Encrypt files into a .tspk package
Pick files, choose a random key or a passphrase, and download one authenticated package. File names, sizes and your note are encrypted inside it.
Files to lock
Package options
What the package reveals
Anyone who gets the .tspk file, with or without the key, can see:
- The package file name (random)
- Its total size, about 2.09 KiB, which roughly reveals how much is inside
- Format version, profile, that a random key was used
Encrypted and hidden without the key: file names, number of files, individual sizes, types, checksums, your note.
What goes into a package
A 76-byte public header, then your files and an encrypted file list sealed with AES-256-GCM. The header is authenticated too, so changing the version, profile or work factor breaks the package instead of weakening it.
Each package gets its own random salt and nonce. The encryption key is derived with HKDF-SHA256 from your 256-bit key (or from PBKDF2 over your passphrase), along with a key commitment that lets the decoder reject a wrong key up front.
Sizes and memory
The whole profile accepts up to 25 MiB, the size this version was designed and tested for. The chunked profile goes to 512 MiB, but your browser still holds the full package in memory, so phones may struggle well before that. The memory estimate under the file list is a rough guide, not a measurement.
Your original files are only read, never changed. Cancelling discards everything that was produced.
After you encrypt
Keep the key apart from the package. If you send both in the same email, anyone who reads that email can open the files. Recipients need nothing but a browser: they open tinyshare.com/decrypt, or the offline decoder if they prefer not to rely on this website.
Questions
Random key or passphrase: which should I use?
A random key (TSK1-…) has 256 bits of strength and cannot be guessed, but it is long, so you will copy or download it. A passphrase is easier to say over the phone, but anyone holding the package can try guesses offline without limits, so it is only as strong as the passphrase is long and random.
What is the difference between the whole and chunked profiles?
The whole profile encrypts everything in one AES-256-GCM operation and is limited to 25 MiB of input. The chunked profile splits the payload into 1 MiB chunks, each with its own nonce, counter and final-chunk marker, so reordering, dropping or truncating chunks is detected. It allows up to 512 MiB, but memory use is still roughly twice the input because the browser holds the package in memory.
Should I turn on compression?
Compression helps text, CSV and logs, and does nothing for photos, video or zip files. It runs on your files before encryption and only in the whole profile. Compressed size can hint at how repetitive the content is; turn it off if that matters to you.
Can I make separate packages for different people?
Yes. Choose more than one recipient and TinyShare makes an independent package with its own key for each. This is not access control: anyone who holds a package and its key can open it.