Client-side encryption. A relay that never writes to disk and destroys the ciphertext after one read. No account needed to start. Post-quantum key exchange available for verified transfers.
Audited · Open source · EU jurisdiction · Free API key
Your file is encrypted in the browser before it leaves your device. The relay never sees plaintext.
The ciphertext moves through the relay, padded to 5 MB and hashed into the CT Merkle log.
The recipient decrypts locally. On download, the relay erases the blob from RAM. Burn-on-read.
The Merkle root is updated. Transfer is proven without storing what was transferred.
Anonymous
Browser-generated key lives only in the URL fragment, never sent to the relay. Prove-by-design that we cannot decrypt what we relay.
Ideal for one-off sends that need zero setup. No registration. No key exchange.
Send a file →Verified end-to-end
ML-KEM-768 + ECDH P-256 hybrid key exchange via Rust/WASM. ML-DSA-65 signed receipts (FIPS 204). Fingerprint verification before send.
For when the audit trail matters. The receiver can prove who sent what.
Try ParaShare →ParaSend
AES-256-GCM. Key in URL fragment. Drop a file, get a burn link. 5 MB, up to 1 hour.
Try now →ParaShare
ML-KEM-768 hybrid with fingerprint verification. Post-quantum key exchange. Proof-of-delivery.
Try free →ParaDrop
Browser to browser via WebRTC. No relay storage. No Apple. No cloud. Burn-on-read.
Try now →For one-off anonymous sends. No account, no tracking.
For professionals who send regularly. Features, not bigger files.
Dedicated infrastructure, compliance, and support.
Source-available under BUSL-1.1. Free for up to 5 users. Works on a Raspberry Pi. If the managed service ever closes, every self-hosted relay keeps running indefinitely.
curl -fsSL https://paramant.app/install.sh | bash
or
docker compose up -d