Skyfay/SkySend: Zero-Knowledge File Sharing You Can Self-Host

Developers and privacy-conscious teams face a persistent dilemma: how to share files and sensitive notes without surrendering data to third-party servers, creating yet another account, or trusting opaque SaaS providers with encryption keys. Most "secure" file sharing services still hold your data hostage behind proprietary infrastructure, require email verification, or quietly monetize usage patterns. SkySend, an open-source project from Skyfay, takes a fundamentally different approach. SkySend encrypts everything in the browser before upload, runs without accounts or telemetry, and can be fully self-hosted in a single Docker^{↗ Bright Coding Blog} container. For teams that need confidentiality without complexity, this tool merits serious attention.

What is Skyfay/SkySend?

SkySend is a minimalist, end-to-end encrypted, self-hostable file and note sharing service built in TypeScript under the GNU Affero General Public License v3.0. The project is maintained by Skyfay and has accumulated 280 GitHub stars and 10 forks as of its last commit on July 15, 2026. It occupies the same functional space as Mozilla Send (now maintained as timvisee/send) and PrivateBin, but was built from scratch with what its authors describe as higher security standards, more features, and a more maintainable codebase.

The architecture reflects modern web development^{↗ Bright Coding Blog} practices: Node.js 24 LTS runtime, Hono for the backend, Vite with React^{↗ Bright Coding Blog} 19 and Shadcn UI for the frontend, SQLite with Drizzle ORM for persistence, and pnpm workspaces for monorepo management. The cryptographic layer uses the Web Crypto API with AES-256-GCM encryption, HKDF-SHA256 key derivation, and Argon2id (via WASM) for password-hardened shares.

What distinguishes SkySend from commodity file sharing is its zero-knowledge design. The encryption key never leaves the browser—it lives only in the URL fragment (#), which browsers do not send to servers. The server stores encrypted blobs and metadata it cannot decrypt. This is not marketing language; it is a structural guarantee enforced by the protocol design. The project also explicitly notes that its architecture, cryptographic design, and feature specifications were human-directed, with AI coding agents handling implementation under detailed specifications—a transparency claim that invites community scrutiny rather than deflecting it.

Key Features

End-to-End Encryption: Files and notes are encrypted using AES-256-GCM with a 64KB record size for streaming. Keys are derived via HKDF-SHA256 with domain separation into fileKey, metaKey, and authKey. Password-protected shares use Argon2id through a WASM implementation, providing memory-hard, GPU-resistant key derivation. The nonce handling uses counter-based XOR to avoid reuse vulnerabilities.

Flexible Sharing Models: Users can upload single files, multiple files (up to 32, client-side zipped with fflate), or entire folders. Each upload supports configurable expiry times, download limits, and optional password protection. Share links are copy-ready with one click.

Encrypted Notes Beyond Text: SkySend handles text notes, password vaults (with masked display, reveal toggles, copy buttons, and a built-in generator), code snippets with syntax highlighting across 43 auto-detected languages, full GitHub Flavored Markdown^{↗ Smart Converter} with live preview, and even SSH key generation (Ed25519 or RSA) for secure sharing. Notes can be set to burn after reading or enforce view limits.

Optional OIDC/SSO: Administrators can restrict uploads by connecting any OIDC-compliant provider—PocketID, Authentik, Keycloak, or generic configurations. Granular environment variables (OIDC_PROTECT_FILES, OIDC_PROTECT_NOTES) independently gate file uploads and note creation. Downloads remain public, preserving the zero-knowledge design. The CLI automatically opens a browser for PKCE-based login when required.

S3-Compatible Storage: Optional backend support for Cloudflare R2, AWS S3, MinIO, Hetzner, Wasabi, and similar services. Files can be served via presigned URLs with tunable part size and upload concurrency.

Client and Admin CLIs: Pre-built cross-platform binaries (Linux, macOS, Windows, compiled with Bun) support upload, download, note creation, OIDC authentication, and self-updating with checksum verification. A separate admin CLI (skysend-cli) provides upload listing, deletion, stats, cleanup, and configuration inspection.

Use Cases

Secure Client Deliverables: Agencies and consultancies sharing contracts, design files, or audit reports can host SkySend internally, ensuring client data never transits third-party infrastructure. The zero-knowledge design means even a compromised server exposes nothing without the URL fragment.

Development Team Secret Exchange: Engineers sharing API keys, database credentials, or TLS certificates can use encrypted notes with burn-after-reading, eliminating the persistent exposure of Slack DMs or email threads. The password vault format supports multiple credentials per note with individual reveal controls.

Self-Hosted Alternative to Expiring SaaS: Organizations currently paying for commercial secure sharing can migrate to SkySend's single-container Docker deployment with S3 backend, cutting recurring costs while retaining equivalent functionality. The AGPL license ensures any modifications to hosted instances must be shared.

Cross-Platform Scripting Workflows: The CLI's --json flag and dual WebSocket/HTTP transport enable integration into CI/CD pipelines, backup scripts, or automation workflows where encrypted file transfer is required without interactive browser use.

Privacy-Preserving Public Service: Community operators can join the public instances list, offering zero-knowledge sharing to users who cannot self-host, with the same cryptographic guarantees as private deployments.

Installation & Setup

SkySend publishes multi-arch Docker images (AMD64 and ARM64) with built-in health checks at /api/health and graceful SIGTERM handling.

