SecShare

Sicherer Datenaustausch.
mit SecShare

Geschützter Austausch von Dateien und Dokumenten.

ML-KEM-1024 Hybrid KEM
XChaCha20-Poly1305
PQC TLS Enforcement
ML-KEM-1024 Key Exchange
Zero-Knowledge Vault
Passkey Login
Customer Stash Portals
Desktop File Sync
WebSocket Real-Time
mTLS Client Certs
Email-Gated Access
Argon2id Auth
Zero npm Deps
Self-Hosted
ML-KEM-1024 Hybrid KEM
XChaCha20-Poly1305
PQC TLS Enforcement
ML-KEM-1024 Key Exchange
Zero-Knowledge Vault
Passkey Login
Customer Stash Portals
Desktop File Sync
WebSocket Real-Time
mTLS Client Certs
Email-Gated Access
Argon2id Auth
Zero npm Deps
Self-Hosted
Security First

Your files. Your keys.

01

Encrypted at Rest

Every file is encrypted with XChaCha20-Poly1305 using a unique per-file key. Keys are sealed with hybrid ML-KEM-1024 + P-384 ECDH post-quantum cryptography. No plaintext ever touches storage.

02

PQC Transport

TLS 1.3 with SecP384r1MLKEM1024 (Level 5) hybrid key exchange — falling back to X25519MLKEM768 / SecP256r1MLKEM768 — enforced at the TCP level. ClientHello inspection rejects non-PQC connections before the handshake completes. PQC preferred on server-to-server connections too.

03

Encrypted Payloads

API key exchange uses ML-KEM-1024 + ECDH P-384 + SHAKE256 + XChaCha20-Poly1305. Session keys never appear in a response body at all — not in plaintext, and not wrapped.

04

Full Audit Trail

Every login, upload, download, and admin action is logged with structured JSON. IPs hashed, emails vault-sealed, zero plaintext in audit records.

05

Self-Hosted Control

Your server, your data. No third-party cloud. Store on local disk, NAS mount, or S3-compatible bucket. Docker-ready with zero npm runtime dependencies.

06

Folder Drops

Drag entire folder trees. Bad file types silently skipped. Magic byte validation. Concurrent uploads with retry. Recipients browse folders or download as ZIP.

Personal Vault

Zero-knowledge. Even from admins.

Client-Side Encryption

Files are encrypted in your browser with ML-KEM-1024 + SHAKE256 + XChaCha20-Poly1305 before they ever leave your device. The server only stores ciphertext it cannot decrypt. Only your passkey can unlock your vault.

Passkey-Gated Access Touch ID, Face ID, YubiKey, or any FIDO2 authenticator to unlock
PRF Mode Derive keys from passkey PRF extension for true zero-knowledge
Key Rotation Rotate vault passkey with atomic re-encryption of all files
Customer Stash

Branded portals. For your clients.

Branded Upload Pages

Custom title, instructions, accent color, and logo per page. Your clients see your brand, not ours.

Access Control

Password protection, email-gated access with one-time codes, domain restrictions (@acme.com), or dual protection with both.

Desktop Sync

Enable sync mode for persistent mutable bundles. Customers run the sync client to keep a local folder in sync via WebSocket.

One-Code Setup

Generate an enrollment code. Customer enters it in the sync client. API key and mTLS certificates are exchanged automatically. No file transfers.

Upload Limits

Per-stash max file size, file count, bundle size, allowed extensions, and default expiry. Each portal gets its own quotas independent of global settings.

Admin Overview

Track bundle count, total bytes, and download stats per stash. View and manage all uploads from the admin panel. Delete bundles or entire stash portals.

Platform

Everything you need. Built in.

Teams

Create teams, assign roles, and isolate file access across your organization.

Bundle Protection

Password, email verification, or both. Argon2id-hashed, rate-limited, with verified audit trail of who accessed what.

Admin Dashboard

Manage users, files, bundles, and 70+ settings. Environment info, CSV exports, database backups, maintenance mode.

