When you send files, they are encrypted in your browser before being uploaded to our servers. With Trebuchet your files never leave your computer unencrypted. After encrypting and uploading is complete, you'll get a download link that you can share with your recipients.
The sharing link is a single link that contains two parts:
The first part is randomly generated, and points to the location of the encrypted files on our servers. Randomly generated means no one could guess the locations of shared files by just trying links. Someone with this part of the link could see that there’s a file on the server but couldn’t decrypt the file, including us.
The second part is the decryption key. Crucially, no-one, including us, can download and decrypt the files without this second part of the link. This decryption key is never sent to us.
Only if someone has the full link can they download and decrypt the file, and only before the link expires. So it’s important to make sure you only send the link to the intended recipient.
The full sharing link, including the decryption key, is generated and stored locally in your browser and never sent to us. If you are signed in using the same browser and device you used to send the files, then you can view the sharing link previously generated by that browser. The sharing link information you are seeing is extracted from local storage on your device, not our servers, and is only available from that specific browser and device.
If you sign into your Trebuchet account on a browser or device which is different to the one used to share any files, you can still see all your active file shares; however, since the local storage of the browser used to originally send the files is not available, the file details, including the sharable link, will be unknown and not available.
Trebuchet will soon support the optional syncing of this local browser storage between your devices, which will allow you to access your sharing link from any device. Even in this situation the sharing link will still not be accessible to us.
With Trebuchet you can apply additional controls when uploading or requesting files. The measures available depend on your account type (see our pricing page for details), such as being able to set:
When the file expires, either because of the duration you set or the maximum number of downloads is reached, it is automatically deleted from our servers.
Files sent using Trebuchet are always encrypted, regardless of whether an additional password is applied. The encryption algorithms used (see a later question for details) are very, very strong and no one could decrypt the files without the full sharing link, which includes the decryption key.
However, for sending very sensitive files, you might decide that you want the recipient to require two pieces of information in order to decrypt the files; a link and a password. These two pieces of information can then be sent separately; for example, you could email the link, and share the password via a different service like Signal or WhatsApp.
As well as using Trebuchet to securely send files, it can also be used to request files, and, like sharing, the recipient of the request does not need a Trebuchet account.
To request a file you generate an invitation request, which creates a unique link to be shared with the person who has the files to share with you. When they receive the invitation link and use it to share files with you, the files are encrypted in their browser, before being uploaded, using a shared key that is known only to you and the sender.
When the sender has used the invitation link to share files with you, the files will be available in your Trebuchet inbox, and are decrypted using your key.
Yes. In all scenarios, shared files are encrypted in the sharer's browser before they are uploaded. They can only be decrypted in the browser of the recipient, who must have the full sharing link, and the password if one has been set. At all points in-between, including when on our servers, the files are encrypted. We cannot decrypt them.
The keys used to encrypt files are never sent to our servers. They are securely stored in your browser, so that only you can view the details of files or invitations you have already shared. Once a file or invitation is deleted, the keys in your browser are also removed.
As well as file encryption, when you use Trebuchet your browsing traffic is encrypted using TLS versions 1.2 or 1.3, which is the industry standard.
No. Since the file encryption happens in your browser before the files are uploaded, we can't look at their contents. This means we don't check for viruses or malware, so it’s important to check files yourself before you share them. Downloaded files are inspected for viruses by most modern web browsers.
No. Part of the security of Trebuchet is that the files are ephemeral, which means they only exist for the period of time set by the expiry duration. When sending files, you choose when they expire, and after this time they are deleted from our servers. We don't keep copies of any uploaded files, and we can't decrypt them. For this reason, Trebuchet should not be used for backup purposes, or for holding the only copy of important files.
When using Trebuchet to send and receive files, including when requesting files, your files are encrypted using AES-256 in Galois Counter Mode (GCM). Encryption key derivation uses PBKDF2 and HKDF. AES key wrap is used to protect your local keys.
When you send file sharing requests, the encryption keys are themselves encrypted using Elliptic Curve Diffie Hellman (ECDH), using NIST curve P-384.
Trebuchet was inspired by Firefox Send, but we've taken it much further. Firefox Send was a great file sharing application from the Mozilla Foundation, but as detailed on their blog, it had to be closed down as it was frequently being used for malicious purposes - primarily due to its anonymity. We've started with their approach, added authentication (thus removing the anonymity), built in more features and improved security. Examples of improvements include:
There are three source files in Trebuchet that have come from the original Firefox Send project. As per their license agreement, we have made these files available here.
Trebuchet is a product by
