build 2.5.0 · aes-256-gcm / post-quantum · eu/de · ram only
POST-QUANTUM · EU SOVEREIGN · ZERO-KNOWLEDGE

File transfer without the file storage.

Files burn after one read. Use the relay, or run your own.

BUILD

Run the relay yourself, or build on the API.

Self-hosters on Raspberry Pi. OT teams deploying sector-isolated relays. Blockchain nodes needing ciphertext passthrough. Developers integrating encrypted transfer into their own products.

Read the docs →
  • BUSL-1.1 source
  • docker compose up -d
  • NIS2, IEC 62443, NEN 7510
CRYPTO 3 KEMs + 18 sigs · NIST FIPS 203/204/205/206 JURISDICTION Hetzner Germany, EU only OWNERSHIP No US parent, no CLOUD Act STORAGE RAM only, no disk writes
01

Four steps. Nothing stored.

How it works
1
Encrypt client-side

Your file is encrypted in the browser before it leaves your device. The relay never sees plaintext.

2
Transit via Ghost Pipe

The ciphertext moves through the relay and is hashed into the CT Merkle log. ParaShare verified transfers are padded to a fixed 5 MB block; anonymous links travel at their actual encrypted size, up to 5 MB.

3
One-time download

The recipient decrypts locally. On download, the relay erases the blob from RAM. Burn-on-read.

4
Cryptographic proof

The Merkle root is updated. Transfer is proven without storing what was transferred.

02

Under the hood.

Cryptography
Anonymous one-off AES-256-GCM

Browser-generated key in URL fragment — never sent to relay. Prove-by-design that we cannot decrypt what we relay.

Verified end-to-end ML-KEM-768 + ECDH P-256

Post-quantum hybrid key exchange. FIPS 203. ML-DSA-65 signed receipts (FIPS 204). All math client-side.

The relay loads 3 KEMs and 18 signatures from FIPS 203, 204, 205, and 206. Clients pick, the relay validates against the live registry, unsupported algorithms get HTTP 415. The official SDKs (sdk-py 3.0.0, sdk-js 3.0.0) produce wire format v1 today; the WebApp tools and extensions are migrating in stages — see crypto-agility § 06 for per-client status.

Full cryptography spec →
03

Verifiable

CT log
Certificate Transparency Log — live
View all →
Log entries
Registered relays
STH signature
checking...
Current root
syncing...
SHA3-256 · tamper-evident · public
Recent activity
loading...
Every transfer hashed into a Merkle tree. Content never stored.
View live CT log → Why post-quantum now →
03.5

No passwords. Ever.

Authentication

Paramant has no login form. No username. No password to phish, steal, or breach. Authentication is a cryptographic key and an optional TOTP code — nothing else.

01 — API key

64-char hex secret

Generated once on account creation. Shown once. Store it in your password manager or secret vault. Rotate instantly if compromised.

02 — TOTP

Authenticator app

RFC 6238, SHA-256, 30-second codes. Works with Aegis, Authy, 1Password. Each code is single-use — replay attacks have no window.

03 — No password

Zero credential surface

Credential stuffing, dictionary attacks, and phishing require a password to target. With no password those attack vectors don't exist.

04

Run your own relay.

Self-host

Source-available under BUSL-1.1. Free for up to 5 users. Works on a Raspberry Pi. If the managed service ever closes, every self-hosted relay keeps running indefinitely.

curl -fsSL https://paramant.app/install.sh | bash or docker compose up -d
Full deploy guide →
05

Every Paramant product.

OVERVIEW

FOR SENDERS

Send a file

ANONYMOUS

Drop a file, share link, burns after one read. No account, no trace.

send a file →

ParaShare

VERIFIED

ML-KEM-768 hybrid with ML-DSA-65 signed receipts. Proof of who sent what.

try ParaShare →

ParaDrop

DEVICE-TO-DEVICE

AirDrop alternative across iOS, Android, Windows, Linux. QR or 6-digit code.

use ParaDrop →

FOR BUILDERS

paramant.app

HOSTED

Create an account on our relay. 30 seconds to your first send. EU-hosted.

create account →

Your server

SELF-HOST

BUSL-1.1 source. Docker compose. Free up to 5 users. Raspberry Pi supported.

deploy guide →

Your infrastructure

ENTERPRISE

Dedicated relay with SLA. Compliance docs, single-tenant. NIS2, IEC 62443, NEN 7510.

see enterprise plan →