Public preview

What runs, and what does not

A transfer runs inside your browser tab and touches no backend, so there is nothing there that could go down. What can go down is this website — and a page that measures it is on the way.

A status page is coming

Uptime, response times and a written record of every outage will live here, on a host of their own so a broken deploy of this site cannot take them down with it. The measuring service is already running on its own machine, separate from this site, so that an outage here cannot take it down. It stays closed until the site itself opens — rather than post a green tick nobody measured, this page says so.

Until it is up: if something here is broken, write to hello@cloakdrop.com and a person reads it. The sections below describe what each part of CloakDrop does today — anything marked Not built will report nothing on the board either, because a status page that shows green for something that does not exist would be the same kind of claim this project refuses to make.

In your browserFinished — open the app and try it.

Encryption

AES-256-GCM · WebCrypto

Finished

Files are encrypted before anything else happens

The key is generated by the browser’s own WebCrypto in your tab and is never sent anywhere — there is nowhere to send it. Files are split into 4 MB chunks and every chunk is encrypted with AES-256-GCM. This part of CloakDrop is done, and it is the part you can check yourself.

Local storage

IndexedDB · this browser

Finished

Encrypted chunks stay on the machine that made them

A drop is written into an IndexedDB database on the device you created it on, up to 500 MB in total. Nothing is uploaded, because there is nothing to upload to. Clear your browser data and the drop is gone with it.

Share link

Transfer id and key in the fragment

Same browser

The link opens the drop only in the browser that created it

The transfer id and the key ride in the fragment behind the hash sign, and the encrypted chunks sit in local storage. Send that link to someone else today and their browser shows them nothing, because it holds no copy. The relay is the piece that will change that.

Not builtNothing here is running.

Relay

Carries a drop from one browser to another

In development

This is what is being built

There is no relay, no backend and no network call in this build. When a relay exists, this page starts reporting what it does: availability measured from the outside, error rates, and a written record of every incident — including the ones nobody noticed. Until then there is nothing here to plot.

Accounts and API

No sessions, no endpoints

Not built

There is nothing to sign in to and nothing to call

The preview keeps no accounts and exposes no endpoints. There is no address here you could send a request to.

Check it yourself

Open your browser’s network panel and create a drop. It stays empty: this build contains no fetch, no XMLHttpRequest and no WebSocket. That is the whole claim — and the only kind of claim this page will ever make.