Link: https://github.com/parsimonit/web-age-stream-decryptor

I built a small open-source web app that lets people share Age-encrypted files using ordinary web hosting. The encrypted file can be hosted at any HTTPS URL, including a public or pre-signed URL for an S3-compatible object store. Decryption happens locally in the recipient’s browser.

Source: https://github.com/parsimonit/web-age-stream-decryptor
Demo: https://decrypt-app.zebrastream.io/

The encrypted file stays on the existing server. The recipient opens a share link, and the file is decrypted locally in the browser for viewing or downloading. There’s no decryption backend.

The link contains the file URL and Age passphrase in the URL fragment, so the passphrase is not sent in the HTTP request. The complete link is still a bearer secret: anyone who gets it can decrypt the file.

I’m interested in feedback from people familiar with privacy tools and threat modeling:

• Is this useful compared with existing encrypted file-sharing tools?
• Are there important browser or URL-leakage risks I should document?
• Does the “static frontend + arbitrary encrypted object storage” model seem worthwhile?
• Should rendering decrypted HTML be disabled or treated as an unsafe feature?

Current limitations include buffering large files in memory and the possibility of script execution when decrypted HTML is rendered.

Given that there's an agents.md file, an AI usage disclosure statement would be helpful.

You are absolutely right, and I should have thought before quickly posting. I'm going to amend the source repo ASAP to make it clear. I enjoy algorithmics and CLI works, but I hate UI, so this really is a time-saver for me. I'd never be a good web front-end developer. That said, I exercise quality control and control the logic. This app is just a tiny layer on top of the official age/typage typescript library. Go and check the source!

AGENTS.md, no thank you I like my software slop-free

You are absolutely right, and I should have thought before quickly posting.

Dear god even your reply sounds like an AI... can you provide any assurance you are a human?

I hate phone typing, so I'll take it as a compliment 😉

I've seen at least half a dozen other projects that looked like this, received criticism, and the supposed author responded that way verbatim. It's actually eerie.

Yeah it's unfortunate the sheer amount of slop being pushed by sloppers letting the clankers "represent" these days.