A Firefox Send alternative: lock a file with a password, no account
Firefox Send was Mozilla's free file sharing service. It launched publicly in March 2019, encrypted files in the browser, needed no account, and its links expired on their own. Some people abused it to spread malware and run phishing attacks, so Mozilla took it offline in the summer of 2020 and announced its end of life on September 17, 2020.
If you came here looking for something that works the same way, there are a few honest options below. Clipboard Share is one of them for a narrower job: moving a sensitive file between your own devices, or to someone nearby, with a password on just the files that need it.
What you can use today
Send (community fork)
A community-maintained fork of the original Firefox Send code, with a public instance at send.vis.ee and the option to host your own. It is the closest thing to the original: an encrypted file and a link that expires automatically.
Wormhole
Encrypts files in the browser before they leave it and puts the key after the # in the share link. Files are deleted from its servers after 24 hours. Good when you want to send one link to someone far away.
Clipboard Share
Not a link-sharing service first. Devices on the same Wi-Fi share one space in the browser, and you can lock only the files that need a password. Text you paste also goes across, but text is not locked.
When Clipboard Share fits
- You are moving an ID photo, a contract or a résumé from your phone to a shared or public computer, and you do not want to sign in to a messenger there.
- Several people use the same Wi-Fi (a school, an office, a library) and you want only one person to be able to open the file.
- The recipient might open it a little later. Files wait in the space for up to about a day instead of needing both devices open at the same moment.
- You would rather show a QR code than read out a password.
When something else fits better
- Your main job is emailing one link to someone far away, with a download limit or a longer expiry you choose. The Send fork or Wormhole is built for that.
- You need the text itself protected. The password lock covers files only.
- You need files kept for days. Here everything is deleted shortly after every device leaves, and after about one day at most.
How to send a locked file
- Open https://www.clipboardapp.org/en/ in a browser. Devices on the same Wi-Fi are grouped automatically under the Same network tab, with no code to type. For someone on a different network, use the Everyone tab.
- Under the Upload File card, tap Lock with a password, enter a password of at least 4 characters and tap Turn on lock. The button changes to Lock on.
- Pick or drag the file as usual. While the lock is on, files you send from this tab are encrypted on this device before upload. Tap Turn off when you are done.
- Tell the recipient the password another way: say it out loud, or send it by text or a call, not in the same place as the file. The recipient sees a scrambled name and a lock icon instead of the file name.
- On the receiving device, open the same site, tap Unlock on the locked file and enter the password. The file is decrypted on that device and saved under its original name. Too many wrong tries and that file can no longer be downloaded.
- Optional: on the sending device, tap the ⋯ button on the file and choose Share via QR code. The QR code carries the key for that one file, so the phone that scans it gets the file without typing the password.
What is locked and what is not
- Locked: the file contents and the file name. Other people on the same network see a scrambled name instead.
- Not locked: text you send, the device name tag (the animal name), device and browser info, and the file size and send time.
- The lock is never on by default. Turn it on each time you need it. Locked files have no preview or thumbnail and are received one at a time.
- Some phone browsers cannot open very large locked files. If you see that message, receive it on a PC or in Chrome on Android.
- For a device you send to often, Connect 1:1 in the device list opens a room for just the two devices after both screens show the same pictures. Files and text in that room are encrypted automatically, without a password.
Questions
Is it end-to-end encrypted?
Files you lock with a password are. The file name and contents are encrypted in the sending browser (PBKDF2-SHA256 with 600,000 iterations, then AES-GCM with a fresh random key per file), and the server only stores the ciphertext and a value used to check the password. The password and keys are never sent to the server. Text, device labels, file size and send time are not locked.
Can I send to someone who is not on my Wi-Fi?
Yes. Switch to the Everyone tab, which is visible to anyone with the service open, and lock the file before sending. The confirmation that appears the first time you send there also has an optional password field. You can also show the recipient a QR code for one locked file.
What if I forget the password?
There is no way to recover it, because the password is never stored on the server. If you still have the original, send it again with a new password.
How long are files kept?
The same as unlocked files: they are deleted shortly after every device leaves the page, and after about one day at most. There is no setting for a longer expiry or a download count.
Is the QR code safe to share?
Treat it like the file itself. Anyone who has the QR code or its link can download that file without the password. The key sits after the # in the address, so it is not sent to the server, and the link stops working once the file is deleted or about a day has passed.