Secure file sharing, without the faff
Encrypted at rest, protected by a 3-word password and deleted automatically. Only the person you give the words to can open your files.
The old way
Most 'quick' ways of sharing files leave copies everywhere: in email inboxes, in chat histories, in cloud folders with public links nobody remembers to switch off. Sensitive documents end up living forever in places you do not control.
- ✕Attachments sitting in inboxes for years
- ✕'Anyone with the link' cloud folders
- ✕No idea who downloaded what
- ✕Files that never get deleted
With Skypost
Skypost encrypts every file with AES-256 before it is stored. Each folder has its own key, unlocked by the 3-word password. Folders are never listed or indexed, and they delete themselves after 7 days on the free plan, 30 on Pro or 90 on Business.
Send — 3 moves
- 1.Drop your filesDrag and drop or click to browse. Any file type.
- 2.Hit sendYour files upload instantly. A unique 3-word password is generated.
- 3.Share the 3 wordsText, WhatsApp, email, phone call — however you like.
That's it. Done.
Receive — 3 moves
- 1.Open the linkGo to skypost.co.uk/receive or use the link the sender shared.
- 2.Enter the 3 wordsType the 3-word password exactly as given.
- 3.DownloadGrab individual files or download everything as a ZIP.
What 'secure' actually means here
Security claims are easy to make and hard to check, so here is exactly what Skypost does. Every upload and download uses HTTPS. Every file is encrypted with AES-256-GCM before it is written to storage. Each folder gets its own random encryption key, and that key is locked using the folder's 3-word password together with a server-side key. Without the password, the stored files are unreadable.
Skypost is not end-to-end encrypted, because files are decrypted on our servers when someone with the right password downloads them. For everyday personal and business documents this is a strong, practical level of protection. If you need zero-knowledge encryption for highly classified material, encrypt the file yourself before uploading.
Built to forget
The safest copy of a sensitive file is the one that no longer exists. Every Skypost folder has an expiry date: 7 days on the free plan, 30 days on Pro and 90 days on Business. When it expires the files are removed from storage automatically. You can also delete a folder the moment the other person has what they need.
Folders that are created but never used are cleaned up too. Guest folders with no files are deleted after 24 hours.
Kept out of search and away from guessers
Shared folders, secure links and download URLs all tell search engines not to index them, both in the page and in the HTTP headers, and they are disallowed in robots.txt. Download pages also stop your browser from passing the folder address on to other sites.
Passwords are three random words drawn from a large word list. Repeated wrong guesses are rate-limited, so the words cannot simply be tried one after another.
A UK service you can contact
Skypost is run from the UK under UK GDPR and the Data Protection Act 2018. Files are stored with Cloudflare R2, and some of our service providers process data outside the UK under approved safeguards. The privacy policy lists them, and the security page goes into more detail. Questions? Get in touch and a real person will reply.
Frequently asked questions
How are my files encrypted?+
Files travel over HTTPS and are stored encrypted with AES-256-GCM. Each folder has its own encryption key, which is itself protected by a key derived from the folder's 3-word password plus a server key.
Is Skypost end-to-end encrypted?+
No. Files are encrypted in transit and at rest, but decryption happens on our servers when someone with the right password downloads. We say this plainly so you can decide what is right for your files.
Can search engines find my shared folders?+
No. Shared folders and download links tell search engines not to index them, and they are blocked in our robots.txt.
What happens when a folder expires?+
It is closed and its files are deleted from storage automatically. You can also delete a folder yourself at any time.
Is Skypost GDPR compliant?+
Skypost is run from the UK and follows UK GDPR and the Data Protection Act 2018. Our privacy policy explains what we collect, why, and where it is processed.
