Open and verify a package
Add the .tspk file and the key or passphrase you were given. Every byte is checked before any file is released, and files are never opened in the page.
Package
What happens when you press Decrypt
- Header check. The 76-byte header is validated first. Unknown versions, absurd work factors or impossible sizes are refused before any heavy work.
- Key check. Your key (or passphrase, through PBKDF2) is turned into a decryption key and compared with the package’s key commitment.
- Authentication. Every encrypted block is decrypted and its tag verified. In chunked packages the chunk number and a last-chunk marker are part of each nonce, so missing, repeated or reordered chunks fail.
- File list check. The encrypted file list must account for every byte: names are checked for unsafe paths, lengths must add up exactly, and per-file SHA-256 values must match.
- Release. Only then are files offered, as plain downloads. Nothing is opened or previewed in the page.
If it will not open
Check that you have the whole key, from TSK1- to the last character, or the exact passphrase including capitals and spaces. The key text has built-in check characters, so a mistyped key is reported as a typo. If the key is right and it still fails, the package was probably damaged or altered in transit: ask the sender to send it again, ideally through another channel. You can look at what the file contains without a key in the inspector.
Questions
Why does it say "could not be opened" without saying why?
AES-GCM cannot tell a wrong key apart from a damaged or altered package, and a message that guessed would give attackers a hint. TinyShare reports one generic failure and produces no files. Check that you have the right key, then ask the sender to resend the package.
Can I preview the files before downloading?
No. Files from a package can be web pages, scripts or documents with macros, and showing them inside TinyShare could run that code. They are offered as plain downloads; open them with your usual apps if you trust the sender.
Does a successful decrypt prove who sent the files?
No. It proves the package was made with this key and has not been changed since. Anyone who had the key could have made it. Confirm the sender through a channel you trust.
Can I download only some of the files?
Yes. The whole package is verified first, then you can download any subset. The verification result always describes the full package, not just the files you picked.