Send any file. We can't read it. Verify the math yourself.
SlothBox encrypts your file in your browser before it leaves your machine. The unlock key lives in the part of the URL after # — which browsers never send to any server. Audited libsodium primitives only. No telemetry. No accounts required.
Drop a file here, or click to choose
Up to 4.0 GB · encrypted in your browser before upload
Self-destruct on first download.
Four guarantees
Trust comes from architecture — not marketing copy.
Every claim below is enforced at the code or infrastructure layer. You can read the source yourself.
The server can't decrypt your files
Your file is locked in your browser using libsodium's XChaCha20-Poly1305 before any byte leaves the machine. The decryption key lives in the URL fragment — browsers never send fragments in HTTP requests.
EU-hosted, no US transit
Containers run on Hetzner Germany and Finland. Data does not transit US-jurisdiction infrastructure where Schrems II compliance is contested. Important if you are subject to GDPR, Bogføringsloven or any tavshedspligt regime.
Open source, every line
This repository is the entire production stack. `docker compose up -d` brings the whole thing online on your own machine. No closed components, no black boxes, no marketing-only claims.
Verifiable, not just promised
v0.5 ships RFC 3161 timestamped delivery receipts. v1.0 adds verifiable burn-after-read via a public hash chain and an offline `slothbox-verify` CLI. Every claim above is checkable without contacting our service.
How it works
Three steps. Zero secrets shared with us.
Drop a file
Pick or drag a file. Up to 4 GiB per share in this alpha. Nothing has left your machine yet.
Encrypted locally
Your browser generates a 256-bit key, slices the file into 5 MiB chunks, and seals each chunk with XChaCha20-Poly1305. The server only ever sees ciphertext.
Share the link
Send the share link over any channel you trust. The decryption key rides in the URL fragment — your recipient's browser unlocks the file on their side.
Built for regulated work.
Lawyers, accountants, journalists, doctors — anyone bound by tavshedspligt or audit-trail requirements. v0.5 adds court-admissible delivery receipts.