skyfay/skysend repository overview

⁠SkySend

End-to-end encrypted, self-hostable file and note sharing service built for speed and security.

Website⁠ • Documentation⁠ • Quick Start⁠ • Public Instances⁠ • Changelog⁠ • Roadmap⁠

⁠What is SkySend?

SkySend is a minimalist, self-hostable file and note sharing service with end-to-end encryption. Files and notes are encrypted entirely in the browser using AES-256-GCM before they ever reach the server - the server stores only encrypted blobs and never has access to the decryption key. No accounts, no tracking, no analytics just Open Source.

This Project is community ready to get self hosted and for those who don't want or could not host their own instance, there are public instances available. If you want to make the internet safer, you can host your own instance and add it to the public instances list by creating a Issue with your instance details or a PR Instances List⁠.

Inspired by timvisee/send⁠ (the community fork of Mozilla Send) and PrivateBin⁠, SkySend is built from scratch with higher security standards, more features, and a minimal, maintainable codebase.

We used a leightweight tech stack (Node.js, Hono, Vite, React) and modern security practices to create a fast, secure, and user-friendly experience. Check out our Benchmarks⁠.

⁠✨ Features

⁠🔒 End-to-End Encryption

• AES-256-GCM streaming encryption with 64KB record size
• HKDF-SHA256 key derivation with domain-separated keys (fileKey, metaKey, authKey)
• Zero Knowledge - the encryption key lives only in the URL fragment (#) and never leaves the browser
• Argon2id password protection via WASM (memory-hard, GPU-resistant)

⁠📁 Upload & Sharing

• Drag & Drop - files and folders
• Multi-File Upload - up to 32 files per upload, zipped client-side with fflate
• Folder Upload - entire directories via the folder picker
• Configurable Expiry - choose download limits and expiration times
• Password Protection - optional, GPU-resistant key derivation
• Share Links - copy and share with one click

⁠📝 Encrypted Notes

• Text Notes - share encrypted text snippets with optional Markdown rendering (GFM support with live preview)
• Password Sharing - store multiple passwords with individual masked display, reveal toggles, copy buttons, and a built-in password generator
• Code Snippets - share code with syntax highlighting (43 auto-detected languages) and line numbers
• Markdown - write and preview Markdown notes with full GitHub Flavored Markdown support
• SSH Keys - generate Ed25519 or RSA key pairs in the browser, or paste existing keys, and share them as encrypted notes
• Burn After Reading - notes that self-destruct after a single view
• View Limits - configurable maximum number of views (including unlimited)

⁠👥 OIDC / SSO Authentication

• Optional SSO - restrict who can upload by connecting any OIDC-compliant provider
• Supported Providers - built-in presets for PocketID, Authentik, Keycloak, and any generic OIDC provider
• Granular Protection - independently require login for file uploads and/or note creation via OIDC_PROTECT_FILES / OIDC_PROTECT_NOTES
• Downloads always public - authentication only gates the upload action, consistent with the zero-knowledge design
• Stateless sessions - signed JWT cookies, no database changes required
• CLI support - the CLI automatically opens a browser for login when the server requires it; tokens are cached per-server in ~/.config/skysend/
• PKCE flow - uses authorization code grant with PKCE for all clients

⁠📊 Upload Dashboard

• No Account Needed - upload and note history stored locally in IndexedDB
• Live Status - download/view counts, remaining downloads/views, expiry countdowns
• Filter & Manage - filter by files or notes, re-copy share links, or delete entries
• Auto-Cleanup - expired entries removed automatically

⁠☁️ S3 Storage Support

• S3-Compatible - optional backend for Cloudflare R2, AWS S3, MinIO, Hetzner, Wasabi, and more
• Direct Downloads - serve files via presigned URLs (short-lived, enforces expiry and download limits)
• Tunable Performance - configurable part size and upload concurrency

⁠🐳 Docker Ready

• Single Container - deploy with docker compose up -d
• Multi-Arch - AMD64 and ARM64 images
• Health Checks - built-in health endpoint at /api/health
• Configurable UID/GID - PUID/PGID for proper volume permissions
• Graceful Shutdown - handles SIGTERM cleanly

⁠💻 Client CLI

• Cross-platform - pre-built binaries for Linux, macOS, and Windows (compiled with Bun)
• End-to-end encrypted - same AES-256-GCM encryption as the web client
• skysend upload <files...> - upload single or multiple files with progress bar
• skysend download <url> - download and decrypt files
• skysend note <text> - create encrypted notes (text, password, code, markdown, sshkey)
• skysend note:view <url> - view encrypted notes
• skysend update - self-update from GitHub Releases with checksum verification
• skysend auth login - authenticate against an OIDC-protected server
• skysend auth logout - remove the stored session token
• skysend auth status - show the current session state
• Scriptable - --json flag for machine-readable output
• WebSocket & HTTP - same dual transport as the web client

