Read the code

# Read it before
you trust it

A zero-knowledge product is only as trustworthy as the code you can read. So the whole client is in the page you are reading — no bundler, no minifier, nothing fetched from anywhere. Press Ctrl+U and you have all of it. This page says what you may do with it, and what you may not.

Try the encryption
Readable, not licensed

Let us be exact, because the words get used loosely. CloakDrop is not open source: there is no repository, no licence, and no permission to redistribute it. What it is, is readable — completely, by anyone, right now. Every line that touches your files or your keys sits in the HTML you already downloaded, unminified, in one file. That is not a promise about some future release; it is the state of the thing in front of you, and you can confirm it in ten seconds. Changes are written up in the changelog.

What you may do

## Read and verify

Everything that touches your files or your keys runs here, in your browser, and you can read all of it. Check the claims instead of believing them — that is the whole point, and no permission is needed for any of it.

- Read the encryption and key handling
- Check the chunking, the IVs, the manifest format
- Watch the network tab stay empty while you cloak

What you may not do

## Copy and run

No licence is granted, so ordinary copyright applies: reading is free, redistributing is not. Nothing here stops you technically — a static page never could — and we would rather say that plainly than pretend otherwise.

- No redistribution of the client
- No running your own copy as a service
- The relay’s code will not be published either

### Verifiable

Open dev tools and watch it happen. The network tab stays empty while a 500 MB drop is encrypted — that is the one claim everything else rests on, and it is the easiest one to check.

### Complete

There is no second version somewhere else. What is served is what runs: one HTML file, styles and logic inline, no build step in between that could hide something.

### Testable

The checks we run are described on the verification page — flipping a bit in stored ciphertext, cutting a key short, tampering with an expiry. You can reproduce every one of them in your own browser.

© 2026
All rights reserved

No licence is granted for this client, which means the default applies: you may read it, run it in your own browser and check every claim on this site, but you may not redistribute it or operate a copy of it. That is a deliberate choice and not an oversight. An open licence would hand out rights that nobody has without one, and it would not add a single thing to what matters here — that you can see exactly what the code does before you trust it with a file. If that ever changes, it will be written in the changelog first, not announced here in advance.