Webhooks & API

HMAC-SHA3-512 signed webhooks. Scoped API keys. Resource-scoped sync tokens. SSRF-safe URL validation.

Multi-Factor Auth

Argon2id passwords, WebAuthn passkeys, Google OAuth, and TOTP 2FA. All simultaneous. Account lockout after failed attempts.

Chunked Uploads

Large files auto-split into 10MB chunks. Concurrent transfer, per-file progress, pause, resume, retry.

S3 & Local Storage

Local disk, NAS, or any S3-compatible bucket. Per-file encryption at rest. Pre-signed direct downloads.

Email Notifications

SMTP or Resend API with dual failover. Upload confirmations, admin alerts, verification emails, password resets.

File Expiry

Auto-expire bundles in 1, 7, 30, or 90 days. Stale upload cleanup. Tombstone-based soft delete for sync bundles.

HermitStash Sync
Companion App

HermitStash Sync

A standalone desktop daemon that keeps a local folder synchronized with your server in real-time. Drop a file locally, it appears on the server. Change it on the server, it downloads automatically.

PQC TLS on every connection
Rename detection — no re-upload
Worker thread parallel checksums
mTLS + ML-KEM-1024 payload encryption
Single binary — no Node.js required
GPG signed + SHA3-512 verified releases
hermitstash-sync
$ hermitstash-sync init
Enter enrollment code: HSTASH-A4K9-XMWP-7RB2
API key received
mTLS certificates installed
PQC TLS verified
 
$ hermitstash-sync start --daemon
Sync engine starting
Worker thread pool started (8 threads)
WebSocket connected
Watching ~/Documents/synced
How It Works

Two ways in.

All encrypted at rest. Vault uploads are end-to-end. Shareable links in seconds.

Public

Drop Files

No login required. Files encrypted on arrival.

  1. Drag folders or files onto /drop
  2. Set expiry, password, or email restriction
  3. Files encrypted and stored instantly
  4. Share link — browse folders or download ZIP
Team

Sign In & Upload

Passkey, password, Google, or 2FA.

  1. Sign in with passkey, password, or Google
  2. Upload from your encrypted dashboard
  3. Vault-encrypt files only you can decrypt
  4. Manage teams, users, and settings
Hardened

Built to resist.

22+
Rate-limited endpoints
Login, register, 2FA, passkey, uploads, bundle unlock, email codes, enrollment, sync. Per-IP sliding windows.
0
Plaintext stored
Every database field is vault-sealed. IPs are SHA3-hashed. Audit logs, emails, names, metadata — all encrypted.
0
Classical-only application crypto
Every file, key, and secret uses post-quantum algorithms — ML-KEM-1024, XChaCha20-Poly1305, SHAKE256, Argon2id. No classical-only fallbacks at the application layer.
0
npm runtime dependencies
All crypto libraries vendored and committed. No supply chain risk. No npm install. Entire codebase is auditable.
Deploy

Two commands. Pick one.

Docker

Recommended
terminal
$ docker compose up -d
Creating hermitstash ... done
http://localhost:3000
  • Auto-restart, health checks, log management
  • Persistent volumes for data + uploads
  • Environment variable overrides
  • Works with Portainer, Coolify, Dokku

Bare Metal

Zero deps
terminal
$ node server.js
Vault keypair generated
http://localhost:3000
  • No npm install — all dependencies vendored
  • No build step — vanilla Node.js
  • No config files — admin panel configures everything
  • Node.js 24+ is the only requirement
Also runs on

Every platform. One image.

Kubernetes

Full manifest with namespace, PVCs, deployment, service, and ingress template.

Podman

Rootless or rootful. SELinux-ready. Auto-generates systemd units.

Proxmox / LXD

One-command LXC container or LXD/Incus system container with Docker nested inside.

Terraform

DigitalOcean droplet with firewall and optional DNS. One terraform apply.

Ansible

Playbook with Docker or native deployment modes. One command for any server.

Ubuntu / Debian

One-liner native install. Node.js 24, tmpfs, systemd service — all automated.