Lock files into a package only your key opens
Encryption happens on this device. Nothing is uploaded: you send the package and the key yourself, through two different channels.
Files to lock
Package options
What the package reveals
Anyone who gets the .tspk file, with or without the key, can see:
- The package file name (random)
- Its total size, about 2.09 KiB, which roughly reveals how much is inside
- Format version, profile, that a random key was used
Encrypted and hidden without the key: file names, number of files, individual sizes, types, checksums, your note.
Package
What TinyShare does not do
These are deliberate. A tool that runs only in your browser cannot keep these promises, so it does not make them.
No links that expire
There is no hosted copy to expire. A delete-after date inside a package is a request, not a lock.
No download limits
Anyone holding the package and key can open it as often as they like, on any device.
No take-backs
Once someone has decrypted a file, nothing can delete their copy. Re-packaging with a new key only protects future copies.
No sender identity
A package that opens proves it was made with that key, not who made it. Anyone with the key could have.
No safety scan
Encrypted malware is still malware. Files are handed over as downloads and never opened in the page.
No recovery
TinyShare never sees your key. Lose it and the package stays locked for good.
How to send a file safely
- Choose files. They are read by this page only. Check the list: names, sizes and any warnings appear before anything is encrypted.
- Encrypt. TinyShare makes a fresh 256-bit key, encrypts with AES-256-GCM, then re-opens the package to check it.
- Save the key. Copy it or download the key file, and confirm you have kept it. The package download unlocks after that.
- Send the two pieces apart. Package by email or chat, key by phone or a different app. The recipient opens it at /decrypt or with the offline decoder.
Check a package before you trust it
The package inspector shows exactly which bytes anyone can read without the key, and, with the key, the authenticated file list without extracting anything.
Know what is promised
The security page documents the container format, the threat model, and the fact that no independent audit has been done yet.
Questions
Does TinyShare upload my files?
No. TinyShare is a static web page. Files are read and encrypted by your browser and the package is handed back to you as a download. There is no upload endpoint, no account and no server copy of your files or keys.
So how does the other person get the file?
You send the .tspk package through any channel you already use (email attachment, chat, USB stick, cloud drive) and send the key through a different one (a phone call, a messenger, in person). Someone who intercepts only one of the two learns nothing about the contents.
Can I set a link to expire or limit downloads?
No, and we will not pretend to. A browser-only tool has nowhere to enforce expiry, count downloads or revoke a file someone already has. You can add an advisory "please delete after" date inside the package, but it is a request, not a lock.
What happens if I lose the key?
The package cannot be opened. TinyShare never sees the key and has no recovery service. Keep a copy of the key somewhere safe before you send anything.
Is TinyShare audited?
Not yet. It uses standard Web Crypto primitives (AES-256-GCM, HKDF-SHA256, PBKDF2-SHA256) in a documented container format with known-answer and tamper tests, but no independent cryptographic review has been done. The security page lists exactly what is and is not claimed.