a random IV |
| Auth token | HMAC-SHA256 |
| Password KDF | Argon2id (WASM) |
| File requests | HPKE (RFC 9180), P-256 and AES-256-GCM |
## 🚀 Quick Start
```yaml
# docker-compose.yml
services:
skysend:
image: skyfay/skysend:latest
container_name: skysend
restart: always
ports:
- "3000:3000"
volumes:
- ./data:/data
- ./uploads:/uploads
environment:
- BASE_URL=http://localhost:3000
```
```bash
docker compose up -d
```
Open [http://localhost:3000](http://localhost:3000). The documentation covers [every environment variable](https://docs.skysend.app/user-guide/configuration/environment-variables), [reverse proxies](https://docs.skysend.app/user-guide/self-hosting/reverse-proxy) and [S3 storage](https://docs.skysend.app/user-guide/configuration/s3). Images are built for AMD64 and ARM64.
The [CLI client](https://docs.skysend.app/user-guide/client-cli/) installs with one line, on Linux and macOS:
```bash
curl -fsSL https://skysend.app/install.sh | sh
```
On Windows, in PowerShell:
```powershell
irm https://skysend.app/install.ps1 | iex
```
## 💖 Sponsors
SkySend is free and open source. [Sponsoring it](https://github.com/sponsors/Skyfay) keeps it that way, and from $15 a month or $100 once your name shows up here by itself.
### One-time Sponsors
🏆 Patrons · $500 once
Kay van Aarssen
## 🛠️ Contributing
Pull requests go into the `dev` branch, never into `main`. [CONTRIBUTING.md](CONTRIBUTING.md) explains the setup and the workflow, and the [Developer Guide](https://docs.skysend.app/developer-guide/) the architecture, the crypto library and the tests. Please read [PHILOSOPHY.md](PHILOSOPHY.md) before proposing a feature.
## 💬 Community & Support
- 💬 **Discord**: [dc.skyfay.ch](https://dc.skyfay.ch)
- 🐛 **Issues**: bugs and feature requests on [GitHub Issues](https://github.com/Skyfay/SkySend/issues)
- 📧 **Support**: [support@skysend.app](mailto:support@skysend.app)
- 🔒 **Security**: report vulnerabilities privately as described in [SECURITY.md](SECURITY.md), never in a public issue
## 🤖 AI Development Transparency
The architecture, the cryptographic design, the technology stack and the feature specifications of SkySend were designed and directed by a human system engineer. The code is written by AI coding agents that follow those specifications and the guidelines of the project. Every feature is tested by hand, backed by unit tests with coverage tracking, CodeQL and security audits run by AI agents. End-to-end tests run the production build in Chromium, Firefox and WebKit on every pull request that touches the app, also behind Caddy and Nginx with HTTPS, and fail it when a key, a filename or any content reaches the server.
A formal security audit by an external firm has not been done yet. Independent security researchers have reviewed parts of the code and reported vulnerabilities privately. Every report was fixed in a release and published as an advisory that credits the reporter, see [Security Advisories](https://github.com/Skyfay/SkySend/security/advisories). The crypto design is [publicly documented](https://docs.skysend.app/developer-guide/crypto/) to make a full review easy. If you review code or work in security, your findings are very welcome, see [SECURITY.md](SECURITY.md) for how to report them.
## 📝 License
[GNU Affero General Public License v3.0](LICENSE). Any hosted instance must release its source code.
