Secure Files

Store files that are encrypted in your browser before Magpie receives them.

Secure Files encrypts each file, its name and the names of your folders in your browser, with the key you set up in Password Vault. Magpie stores the encrypted data, and only your Password Vault password, entered in your browser, opens it. You organize the files in folders, search their names, preview images and restore files from Trash, all on names and contents decrypted in your browser.

Get started free

What is encrypted, and with which key

When you upload a file, your browser makes a new random key for it and encrypts the file in chunks with XChaCha20-Poly1305, using the libsodium library. The file's name and type, and the name of every folder, are encrypted too. The file's key is then encrypted with your Password Vault key, so Magpie stores the encrypted file, its encrypted name and the encrypted key, never the readable file or a usable key.

Your Password Vault key is decrypted in your browser with your Password Vault password, which is never sent to Magpie. A copy of Magpie's database alone does not contain what is needed to decrypt your files.

Password Vault, unlocking and locking

Secure Files has no password of its own: it uses the encryption key from Password Vault, so Password Vault is set up first.

Unlock
Enter your Password Vault password. If Password Vault is already unlocked in the same browser tab, Secure Files opens without asking, and the tab stays unlocked when you reload the page.
Lock
Secure Files locks after the time without activity set in Password Vault (15 minutes unless you change it), or when you choose Lock. Locking clears the keys from the page and deletes nothing. It also stops an upload or download in progress.
A forgotten password
The recovery key from Password Vault setup lets you choose a new Password Vault password, and Secure Files will open with the new one. Magpie has neither the password nor the recovery key, so it cannot open your files without one of them.

Upload, download and preview

  1. Upload

    Choose one or more files, each up to 2 GB. They will be encrypted and uploaded one at a time, in chunks, into the folder that is open. If one file cannot be uploaded, Secure Files names it and continues with the others.

  2. Download

    Choose a file's name to download it and decrypt it in your browser. Browsers that have a file save picker write each decrypted chunk to the file you choose; other browsers put the whole file together in memory first, so a large download uses more memory.

  3. Image previews

    PNG, JPEG, GIF, WebP and AVIF images up to 10 MB show a preview in the list. Each preview is downloaded and decrypted in your browser when the list opens, and discarded when Secure Files locks.

  4. PDFs

    Open in PDF Editor decrypts a PDF in your browser and opens it in PDF Editor, which keeps the decrypted copy in that browser's storage while you edit. A finished PDF can be saved back to Secure Files, encrypted before upload, or replace the original, which moves to Trash.

Folders, search and Trash

Folders
Create folders inside folders. The heading above the list shows where you are, and each part of it opens that folder. Folder names are encrypted, so your browser, not Magpie, stops two folders with the same name in one place.
Move and rename
Move a file to another folder from its More menu. Rename changes the file's encrypted name and leaves its encrypted contents as they are.
Search
Search covers file and folder names in every folder. It runs on the names decrypted in your browser, and the search text is not sent to Magpie.
Trash
Move to Trash takes a file out of Files and revokes its secure links. Restore returns it to its folder, or to Files when that folder has been deleted. Trash is not emptied automatically.
Delete forever
Delete forever, in Trash, removes the encrypted file and its encrypted key from active storage, and the file cannot be restored. Deleting a folder deletes the folders inside it and moves their files to Trash.

Storage and plans

Secure Files is on every plan. It counts toward your Personal plan's storage, together with images, podcast episodes, recordings and other stored files, and the bottom of the file list shows how much Secure Files uses and how much of the plan's storage is used in total.

Files in Trash and unfinished uploads still use storage until you choose Delete forever. An upload that would go over the plan's storage is not started.

What Magpie can see

Magpie can see which account owns each file, file sizes, which folder each file and folder is in, timestamps, which files have secure links, download counts and access patterns, including the requests for image previews when the list opens. It cannot read file contents, file names, file types or folder names, and it cannot scan encrypted contents for malware. After Delete forever, encrypted data may remain in infrastructure backups for a time.

Secure Files is personal: the files belong to your account, not to a team, and the same files open whichever team you have selected. To give someone a file, send it with a secure link.

Store your first encrypted file.

Create a Magpie account, set up Password Vault and save its recovery key, then open Secure Files and choose Upload.

Create account