Encrypted File Transfer — Send Large Files by Link
Send large files up to 2GB free with a link. Files are encrypted in your browser before upload, so we can't read them. Recipients need no account; links last 72h.
About this tool
Wrklyst's file transfer sends a file of up to 2 GB as a link, and encrypts it in your browser before a single byte is uploaded. The key that unlocks it is generated on your machine and travels in the part of the link after the # — the fragment, which browsers never include in a request. That is not a policy, it is how the web works: our servers receive the file, cannot decrypt it, and hold no key to hand over to anyone who asks for one. The file name is encrypted too, because a name like "redundancy-consultation-final.xlsx" gives away most of what the sender was protecting. Recipients need no account and nothing installed — they open the link, the file decrypts in their own browser, and it downloads. Links expire after 72 hours and the file is deleted from storage. Designers handing over video exports, accountants sending payroll files and anyone who has watched a 900 MB attachment bounce off a mail server all use it for the same reason: it moves a big file to one person without leaving a readable copy anywhere.
How to Send a File Securely
- 1
Drop in any file up to 2 GB — a video, a design file, a zipped folder, a database dump. There is no file-type restriction, because the contents are never inspected.
- 2
A fresh AES-256 key is generated in your browser and the file is encrypted chunk by chunk before anything is uploaded. On a large file you will see encryption finish first and the upload start second; that order is the entire security model.
- 3
Copy the link, or open your mail client with it prefilled. Keep it whole — everything after the # is the key, and some chat apps truncate there. Your recipient opens it, the file decrypts in their browser, and it saves to their machine.
Why Send Files with Wrklyst
- We Genuinely Cannot Read What You Send
- Most transfer services promise not to look at your files. This one is unable to. Encryption happens in your browser and the key never leaves it, so what arrives in our storage is ciphertext. A subpoena, a breached bucket and a curious employee would all yield the same thing: bytes that cannot be turned back into your file.
- No Account for the Person Receiving
- Your recipient clicks the link and downloads. No sign-up wall, no app to install, no ten-second countdown, no advert dressed up as a download button. Sending needs a free account so every transfer has an owner and can be revoked; receiving never does.
- Encrypted File Names, Not Just Contents
- Services that encrypt the file but store its name in plain text leak most of the story anyway. Here the name is ciphertext in our database like everything else, which means even our own support tools cannot tell you what a given transfer contains.
- It Deletes Itself
- Links stop working after 72 hours and a scheduled job removes the file from storage, so retention is a mechanism rather than a promise. You can also revoke a transfer the moment you realise it went to the wrong person.
- 2 GB Per File, No Adverts
- The same free ceiling as WeTransfer, without the interstitial ads, the email-capture step, or the upsell between you and your download.
When to Use an Encrypted Transfer
- Video and design files too big to email
- A 900 MB export bounces off every mail server. Send a link instead and the recipient downloads at their own pace, without you provisioning a shared folder.
- Documents you would not put in a shared drive
- Contracts, payroll spreadsheets and medical records, moved without creating a readable copy on infrastructure you do not control.
- One-off handovers to a client
- Nothing for them to sign up for, nothing for you to remember to delete afterwards, and the link cleans itself up in three days.
- Sending to someone outside your organisation
- Corporate file shares assume the recipient has an account on your systems. A link assumes only that they have a browser.
How It Compares
| Method | Verdict | What that means |
|---|---|---|
| WeTransfer | Polished, but they hold a readable copy | 2 GB free and a genuinely good experience, behind adverts and an email step. Files are stored in a form WeTransfer can read, so their privacy commitment is a policy rather than a technical property. |
| Google Drive / Dropbox links | Convenient, permanent, and readable | Fine for ongoing collaboration, poor for handing over one sensitive file: the copy persists until you remember to delete it, the provider can read it, and the recipient is often pushed toward an account. |
| Email attachment | Free, tiny, and stored forever | Most servers reject anything past 25 MB, and what does get through sits in two mailboxes and their backups indefinitely, readable by both providers. |
| Wrklyst File Transfer | Encrypted before upload, expires by itself | 2 GB per file, end-to-end encrypted with the key never reaching us, encrypted file names, no recipient account, no adverts, automatic deletion after 72 hours. The honest trade-off: because we cannot read your file, we cannot scan it for malware, preview it, or recover it if you lose the link. |
Tips for Sending Files Securely
- Send the link and the heads-up through different channels — the link by email, a nudge by phone. Anyone who intercepts only one of them has nothing.
- Paste the link somewhere that will not mangle it. A few chat clients treat the # as the end of a URL, and a link without its fragment is permanently dead.
- Zip a folder before sending rather than transferring files one at a time; one link is easier for your recipient to keep track of and expires as a unit.
- Revoke the transfer as soon as your recipient confirms they have it, instead of waiting out the 72 hours.
- For very large files, keep the tab open until the upload bar completes — encryption and upload both happen in that tab, and closing it cancels the transfer.
Frequently asked questions
Can Wrklyst see my files?
No — and not as a promise, but as a property of how it is built. Your browser generates an AES-256 key, encrypts the file with it, and uploads only the result. The key is placed in the link after the # symbol, and browsers never transmit that fragment to a server. We hold ciphertext and no key. If our storage were breached tomorrow, the attacker would end up with exactly what we have: bytes nobody can turn back into your file.
What happens if I lose the link?
The file becomes unrecoverable. This is the direct cost of the design: the key exists only inside that link, so losing it means nobody can decrypt the file and we cannot help you. Keep the whole link, including everything after the #. Some messaging apps and email clients truncate at that character, so paste it somewhere it will survive intact.
How big a file can I send?
Up to 2 GB per file. The ceiling comes from the browser rather than from our storage: encryption happens inside your tab, and past that size the memory and time required stop being reasonable on an ordinary laptop or phone. Each account can send up to 5 GB in any 24-hour window, and expired transfers free that allowance back up automatically.
How long does a link last?
72 hours. After that the link stops working and a scheduled job deletes the file from storage. You can also revoke a transfer yourself at any point before it expires, which removes the file immediately.
Does the person receiving the file need an account?
No. Anyone with the link can open it, with no account, no app and no email address required. Sending does need a free account — that is what gives every uploaded file an owner, keeps anonymous abuse off the service, and lets you revoke a transfer later.
Do you scan files for viruses?
No, and that follows directly from the encryption. We cannot read your file, so we cannot inspect it either. Treat a transfer link the way you would treat any file from another person: trust the sender, not the service. If server-side malware scanning matters more to you than privacy, use a tool that can read your files — but be clear that it can read your files.
Is this actually different from a password-protected ZIP?
The cryptography is comparable; the failure modes are not. A password-protected ZIP is only as strong as a password a human chose and then usually sends through the same channel as the file. Here the key is 256 random bits, generated by your browser, never typed and never reused — and the file is already encrypted before it reaches anyone else's disk.