Security and temporary file sharing

QickShare's browser upload flow encrypts file contents using AES-256-GCM before uploading them. The encryption key is derived from the six-digit sharing code using PBKDF2 and a random salt for each file.

The protection provided by this encryption depends on the sharing code. Keep the code private and share it only with your intended recipient.

A short sharing code makes transfers convenient, but it has a limited number of possible values. It should not be treated as equivalent to a strong password or a long random encryption key.

The encrypted upload flow stores a lookup hash instead of the raw sharing code in the share record. Someone with access to that hash could test possible codes to find a match. Recovering the code would also allow the file encryption key to be derived.

Browser encryption therefore does not guarantee that the service operator or someone with access to stored share data could never recover file contents.

File-content encryption does not hide all information about a transfer. QickShare stores filenames, file sizes, file types, storage paths and sharing details, including expiry times.

Shared link addresses and titles are stored without the file-content encryption described above. Avoid putting private information in filenames or link titles.

A share expires 10 minutes after it is created. A scheduled cleanup process removes expired uploads from storage and deletes their share records.

Expiry and storage deletion are separate steps. Cleanup timing depends on the scheduled process completing successfully, so deletion may be delayed if the service encounters a problem.

Expiry does not remove copies that a recipient has already downloaded. Recipients can retain or forward those copies.

QickShare does not require registration or login to share files. This does not mean that using the service leaves no technical or usage data.

Read our Privacy Policy for information about data handling and service providers.

If you notice unexpected access to a share or another security issue, report it through our contact page. Describe what happened and when, without including private file contents or an active sharing code.