2026LiveDownload
Zarf
- Go
- TypeScript
- Vite
- Web Crypto API
- WebRTC
- WebSocket
- CPace
- SQLite
- Caddy
- Oracle Cloud
Overview
End-to-end encrypted file sharing: the file is encrypted on the device, the key stays in the part of the link after #, and the server can't see the contents. Send a link, request files from someone, or send right away with a short code, in the browser or from the command line.
01 · Problem
Accountants, lawyers and HR teams send ID copies, contracts and medical reports every day by e-mail or ordinary sharing services, and those services can read what they store. There was no account-free way to send documents with personal data that even the server cannot read.
02 · Solution
I documented my own protocol first, then implemented it in Go and in TypeScript against the same test vectors: chunked AES-256-GCM encryption, a key commitment and an optional Argon2id password. The key sits in the part of the link after #, so it never reaches the server. File requests use X25519, sending with a short code uses the CPace key exchange, and browsers connect directly over WebRTC when they can. One Go program runs the API, the web pages and its own STUN server, and the command line tool speaks the same protocol.
03 · Outcome
A live app at zarf.miracdeprem.com whose three ways of sending work across the browser and the command line. Go and TypeScript pass the same test vectors, CPace is checked against the IETF draft's vectors in both languages, and browser tests play the send, request and code flows end to end. The command line tool can be downloaded for Windows, macOS and Linux.