Why it exists

Every mainstream file-transfer service (WeTransfer and friends) uploads your data in plaintext, keeps it on their servers, wraps it in ads, and treats your files as inventory. Wormhole — built by the CryptPad team — starts from the opposite axiom: the server should be structurally unable to read what it stores. Files are encrypted with AES-128-GCM in the browser, before upload; the decryption key lives in the share link's URI fragment, which is never sent to the server; and everything expires after 24 hours. Privacy isn't a mode you enable — it's the only way it works.

Main features

• End-to-end encryption by default — AES-128-GCM applied client-side; the secret key never touches the server (it's in the #fragment of the link).
• Up to 10 GB per transfer — files ≤5 GB are stored server-side for 24 hours; larger files switch to peer-to-peer WebRTC transfer, sender page open until the recipient pulls.
• Links that expire — files are permanently deleted from the server after 24 hours; your stuff doesn't linger online forever.
• No account, no ads, no trackers — nothing to sign up for, no marketing funnel; the service is currently free while a Pro plan (bigger limits) is planned.
• Open-source clients — the app's code is GPL-3.0 on GitHub; third-party CLI clients exist in the wild.
• "Protected by Socket" — supply-chain scanning of their dependencies, a quiet but serious hygiene signal.

Who it's for

• Anyone who needs to send a big file once — the 2 GB video, the client's 6 GB asset dump — without an account on yet another service.
• People sharing anything sensitive (contracts, scans, unreleased work) who'd rather the transfer service can't read it.
• Developers and teams who want an expiring, encrypted drop that won't become a permanent link liability.
• The "Firefox Send hole" crowd: this is the closest living successor to Mozilla's beloved Send.

How it compares

• WeTransfer / Smash — smoother brand polish and longer retention options, but plaintext on their servers, ad-supported, retention as an upsell; Wormhole inverts the trust model.
• SwissTransfer — free up to 50 GB with 30-day retention; friendlier limits, but no E2EE and Swiss-law privacy instead of cryptographic privacy.
• Firefox Send (discontinued) — the spiritual ancestor with the same client-side encryption idea; Wormhole is the community continuation of that design.
• magic-wormhole (the CLI tool) — same name, different project: a server-less sender/receiver pair for terminal users; Wormhole.app is the polished browser edition.

Notes

• The 24-hour expiry is unconditional — if the recipient misses the window, you re-send; for long-lived links you need different tools.
• P2P mode for >5 GB files requires the sender's browser to stay open until the download completes.
• Security design is documented in detail (key handling in URI fragments, no server-side decryption); a public third-party audit isn't prominently advertised — read the design page and decide.
• Mobile apps are on the roadmap; the mobile web experience already works well.

Useful links

• Official site: https://wormhole.app/
• Security design: https://wormhole.app/security
• FAQ: https://wormhole.app/faq
• Source code: https://github.com/wormhole-app/wormhole
• Roadmap: https://wormhole.app/roadmap