Privacy Tools Guide

Email attachments are dinosaurs: limited to 25MB, scanned for “suspicious” content, logged forever on central servers. Cloud storage (Dropbox, Google Drive) makes file sharing convenient but trades privacy for convenience—your files sit on someone else’s server, indexed and searchable.

If you need to send a sensitive file (medical records, legal documents, passwords, financial data), these tools are riskier than they seem.

This guide compares four privacy-focused file transfer tools: OnionShare, Magic Wormhole, Croc, and Send (Firefox Send fork). We tested them on real-world scenarios: sharing sensitive documents, large files, and ephemeral transfers.

The Threat Model

Before choosing a tool, understand what you’re protecting against:

Email / Cloud Storage Risks:

Privacy-Focused Tools Solve This By:

The Contenders

1. OnionShare

What it is: Share files over Tor, with no central server.

Encryption: End-to-end (AES-256), plus Tor layer encryption.

Speed: Slow (Tor adds 5–10x latency).

Setup complexity: Medium (requires Tor browser or Tor daemon).

Cost: Free, open-source.

Use case: Sharing sensitive files with journalists, activists, or people under surveillance. Maximum privacy.

How It Works

  1. Run OnionShare on your computer
  2. Select files to share
  3. OnionShare starts a web server and generates a .onion URL (e.g., http://abc123.onion/share?code=xyz)
  4. Share the URL securely (Signal, encrypted email, etc.)
  5. Recipient visits the URL in Tor Browser
  6. Recipient downloads; file is deleted after download

Real example: Whistleblower sending encrypted logs

Whistleblower has 50MB of server logs proving financial fraud. Can’t use email (IT department monitors). Can’t use cloud storage (company might gain access).

# On whistleblower's computer
onioshare
Select: fraud_logs.tar.gz (encrypted with gpg)
OnionShare generates: http://whistleblower123.onion/share?key=xyz
Send link to journalist via Signal
Journalist receives URL, opens in Tor Browser, downloads
Logs deleted from OnionShare after download

Encryption detail: OnionShare encrypts files with AES-256 before the web server even touches them. Tor encrypts the connection. Even if OnionShare code had a backdoor, Tor layer protects you.

Speed test (50MB file over Tor):

When OnionShare is overkill:

If you’re sending a family photo to your sibling, OnionShare is paranoid. Tor is slow; setup is annoying.

If you’re sending medical records, tax returns, or anything that shouldn’t be logged: OnionShare.

Downsides:

Cost: Free.

2. Magic Wormhole

What it is: Securely transfer files or text using a simple passphrase.

Encryption: End-to-end (SPAKE2 + ChaCha20).

Speed: Fast (direct peer-to-peer when possible).

Setup complexity: Low (command-line only, but very simple).

Cost: Free, open-source.

Use case: Transferring files to trusted contacts with a simple password. Balance of security and simplicity.

How It Works

  1. Sender: wormhole send file.txt → Generates passphrase (e.g., 7-guitar-siren)
  2. Sender shares passphrase verbally, via Signal, or any insecure channel
  3. Recipient: wormhole receive 7-guitar-siren → Downloads file
  4. File deleted after transfer

Real example: Sending medical report to doctor

Doctor needs your lab results. Can’t email (HIPAA-violating). Can’t use cloud (private medical data).

# On patient's computer
$ wormhole send lab_results.pdf
Sending lab_results.pdf (2.3 MB)
Wormhole code is: 3-sparrow-modern

# Patient calls doctor with passphrase: "3-sparrow-modern"

# On doctor's computer
$ wormhole receive 3-sparrow-modern
Receiving file (2.3 MB)
Receiving... [████████████████] 100%
Saved to lab_results.pdf

Encryption detail: Wormhole uses SPAKE2 (a secure password protocol). Even if you share the passphrase in a channel an attacker monitors, they can’t decrypt without both:

  1. The passphrase (you send over one channel)
  2. The encryption key (derived from the passphrase + rendezvous server handshake, attacker can’t replicate)

Speed test (100MB file, direct peer-to-peer):

Wormhole is 3x faster than Tor.

Downsides:

Cost: Free.

3. Croc

What it is: Similar to Wormhole, but faster and simpler.

Encryption: End-to-end (ChaCha20), relay encryption (server can’t read data).

Speed: Very fast (optimized protocol).

Setup complexity: Very low.

Cost: Free, open-source.

Use case: Quick, simple file transfer to colleagues or friends. Simplicity without sacrificing security.

How It Works

  1. Sender: croc send file.txt → Generates code (e.g., happy-crystal-5)
  2. Sender shares code
  3. Recipient: croc happy-crystal-5 → Downloads and saves

Real example: Sharing project secrets with coworker

Developer needs to send database_credentials.env to their backup (who takes over if they leave). Can’t store in Git. Can’t email.

# On sender's computer
$ croc send database_credentials.env
Sending 'database_credentials.env'
Code is: friendly-turtle-9
On the other computer run:
  croc friendly-turtle-9

# On recipient's computer
$ croc friendly-turtle-9
Receiving 'database_credentials.env'
Accept? (y/n) y
[████████████████] 100%
Saved as database_credentials.env

Speed test (100MB file):

Croc is the fastest for most scenarios.

Encryption detail: Croc uses ChaCha20 (same as Wormhole) but optimizes the relay server. The relay server can’t decrypt your files (encryption is end-to-end), but it relays faster than Wormhole’s architecture.