Create a docker-compose.yml:

# docker-compose.yml
services:
  skysend:
    image: skyfay/skysend:latest
    container_name: skysend
    restart: always
    ports:
      - "3000:3000"
    volumes:
      - ./data:/data
      - ./uploads:/uploads
    environment:
      - BASE_URL=http://localhost:3000
      # All environment variables: https://docs.skysend.app/user-guide/configuration/environment-variables
      # There are a lot of customization options available, so make sure to check the documentation for more details.

Deploy:

docker compose up -d

Open http://localhost:3000 in your browser.

The PUID and PGID environment variables are available for proper volume permissions if running with specific user mappings. For production deployments, consult the full environment variable reference at docs.skysend.app/user-guide/configuration/environment-variables.

Real Code Examples

Client CLI Installation and Basic Upload

The README provides cross-platform install scripts and concrete usage patterns:

# Install on Linux/macOS
curl -fsSL https://skysend.app/install.sh | sh

# Set your server
skysend config set-server https://your-instance.com

# Upload a file
skysend upload ./document.pdf

The config set-server command establishes the target instance, enabling use against self-hosted or public deployments interchangeably. The upload command performs client-side encryption identical to the web interface before transmission.

Advanced Upload with Password and Expiry

# Upload with password and expiry
skysend upload ./secret.zip --password --expires 1h --downloads 5

This demonstrates SkySend's granular share controls: --password triggers interactive Argon2id-hardened password entry, --expires 1h sets a one-hour lifetime, and --downloads 5 enforces a maximum access count. These constraints are enforced server-side even though the server cannot decrypt the content.

Encrypted Note Creation

# Create an encrypted note
skysend note "This is a secret message" --type text --expires 24h

The --type parameter accepts text, password, code, markdown, or sshkey, routing to the appropriate note renderer. The CLI outputs a share URL containing the decryption fragment, which the user must preserve independently.

OIDC Authentication Flow

# Login to an OIDC-protected server
skysend auth login

# Check session state
skysend auth status

# Remove stored token
skysend auth logout

The auth login command automatically opens the system browser for PKCE authorization code flow, caching tokens per-server in ~/.config/skysend/. This enables scripted workflows against protected instances without manual token management.

The README contains these four concrete CLI examples. Developers seeking additional patterns should consult the [INTERNAL_LINK: CLI automation guide] or the full documentation at docs.skysend.app/user-guide/client-cli.

Advanced Usage & Best Practices

For production self-hosting, consider these practices consistent with SkySend's documented design:

Reverse Proxy TLS: The BASE_URL should use HTTPS in production. SkySend handles presigned URL generation for S3 backends, but TLS termination at your reverse proxy (nginx, Traefik, Caddy) is essential for the zero-knowledge guarantee to have meaning—an attacker intercepting HTTP traffic captures the URL fragment before encryption applies.

S3 Backend for Scale: Local volume storage (./uploads:/uploads) suffices for personal or small-team use. For higher throughput or durability, configure an S3-compatible backend with presigned URLs. This offloads transfer bandwidth from the SkySend container while maintaining the same encryption boundaries.

Rate Limit Tuning: The built-in sliding-window rate limiting and HMAC-hashed IP quotas with daily key rotation provide privacy-preserving abuse mitigation. Review these settings if your instance serves public traffic.

Backup Strategy: SQLite database files in ./data should be backed up regularly. The encrypted blobs in ./uploads (or S3) are useless without the database's metadata mapping, so both components require protection.

Security Audit Participation: The project maintainers explicitly invite cryptographic review. If deploying for sensitive organizational use, consider contributing to or funding an independent audit—the codebase is open and the design is fully documented.

Comparison with Alternatives

timvisee/send offers mature file sharing with broader protocol support but lacks SkySend's note variety and OIDC integration. PrivateBin excels at minimal text pastes but does not handle files natively and offers no CLI or modern authentication. SkySend's trade-off is a newer codebase with fewer production miles—evident in its invitation for security review—and a heavier dependency stack (Node.js, React) versus PrivateBin's PHP^{↗ Bright Coding Blog} simplicity or send's more established Rust foundation.

FAQ

Does SkySend require user accounts? No. The service operates without accounts or telemetry. Optional OIDC restricts upload permissions but does not create user profiles within SkySend.

What happens if I lose the share URL? The decryption key exists only in the URL fragment. There is no recovery mechanism—this is structural to the zero-knowledge design.

Can I run SkySend without Docker? The README documents Docker as the primary deployment path. Manual Node.js installation would require reproducing the container's environment configuration.

Is the server truly zero-knowledge? Per the documented design, the server stores only encrypted blobs and metadata. The key in the URL fragment is never transmitted to the server.

What databases are supported? SQLite via Drizzle ORM. The README does not document additional database backends.

How does the AGPL license affect my instance? Any modified version accessed over a network must have its source code released. Unmodified self-hosting requires no action beyond preserving the license notice.

Are there public instances if I cannot self-host? Yes. The project maintains a public instances list; community operators can add their deployments via GitHub issue or PR.

Conclusion

SkySend occupies a well-defined niche: developers and organizations that need confidential file and note sharing without surrendering control to SaaS providers or managing user accounts. Its zero-knowledge architecture is technically sound, its feature set—particularly the varied note types and OIDC flexibility—exceeds direct competitors, and its Docker-first deployment removes operational friction. The 280-star project is young enough that its authors candidly seek security review, which should factor into risk assessment for the most sensitive deployments. For teams comfortable with a TypeScript/Node.js stack and attracted to the AGPL's copyleft protections, SkySend offers a credible, inspectable alternative to opaque commercial services. Explore the repository, review the cryptographic documentation, and determine whether it fits your threat model at https://github.com/Skyfay/SkySend.