Choose recipients
Send immediately, even to someone without an account. BlindEve creates their keypair and sends an invitation with a temporary passphrase.
Client-side encrypted file delivery
Encrypt files before they leave your browser.
Client-side file encryption with recipient-specific access. BlindEve handles account key setup, invitations and key-management operations; it is not a zero-knowledge service.
Plaintext file
Authenticated streaming encryption
Encrypted object
Local decrypt
- File key
- Generated in the browser for each envelope.
- Key wrapping
- Encrypted separately for the sender and each recipient.
How it works
Encrypt in the browser. Deliver as an envelope.
Encrypt locally
The browser generates a stream key and encrypts files in authenticated chunks using XChaCha20-Poly1305 secretstream.
Deliver encrypted keys
The file key is encrypted separately for the sender and each recipient with RSA-OAEP.
Decrypt locally
Recipients unlock with a passphrase, recovery key or compatible passkey and decrypt files in the browser.
Security model
Client-side encryption, with server-assisted key management.
No plaintext file upload
File contents leave the browser only after encryption.
Local file decryption
Files are decrypted on the recipient device. The service participates in key management, so this requires trust in BlindEve.
Recipient-specific access
Each recipient gets their own encrypted copy of the file key.
Encrypted private key storage
Private keys live in encrypted vaults unlocked in your browser. New recipient invitations use temporary server-assisted enrollment.
Authenticated delivery
Envelope access requires a signed-in account and an encrypted file key for that recipient.
Clear limits
This is not zero-knowledge encryption. Trust in the service, its delivered browser code and the invitation channel remains necessary.
Data visibility
What the service handles and where file encryption happens.
Processed by the service
- Sender and recipient account identifiers
- Envelope state, timestamps, file names, and file sizes
- Wrapped file keys and encrypted vaults; plaintext key material only during server-assisted recipient invitations
- Encrypted file objects and storage paths
File transfer path
- File contents are encrypted locally before upload
- The file stream key is generated locally and wrapped for each participant
- Account setup, key import and rotation happen in your browser; recipient invitations use temporary server-assisted setup
- Decrypted downloads are saved on the recipient device
Product controls
Controls for secure delivery workflows.
Envelope history
See sent and received envelopes without exposing file contents.
Multiple recipients
Send one encrypted envelope to multiple recipients.
Recipient changes
Add or remove recipient access when workflows change.
Blocked senders
Block unwanted inbound envelopes.
Recipient enrollment
Send without waiting for enrollment. New recipients receive an invitation and a temporary passphrase.
Transfer state
Show encryption, upload, and download progress.
Key management
Rotate user keypairs when your team needs key lifecycle control.
Paid plans include key import and rotation. Keys are generated or imported and rewrapped in your browser.
Import keypair
Test keypair
Rotate keys
Handle older envelopes
Pricing
Useful limits. Simple prices.
Every plan includes browser encryption, recipient changes, sender blocking, passphrase management. Paid plans also include key import and rotation. Receiving and downloading are free.
Free
€0
No subscription required
- 20 transfers/month
- 250 MB per transfer · 250 MB per file
- Up to 14 days of availability
- 5 GB uploaded/month · 2 GB active storage
- 5 recipients · 100 files per transfer
- Sign incoming documents · incoming email updates
Essential
€2.99/month
€24/year, billed annually
- 200 transfers/month
- 1 GB per transfer · 1 GB per file
- Up to 30 days of availability
- 25 GB uploaded/month · 20 GB active storage
- 10 recipients · 100 files per transfer
- Key rotation · sent-envelope email updates
Pro
€4.99/month
€48/year, billed annually
- 1,000 transfers/month
- 5 GB per transfer · 2 GB per file
- Up to 90 days of availability
- 100 GB uploaded/month · 50 GB active storage
- 25 recipients · 100 files per transfer
- Essential features · request signatures · verify proof
Decimal units: 1 MB = 1,000,000 bytes; 1 GB = 1,000,000,000 bytes. Allowances count original file sizes. Monthly limits reset at the start of each UTC calendar month, including annual plans. No automatic overage charges.
Annual plans are charged in full each year. Applicable taxes and the final total are shown before payment. Availability starts when a transfer is created.
Self-service help and best-effort issue reporting on Free; best-effort email support on paid plans. No response-time guarantee.
Security FAQ
Practical answers, not slogans.
Are files encrypted before upload?
Yes. File contents are encrypted in the browser before the encrypted object is uploaded.
Does BlindEve store private keys?
BlindEve stores an encrypted key vault. Unlock it locally with your passphrase, recovery key or a compatible passkey. New-recipient invitations use temporary server-assisted keys.
Is metadata encrypted?
No. The service can process delivery metadata such as account identifiers, filenames, sizes, timestamps, and envelope state.
How is access controlled?
A recipient must be authenticated and must have an encrypted file-key copy that can be opened with their private key.
Which cryptography is used?
Files use XChaCha20-Poly1305 secretstream with authenticated chunks. Stream keys are wrapped with RSA-OAEP. Private keys are held in encrypted vaults unlocked in your browser.
Access