filekey: Encrypt and Share Files with Passkeys

Overview

FileKey is a TypeScript offline web app built on the WebAuthn PRF extension. It derives an encryption identity from a passkey, then encrypts and decrypts files on your device, without accounts, tracking, or cloud uploads. It is intended for people who want to protect files locally or share them directly with a recipient.

The app supports browsers and passkey providers that implement WebAuthn PRF, including compatible password managers and FIDO2 security keys. It can encrypt folders and large files, and it is installable as a PWA for offline use. For sharing, send an encrypted file addressed to someone's public Share Key, or give them a link to encrypt a file to you.

Key Features

• Derives a reusable identity key from a passkey using WebAuthn PRF and HKDF-SHA-256.
• Encrypts files with HPKE and AES-256-GCM, using chunked streaming for large files.
• Creates recipient-addressed encrypted files that can be sent through any file-transfer method.
• Provides a “send me a file” link so others can encrypt files to you in their browser.
• Offers optional 24-word recovery codes and a standalone offline recovery tool.
• Runs as a static site, with PWA installation and self-hosting options.

Use Cases

• Individuals can encrypt personal documents locally when they do not want to upload them to a storage service.
• People exchanging sensitive files can encrypt them for a recipient's Share Key before using email or another transfer channel.
• A small organization can offer a “send me a file” link for receiving encrypted files without requiring senders to create accounts.
• Travelers or people working offline can use the installed PWA to encrypt and decrypt files without an active connection.

Getting Started

The README's local build instructions use Bun:

cd reference
bun install
bun run build:web
bun run serve

For compatibility details, recovery, and self-hosting guidance, see the README. The hosted app is available at filekey.app.

Alternatives

• cryptpad: CryptPad is a hosted or self-hosted suite for encrypted collaboration, while FileKey encrypts files locally with passkeys for private storage or sharing.
• subtitle-translator: Subtitle Translator converts subtitle files between languages; FileKey encrypts files for private storage or sharing.

Considerations

• Passkey support alone is not enough: the provider, browser, and operating system must support the WebAuthn PRF extension. Compatibility varies, and the README notes that Windows 10 and earlier do not support PRF.
• Losing the passkey can mean losing access unless you created and safely retained a recovery code. The recovery code is an additional secret that needs its own secure backup.
• The project is marked maintained based on recent commits, but development is concentrated in one contributor and there have been no releases in over a year. Teams should weigh that maintenance concentration when relying on it for important files.
• FileKey 1.1 cannot open files from the original version; older files require the v1 app.
• The project is licensed under GPL-3.0, which teams should review against their distribution and compliance requirements.