Inspect a package
See exactly what a package reveals to anyone who holds it, byte by byte. Add the key to view the authenticated file list without extracting any files.
The inspector never decrypts unless you supply the key, and even then it only lists the files; it never offers them for download.
Why look before opening
A package someone sends you could be anything. The inspector reads only the public header, so you can see whether the file really is a TinyShare package, which version made it, and how it is locked, before you type a key into anything.
Metadata you cannot hide
Encryption hides contents, not size. Someone holding the package can tell roughly how much data is inside and, from the header, whether a passphrase was used. Choose the random package name option when encrypting to avoid leaking a file name as well. More on this in the security model.
Questions
What can someone learn from a package without the key?
The 76-byte public header: format version, profile, whether a key or passphrase was used, the passphrase work factor, a random salt and nonce, the chunk size, and a key commitment. They can also see the total package size, which roughly reveals the total size of the contents. File names, count, individual sizes, types and your note are encrypted.
What is the key commitment?
A 32-byte value derived from the key and salt. It lets the decoder reject a wrong key quickly and stops an attacker from crafting one package that decrypts differently under two keys, a known weakness of plain AES-GCM. It reveals nothing useful about a random key; for passphrases, offline guessing was already possible.
Is the manifest view the same as decrypting?
It runs the full authentication, so the file list it shows is verified, but it does not offer the files for download. Use Decrypt when you want the files.