Sicherer Datenaustausch.
mit SecShare
Geschützter Austausch von Dateien und Dokumenten.
Your files. Your keys.
Encrypted at Rest
Every file is encrypted with XChaCha20-Poly1305 using a unique per-file key. Keys are sealed with hybrid ML-KEM-1024 + P-384 ECDH post-quantum cryptography. No plaintext ever touches storage.
PQC Transport
TLS 1.3 with SecP384r1MLKEM1024 (Level 5) hybrid key exchange — falling back to X25519MLKEM768 / SecP256r1MLKEM768 — enforced at the TCP level. ClientHello inspection rejects non-PQC connections before the handshake completes. PQC preferred on server-to-server connections too.
Encrypted Payloads
API key exchange uses ML-KEM-1024 + ECDH P-384 + SHAKE256 + XChaCha20-Poly1305. Session keys never appear in a response body at all — not in plaintext, and not wrapped.
Full Audit Trail
Every login, upload, download, and admin action is logged with structured JSON. IPs hashed, emails vault-sealed, zero plaintext in audit records.
Self-Hosted Control
Your server, your data. No third-party cloud. Store on local disk, NAS mount, or S3-compatible bucket. Docker-ready with zero npm runtime dependencies.
Folder Drops
Drag entire folder trees. Bad file types silently skipped. Magic byte validation. Concurrent uploads with retry. Recipients browse folders or download as ZIP.
Zero-knowledge. Even from admins.
Client-Side Encryption
Files are encrypted in your browser with ML-KEM-1024 + SHAKE256 + XChaCha20-Poly1305 before they ever leave your device. The server only stores ciphertext it cannot decrypt. Only your passkey can unlock your vault.
Branded portals. For your clients.
Branded Upload Pages
Custom title, instructions, accent color, and logo per page. Your clients see your brand, not ours.
Access Control
Password protection, email-gated access with one-time codes, domain restrictions (@acme.com), or dual protection with both.
Desktop Sync
Enable sync mode for persistent mutable bundles. Customers run the sync client to keep a local folder in sync via WebSocket.
One-Code Setup
Generate an enrollment code. Customer enters it in the sync client. API key and mTLS certificates are exchanged automatically. No file transfers.
Upload Limits
Per-stash max file size, file count, bundle size, allowed extensions, and default expiry. Each portal gets its own quotas independent of global settings.
Admin Overview
Track bundle count, total bytes, and download stats per stash. View and manage all uploads from the admin panel. Delete bundles or entire stash portals.
Everything you need. Built in.
Teams
Create teams, assign roles, and isolate file access across your organization.
Bundle Protection
Password, email verification, or both. Argon2id-hashed, rate-limited, with verified audit trail of who accessed what.
Admin Dashboard
Manage users, files, bundles, and 70+ settings. Environment info, CSV exports, database backups, maintenance mode.
Webhooks & API
HMAC-SHA3-512 signed webhooks. Scoped API keys. Resource-scoped sync tokens. SSRF-safe URL validation.
Multi-Factor Auth
Argon2id passwords, WebAuthn passkeys, Google OAuth, and TOTP 2FA. All simultaneous. Account lockout after failed attempts.
Chunked Uploads
Large files auto-split into 10MB chunks. Concurrent transfer, per-file progress, pause, resume, retry.
S3 & Local Storage
Local disk, NAS, or any S3-compatible bucket. Per-file encryption at rest. Pre-signed direct downloads.
Email Notifications
SMTP or Resend API with dual failover. Upload confirmations, admin alerts, verification emails, password resets.
File Expiry
Auto-expire bundles in 1, 7, 30, or 90 days. Stale upload cleanup. Tombstone-based soft delete for sync bundles.
HermitStash Sync
A standalone desktop daemon that keeps a local folder synchronized with your server in real-time. Drop a file locally, it appears on the server. Change it on the server, it downloads automatically.
Two ways in.
All encrypted at rest. Vault uploads are end-to-end. Shareable links in seconds.
Drop Files
No login required. Files encrypted on arrival.
- Drag folders or files onto /drop
- Set expiry, password, or email restriction
- Files encrypted and stored instantly
- Share link — browse folders or download ZIP
Sign In & Upload
Passkey, password, Google, or 2FA.
- Sign in with passkey, password, or Google
- Upload from your encrypted dashboard
- Vault-encrypt files only you can decrypt
- Manage teams, users, and settings
Built to resist.
Two commands. Pick one.
Docker
Recommended- Auto-restart, health checks, log management
- Persistent volumes for data + uploads
- Environment variable overrides
- Works with Portainer, Coolify, Dokku
Bare Metal
Zero deps- No npm install — all dependencies vendored
- No build step — vanilla Node.js
- No config files — admin panel configures everything
- Node.js 24+ is the only requirement
Every platform. One image.
Kubernetes
Full manifest with namespace, PVCs, deployment, service, and ingress template.
Podman
Rootless or rootful. SELinux-ready. Auto-generates systemd units.
Proxmox / LXD
One-command LXC container or LXD/Incus system container with Docker nested inside.
Terraform
DigitalOcean droplet with firewall and optional DNS. One terraform apply.
Ansible
Playbook with Docker or native deployment modes. One command for any server.
Ubuntu / Debian
One-liner native install. Node.js 24, tmpfs, systemd service — all automated.