⁠🛠️ Admin CLI

• skysend-cli list - show active uploads
• skysend-cli delete <id> - delete an upload
• skysend-cli stats - storage overview
• skysend-cli cleanup - trigger manual cleanup
• skysend-cli config - show current configuration

⁠🌍 Additional

• Multi-Language - automatic browser language detection with English fallback
• Dark Mode - with automatic OS detection
• Rate Limiting - sliding window, per-IP
• Upload Quota - privacy-preserving with HMAC-hashed IPs and daily key rotation
• Responsive - mobile and desktop

⁠🚀 Quick Start

Supported Platforms: AMD64 (x86_64) • ARM64 (aarch64)

# docker-compose.yml
services:
  skysend:
    image: skyfay/skysend:latest
    container_name: skysend
    restart: always
    ports:
      - "3000:3000"
    volumes:
      - ./data:/data
      - ./uploads:/uploads
    environment:
      - BASE_URL=http://localhost:3000
      # All environment variables: https://docs.skysend.app/user-guide/configuration/environment-variables
      # There are a lot of customization options available, so make sure to check the documentation for more details.

docker compose up -d

Open http://localhost:3000⁠ in your browser.

📖 Full installation guide: docs.skysend.app/user-guide/getting-started⁠

⁠💻 Client CLI

Upload and download files from the terminal with the same end-to-end encryption as the web interface.

Install (Linux/macOS):

curl -fsSL https://skysend.app/install.sh | sh

Install (Windows PowerShell):

irm https://skysend.app/install.ps1 | iex

Usage:

# Set your server
skysend config set-server https://your-instance.com

# Upload a file
skysend upload ./document.pdf

# Upload with password and expiry
skysend upload ./secret.zip --password --expires 1h --downloads 5

# Download a file
skysend download https://your-instance.com/file/abc123#secret

# Create an encrypted note
skysend note "This is a secret message" --type text --expires 24h

# Login to an OIDC-protected server
skysend auth login

# Self-update
skysend update

📖 Full CLI documentation: docs.skysend.app/user-guide/client-cli⁠

⁠🔒 Security Design

The complete crypto design is publicly documented at docs.skysend.app/developer-guide/crypto⁠.

⁠🛠️ Tech Stack

⁠📚 Documentation

Full documentation is available at docs.skysend.app⁠:

• User Guide⁠ - Installation, configuration, usage
• Developer Guide⁠ - Architecture, crypto design, contributing
• Changelog⁠ - Release history
• Roadmap⁠ - Planned features

⁠🛠️ Development

# Clone & install
git clone https://github.com/Skyfay/SkySend.git && cd SkySend
pnpm install

# Start dev server (all packages in parallel)
pnpm dev

# Run all checks (lint, typecheck, tests)
pnpm validate

For contribution guidelines, see the CONTRIBUTING.md⁠.

⁠💬 Community & Support

• 💬 Discord: Join our community at https://dc.skyfay.ch⁠
• 📝 Documentation: Full guides at docs.skysend.app⁠
• 🐛 Issues: Report bugs or request features on GitHub Issues⁠
• 📧 Support: General questions and support via [email protected]⁠
• 🔒 Security: Report vulnerabilities responsibly via [email protected]⁠ (please do not open public issues for security reports)

⁠🤖 AI Development Transparency

⁠Architecture & Concept

The system architecture, cryptographic design, strict technology stack selection, and feature specifications for SkySend were entirely conceptualized and directed by a human System Engineer to solve real-world privacy challenges in file sharing.

⁠Implementation

The application code was generated by AI coding agents following detailed architectural specifications and coding guidelines. All features were manually tested for correctness, stability, and real-world reliability. Automated unit tests (Vitest) with coverage tracking via Codecov, CodeQL static analysis, and security audits complement the manual QA process.

⁠Open for Review

SkySend is thoroughly tested and used in production, but a formal manual security audit by an external developer has not yet been completed. The entire cryptographic design is publicly documented⁠ to facilitate independent review. If you are a software developer or cybersecurity professional, your expertise is highly welcome! We invite the open-source community to review the code, submit PRs, and help us elevate SkySend to a fully verified standard.

⁠📝 License

GNU Affero General Public License v3.0⁠ - Any hosted instance must release its source code.