Secure Files

Send one file as an encrypted link that expires, can allow one download and can need a passphrase.

A secure link lets someone download one file from Secure Files without a Magpie account. The file stays encrypted on Magpie, and the recipient's browser decrypts it with a secret in the link that Magpie never receives. You choose when the link expires, whether it allows one download and whether it needs a passphrase, and you can revoke it at any time.

Get started free

Create a link

Share securely is in a file's More menu in Secure Files. Each link is for one file, and a file can have several links with different settings.

  1. Choose when it expires

    A link can expire in 1 hour, 1 day, 7 days or 30 days. A new link expires after 7 days unless you choose another time.

  2. Choose the download limit

    A link allows Unlimited downloads, or One download.

  3. Add a passphrase

    Tick Require a passphrase to make the recipient enter one as well as open the link. The passphrase is not part of the link, so send it separately, such as by phone or in another app.

  4. Copy the link

    Create secure link shows the complete link with Copy link. Magpie shows it only once, because Magpie does not have the secret in it, so copy it before closing the drawer.

How the link keeps the key from Magpie

Your browser makes a random secret for the link and uses it to encrypt the file's key. The secret goes after the # in the link's address. Browsers do not send that part of an address to a website, so the recipient's browser reads it and Magpie never receives it.

The rest of the address holds a separate random link ID. Magpie stores a hash of the ID and uses it to find the encrypted file and enforce the expiry, the download limit and revocation. With a passphrase, the recipient's browser also needs the passphrase to decrypt the key, using Argon2id. Magpie stores the encrypted file and the encrypted key, never the link secret, the passphrase, the file's key or the readable file.

The passphrase is checked in the recipient's browser, so Magpie cannot limit wrong guesses: anyone who has the complete link can try passphrases against it. Use a long passphrase that you do not use anywhere else.

What the recipient sees

  1. Secure file shared with you

    The recipient opens the link in a browser and does not need a Magpie account. If the link has a passphrase, they enter it and choose Unlock file.

  2. Download and decrypt

    The page shows the file's name, size and expiry date. Download and decrypt downloads the encrypted file and decrypts it in the recipient's browser.

  3. The page locks

    After a period without activity, the page locks and clears the key. Opening the original complete link again opens the file, while the link is still active.

One download, revoking and Trash

What one download counts
A one-download link stops accepting new downloads when a recipient starts one, and that transfer can still finish. It counts the download Magpie authorized, not whether the recipient opened or saved the file. An interrupted transfer still uses it, so create a new link if a download did not finish.
External links
Share securely lists the file's links, each with when it was created, when it expires, how many downloads it has had, and whether it is active, expired, revoked or at its download limit.
Revoke
Revoke beside a link stops access at once, including a transfer in progress.
Moving the file to Trash
Moving a file to Trash revokes all of its links, and they stay revoked if the file is restored.
Copies already downloaded
Revoking or expiry stops new downloads. Neither removes a copy someone has already downloaded, and the encrypted file stays in your Secure Files.

What Magpie can see of a link

Magpie can see that a file has links, when each expires, how many downloads each has authorized, and when and from which network address a link is used. It cannot see the link secret, the file's name or its contents.

Magpie limits how many failed link lookups and download starts it accepts from one network address. The link's page asks search engines not to index it and tells browsers not to cache it.

Send a file with a secure link.

Create a Magpie account, set up Password Vault, upload the file to Secure Files and choose Share securely.

Create account