About QuickDrop

QuickDrop is a privacy-friendly temporary file sharing service. No account, no tracking, no sign-up. Upload a file, get a share link, set an expiry — done.

How it works

1. Upload a file (drag & drop or click) — it's encrypted in your browser before leaving your device
2. Get a share link with the decryption key — share it with anyone
3. The recipient opens the link, their browser decrypts the file locally, and downloads it
4. The file auto-expires and is permanently deleted — no trace left

End-to-end encryption

All files are encrypted with AES-256-GCM before they leave your browser. The encryption key is embedded in the share URL as a fragment (#) and is never sent to the server.

This means the server, Cloudflare, Telegram, and the QuickDrop operator never see your file contents, filename, or type — only opaque encrypted data. Neither the file content nor the encryption key touches any server.

Current deployment

• Frontend: quickdrop-d4l.pages.dev
• API: quickdrop-worker.my-johnlee.workers.dev

Open source

QuickDrop is open source under the MIT license. Built on Cloudflare's serverless platform.

Technical stack

• Frontend: Astro + Tailwind CSS on Cloudflare Pages
• API: Cloudflare Workers (TypeScript)
• Database: Cloudflare D1 (SQLite)
• Rate limiting: Cloudflare KV
• Expiry & analytics: Cloudflare Queues
• File storage: Telegram Bot API / Cloudflare R2
• Captcha: Cloudflare Turnstile (optional — disabled for MVP)

Telegram storage note

Files are encrypted in your browser before being sent to Telegram. Telegram only stores opaque encrypted blobs — it never sees the original file contents, filename, or type.

Telegram may cache these encrypted blobs on their CDN beyond our control. Once a file expires or is deleted, the share link stops working immediately — but we cannot guarantee its immediate removal from Telegram's caching infrastructure. Since only encrypted data is cached, this poses no privacy risk.