Supa Transfer

Security

Supa Transfer sends files straight from one computer to another. Here is what protects them on the way, and how to check the app you download.

The ticket is the key

Anyone who has a ticket can download its files while you're sharing them, so send it privately, as you would a password, and stop sharing when they're done.

Only the people you choose

To limit a share, choose Only these emails under Who can download (supa send --to on the command line) and list the emails the people you send to sign in with. Then a ticket that reaches someone else isn't enough: as each receiver connects, your app asks supatransfer.app whether the account behind that connection signed in with a listed email, and closes the connection if not. The list stays on your device; our server only answers yes or no. Someone who signs in through Apple with Hide My Email has a relay address as their email, so list that one.

Encrypted end to end

Connections use QUIC with TLS 1.3, and the receiver checks it's talking to the sender named in the ticket. They're made with iroh, an open-source networking library. When two networks block a direct connection and the receiver allows it, a relay carries the data, and it only ever sees it encrypted.

Checked on arrival

Every byte is checked against a BLAKE3 hash. The receiver never overwrites existing files and refuses paths that would land outside the folder it saves to.

What our servers see

Your account, and for each share and download a fingerprint that reveals neither names nor contents, its size and when it happened, to count your monthly allowance. We never see file names, file contents or tickets. The privacy policy lists everything we keep and for how long.

Checking your download

Each download has a SHA-256 file with its checksum and the file name, which includes the version: macOS, Windows, Linux. Work out your zip's checksum and compare the two:

The Mac app isn't notarized by Apple yet, so macOS blocks its first launch: open System Settings > Privacy & Security and click Open Anyway. The Windows app isn't code-signed yet, so SmartScreen may warn: click More info > Run anyway. Checking the checksum first tells you the zip is the one we published.

Reporting a problem

If you find a security issue, write to hello@supatransfer.app. Please give us a chance to fix it before telling others.