Browser encryption
Browser-encrypted file sharing means the file is protected on the sender device before upload instead of relying only on transport or storage-layer encryption.
The browser creates the encrypted file package locally with chunked XChaCha20-Poly1305 authenticated encryption before upload. The service stores encrypted file data and coordinates delivery rather than treating file bodies as ordinary readable application data.
Encryption at rest protects disks, buckets, databases, and backups. Browser encryption moves the protection boundary earlier, before the application stores the file.
For sensitive documents, logs, contracts, financial files, HR packets, and client records, the key question is whether the service needs readable file contents during normal delivery.
Browser encryption does not erase operational metadata. A delivery service may still process account details, recipients, transfer size, timestamps, status, and abuse-prevention signals.
Secure links are useful when a recipient should not need an account, but they are lower assurance than account-bound access because the full active link can be forwarded.
ZipPigeon is useful when a sensitive file needs to reach a specific person without becoming an email attachment or a standing shared-folder permission.
The normal delivery model is designed so stored file data is encrypted and raw file keys are not sent to the server. Operational metadata is still processed.
Operational metadata such as account information, recipient information, timestamps, file size, delivery state, and audit events may be processed.
Use ZipPigeon when a file needs to reach the right person without becoming another attachment or shared folder to clean up later.
Open signed-in sender