Add FileShot.io — zero-knowledge AES-256-GCM file sharing tool for secure data transfer

[FileShot]

Suggest: FileShot.io

I would like to suggest FileShot.io as a resource for secure file sharing in the context of security education and ethical hacking.

Why it is relevant

This repo covers many aspects of security and ethical hacking. FileShot.io is a practical demonstration of:

• Zero-knowledge client-side encryption — AES-256-GCM in the browser via Web Crypto API
• Secure key management — encryption key stored in URL fragment (#) which browsers never send to servers
• Privacy-by-design architecture — server cannot decrypt files even if compelled
• Useful for practitioners — securely share evidence, PoCs, or sensitive files with clients/teams during assessments

Project details

• Website: https://fileshot.io
• Source (MIT): https://github.com/FileShot/FileShotZKE
• No account required
• Self-hostable
• Free

Could fit in a section on privacy tools, secure communications, or as a reference implementation for browser-side encryption.

Thank you for this excellent resource!

[github-actions]

Thank you for opening your first issue in this repository! 🚀 We value your contribution and will review your input as soon as possible. If you’re new here, please check out our contribution guidelines and code of conduct to get started: Contribution Guidelines Happy hacking! 💻 | Omar Santos @santosomar

[github-actions]

This issue has been automatically marked as stale due to inactivity for 30 days. If you believe this issue is still relevant, please comment to remove the stale label. Otherwise, it will be closed in 7 days. Thank you for your contributions!

[admike304-web]

Gud

[santosomar]

I cannot add the commercial version shown in the website and only the free open source code.

#460 is a duplicate of this

My Overall verdict: The code is safe and sound for this repo's knowledge base. It's a straightforward, well-structured client-side encryption library with no red flags. There are no network calls, no obfuscated code, no exfiltration, and no dependencies — it's just a thin wrapper around the browser's native Web Crypto API.

What it does right (cryptographically):

The library uses AES-256-GCM (authenticated encryption), PBKDF2 with 100k iterations for password-based key derivation, a fresh random 16-byte salt and 12-byte IV per encryption, and the crypto.subtle API throughout — meaning the actual crypto primitives are handled by the browser's vetted, hardware-accelerated implementation, not custom JavaScript math. The ciphertext format ([salt][iv][ciphertext+tag]) is clean and standard. The key is marked non-extractable (false in importKey/deriveKey), which is a nice touch.

What I checked for (security/safety):

No network requests of any kind — no fetch, XMLHttpRequest, WebSocket, navigator.sendBeacon, or any other outbound data channel. No external scripts, CDNs, or dependencies loaded. No eval, Function(), dynamic import(), or code injection vectors. No localStorage/sessionStorage/IndexedDB writes that could leak secrets. No service worker registration. The demo HTML is purely local UI with no analytics or tracking. The only XSS-adjacent surface is the innerHTML in the demo's showStatus and fileInfo functions, but those are populated from local file metadata and hardcoded strings — not from untrusted remote input — so it's benign in this context.

[santosomar]

Addressing via #460