- Your device
- Encrypted storage
- Their device
Encryption happens before upload
The website encrypts your file and its filename with AES-256-GCM using your browser’s Web Crypto API. A fresh random key is created for every share. The server receives encrypted bytes, encrypted metadata and the hashes of access and revocation tokens.
The code is the key
The 32-character access code contains the file identifier and 120 bits of random key material. HKDF derives the encryption key and a separate download token. The full share link includes the key after #, a URL fragment browsers do not send in HTTP requests.
Expiry and revocation limit access
Choose one hour, 24 hours or seven days. Expired files stop being available immediately and are removed during regular cleanup. You can revoke a share sooner using the button shown after upload or the revoke link in your optional receipt.
One opening, when you want it
Burn after first view permits one download from Oveile, then deletes the stored share. The recipient can still save, copy or capture what they receive. This option cannot erase a copy already held on another device.
Optional emails contain no decryption key
You can request a receipt, notify a recipient or ask for an opened notice. A recipient email contains a link without its decryption key. Send the access code separately. Email addresses are used to provide the notifications you request.
Know the limits
Anyone holding the full share link or code can decrypt the file. A compromised device or browser can expose it. Oveile cannot recover a lost code or prevent recipients from keeping a copy. Keep a separate original if you need one.
A clear exception for API integrations
The website and client-side API mode encrypt before upload. The optional hosted-encryption API accepts plaintext over TLS, so the server sees that file during the request before encrypting it. Use client-side encryption when the server must never receive the original.
Partners & API