Share files privately, worldwide.
Zero-knowledge file sharing and a free global CDN. Encrypted in your browser before it ever leaves your device, no email, no ads, no tracking.
hypastack.com · Docs · Pricing · Status · Discord
I'm a solo developer, and I built Hypastack because I got tired of "private" file sharing that just means the company promises not to look. I'd rather not be able to look at all.
v3 just shipped. New dashboard, a redesigned upload flow, and a proper Developer API. What's actually new is in the changelog.
- Secure File Sharing: encrypted client-side (AES-GCM 256) before upload. The decryption key lives in the URL fragment, which never reaches the server. I genuinely cannot read these files.
- Permanent CDN Hosting: public, permanent links for images and static assets. Not encrypted (a browser has to render them), but EXIF/GPS/camera metadata is stripped on upload.
- Paste: a short recovery window for anything you delete by accident, before it's gone for good.
- Requests: collect one-time file drops from people who don't have (or don't want) an account.
- Forum: a public community board with file attachments.
- Developer API: plain REST, plain JSON, bearer tokens with scoped keys. No SDK required. See docs.hypastack.com.
No email, no phone number. An account is a random ID plus a passkey, and that's it.
No, and I'd rather say that plainly than let the word "public repo" do the lying for me. This is source-available: you can read every line, verify the zero-knowledge claims yourself, and publish whatever you find. You can't run it, self-host it, or build a competing service from it. The exact terms are in LICENSE, and the reasoning is in there too, it's a short read and worth it before you ask.
Bug reports are genuinely welcome, open an issue. Security findings even more so, please email me directly at usekiko@hypamail.me instead of filing a public issue. Full details, including why I can promise not to come after you for an honest finding, are in CONTRIBUTING.md and SECURITY.md.
TypeScript and Next.js for the web app, Go for CPU-heavy hashing, Erlang for background scheduling, Rust (Tauri) for the desktop client. Polyglot because each piece is genuinely better suited to a different language, not because I like maintaining four toolchains.
Everyone who's filed a bug, reported a security issue, or otherwise made this thing better than I could alone:
HypaLabs License (Reference-Only) - (c) 2025-2026 HypaLabs. All rights reserved.
Questions the license doesn't answer: usekiko@hypamail.me