Downsides:

Cost: Free.

4. Send (Firefox Send Fork)

What it is: Web-based file transfer with encryption, expiry, and download limits.

Encryption: End-to-end (AES-128 in browser).

Speed: Fast (HTTP, not P2P, but optimized).

Setup complexity: Very low (just a website).

Cost: Free (if self-hosted); some public instances are free.

Use case: Sharing files with non-technical users, or needing a GUI.

History & Context

Firefox Send was Mozilla’s official encrypted file transfer service (shut down in 2021 due to abuse). Open-source community forked it; now several independent instances run the same code:

How It Works (Using send.vis.ee)

  1. Visit send.vis.ee
  2. Drag file onto page
  3. Optionally set password + expiry
  4. Click “Send”
  5. Generates link (e.g., send.vis.ee/download/abc123#password)
  6. Share link
  7. Recipient visits link, enters password, downloads
  8. File deleted after expiry (default 1 day)

Real example: Sharing large file with consultant

Consultant needs 500MB video project file. Email max is 25MB. Cloud storage isn’t private enough.

1. Upload file to send.vis.ee
2. Set expiry: 24 hours
3. Set password: "ProjectSecure2024"
4. Send link: send.vis.ee/download/abc123
5. Message separately: "Password: ProjectSecure2024"
6. Consultant downloads
7. File auto-deletes after 24 hours

Encryption detail: Files are encrypted in your browser (AES-128, not the 256-bit of others, slight weakness). Server receives encrypted file; can’t decrypt without password. Encryption + password = good protection.

Speed test (500MB file):

Strengths:

Downsides:

Cost: Free for public instances; cost depends on bandwidth if self-hosted.

Comparison Table

Tool Speed Privacy Ease of Use Best For Cost
OnionShare Slow Excellent Medium Whistleblowers, activists Free
Magic Wormhole Fast Excellent Low Trusted contacts, quick share Free
Croc Very fast Excellent Low Speed + privacy balance Free
Send Fast Good Very high Non-technical users Free

Which Tool When

Sending to a journalist (whistleblowing)

→ OnionShare (maximum privacy, no logs, Tor protection)

Quick transfer to trusted colleague

→ Croc (fastest, simple passphrase, secure)

Large file to non-technical user

→ Send (no CLI needed, browser-based)

Sharing secret that should auto-delete

→ Magic Wormhole (simple, secure, peer-to-peer)

Sending over untrusted network (airport WiFi, surveillance concern)

→ OnionShare or Wormhole (encryption protects against snooping)

Real-World Scenarios

Scenario 1: Consultant Needing Project Files

Setup: You work at a company; external consultant needs 300MB of project files, but they shouldn’t live in cloud storage.

Tool: Croc

Why: Fast, simple code, easy to explain verbally.

$ croc send project_files.tar.gz
Code: happy-rabbit-2
(Consultant runs: croc happy-rabbit-2)
Transfer complete in 15 seconds

Scenario 2: Whistleblower Sharing Evidence

Setup: Employee has documents proving illegal activity. Can’t use company email or cloud.

Tool: OnionShare

Why: Journalist can access via Tor (anonymously), files are end-to-end encrypted, no central server, deleted after download.

onioshare
Select: evidence.tar.gz (encrypted with GPG)
Generated URL: http://witness123.onion/share?key=xyz
Send via Signal to journalist
Deleted after download

Scenario 3: Family Sharing Medical Records

Setup: Mom needs to send medical report to you and your sibling. Can’t email (HIPAA). Don’t want to use Google Drive.

Tool: Send (public instance) or Croc

Why: Send is browser-based (Mom can use it); Croc requires CLI but is faster.

Send option:
- Mom visits send.vis.ee
- Uploads medical_report.pdf
- Sets 48-hour expiry
- Shares link + password

Croc option:
- Mom runs: croc send medical_report.pdf
- Calls you with code
- You and sibling both run: croc [code]

Scenario 4: Transferring Files to Multiple Recipients

Setup: You’re leaving a job; need to transfer files to 3 teammates.

Tool: Multiple Croc transfers (simplest for multiple people)

Why: One code per person, easy to explain.

$ croc send file_set_1.tar.gz
Code: smart-wizard-3
(Team member 1 gets code, downloads)

$ croc send file_set_1.tar.gz
Code: brave-painter-5
(Team member 2 gets code, downloads)

$ croc send file_set_1.tar.gz
Code: kind-salmon-7
(Team member 3 gets code, downloads)

Privacy Tradeoffs

OnionShare

Magic Wormhole

Croc

Send

Installation & Quick Start

OnionShare (macOS/Linux)

brew install onionshare  # macOS
apt install onionshare    # Ubuntu
# Then: onionshare (opens GUI)

Magic Wormhole

pip install magic-wormhole
# Usage: wormhole send file.txt

Croc

brew install croc   # macOS
apt install croc    # Ubuntu (if available) or build from source
# Usage: croc send file.txt

Send

No installation needed. Visit send.vis.ee or self-host.

Recommendations by Use Case

Maximum privacy, no compromises: → OnionShare (accept the speed cost)

Privacy + speed balance: → Croc (CLI is worth learning)

Non-technical user: → Send (public instance)

Self-hosting (full control): → Croc (simple deployment) or Send (if you want a web UI)

All four are free, open-source, and actively maintained. Pick one based on your threat model and technical comfort.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides