** End to end encryption ** - AES-256-GCM streaming encryption, 64KB record blocks - HKDF-SHA256 key derivation supports domain isolation keys (fileKey, metaKey, authKey) - Zero knowledge--The encryption key only exists in the URL fragment (#) and never leaves the browser - Argon 2id password protection through WASM (resistance to memory hard attacks, resistance to GPU attacks) ** Upload and share ** - Drag-and-drop upload-supports files and folders - Multiple file upload-up to 32 files at a time, and the client uses fflate to package them into zip - Folder Upload-Upload entire directories via folder selector - Configurable expiration date--custom download limit and expiration time - Password protection (optional)--Resist GPU key derivation - Share links--copy and share with one click ** Encrypted notes ** - Text notes--Share encrypted text fragments and support optional Markdown rendering (GFM support + real-time preview) - Password sharing-Store multiple passwords, support separate mask display, light and dark switching, copy button and built-in password generator - Code snippets-Share code with syntax highlighting (automatically recognized in 22 languages) and line numbers - Markdown--Write and preview Markdown notes, fully support GitHub style Markdown - SSH key-Generate Ed25519 or RSA key pair in your browser, or paste an existing key and share it as an encrypted note - Burn after reading-Notes are automatically destroyed after a single review - View Limit-The maximum number of views can be configured (including unlimited) ** OIDC / SSO certification ** - Optional SSO-Limit uploaders by connecting to any OIDC-compatible identity provider - Support providers-built-in PocketID, Authentik, Keycloak, and presets from any universal OIDC provider - Refined protection-You can log in independently through `OIDC_PROTECT_FILES` / `OIDC_PROTECT_NOTES` before uploading files and/or creating notes - Downloads are always open-certification only applies to upload operations, consistent with zero-knowledge design - Stateless sessions-Sign JWT sessions without database changes required - CLI support--When a server requests login, CLI will automatically open a browser to login; each server's token will be cached in `~/.config/skysend/` - PKCE process--All clients use authorization code + PKCE mode ** Upload dashboard ** - No account required-upload and note history stored locally in IndexedDB - Real-time status-downloads/views, remaining downloads/views, expiration countdown - Filtering and management-Filter by file or note, re-copy sharing links, or delete entries - Automatic cleanup-Automatic removal of expired items **ˇ S3 storage support ** - Compatible with S3-optional backend, supporting Cloudflare R2, AWS S3, MinIO, Hetzner, Wasabi, etc. - Direct download-Provide files via pre-signed URL (valid for short periods, enforced expiration and download limit) - Adjustable performance-configurable chunk size and upload concurrency ** Use Docker immediately * - Single container deployment-run through docker compose up -d - Multi-architecture-supports AMD64 and ARM64 mirroring - Health check--Built-in health check endpoint `/api/health` - Configurable UID/GID-Support `PUID`/`PGID` to correctly set volume permissions - Elegant stop-ability to cleanly process SIGTERM signals ** Client CLI** - Cross-platform-Provide pre-compiled binaries for Linux, macOS, and Windows (compiled using Bun) - End-to-end encryption-same AES-256-GCM encryption as Web client - `skysend upload <file...>` --Upload single or multiple files with progress bar - `skysend download<url>` --Download and decrypt files - `Skysend note <text>` --Create encrypted notes (text, password, code, markdown, sshkey) - `skysend note:view<url>` --View encrypted notes - `Skysend update` --Self-update from GitHub Releases, including checksum verification - `skysend auth login` --Log in to an OIDC-protected server - `skysend auth logout` --Remove stored session tokens - `skysend auth status` --Displays the current session status - Scripting-supports the `--json` flag to output machine-readable content - WebSocket and HTTP-the same dual transport channels as Web clients ** ˇ Manage CLI** - `skysend-cli list` --Display current valid uploads - `skysend-cli delete<id>` --Delete an upload - `skysend-cli stats` --Storage overview - `skysend-cli cleanup` -triggers manual cleanup - `skysend-cli config` --Display current configuration ** Other characteristics ** - Multi-language-automatically detects browser language and returns to English - Dark mode-automatically follows operating system settings - Current limit--based on sliding window, per-IP limit - Upload quota-privacy friendly, based on HMAC hashed IP and daily key rotation - Responsive-Support mobile and desktop
