one more step.
This address has two-step sign-in turned on. Confirm it is you.
- 1Create a key
- 2Publish it
- 3Send or receive
Create your key
Not created yetYour key is the identity people encrypt to. It is generated here, in this browser — the private half is never sent to us.
On a security key derives the keypair from a YubiKey (5.2+) or other FIDO2 key with PRF; With Touch ID / Windows Hello uses this device's own authenticator. Either way the private half is never stored — decrypting always requires the device. Security keys work on other machines by importing their ; fingerprint keys travel only if your passkeys sync (iCloud/Google).
Take a backup from the other browser first (back up… on its key), then bring it here — as the file, or as the one-hour link that browser can create. Restoring does not move the key: the other browser keeps working, and both can open the same files.
Drop the backup file here, or click to choose
Decrypted here, with your passphrase — nothing is uploaded
This browser holds the only copy. Clearing site data deletes the key permanently, and files already sent to it can no longer be opened by anyone. Use back up… on the key to save a passphrase-protected copy — that is also how you use the same key in a second browser. Never email that backup to yourself.
Let people find you
OptionalPublish your key under your email address so people can encrypt to you without asking first. We email you a confirmation link — nothing appears in the directory until you click it. If you are already signed in as that address it is published straight away. Publishing .
manage your listings
Sign in to rename, expire or remove the keys published under your address — without an emailed confirmation each time. This proves you control the address and nothing more: your private keys stay in this browser and are never sent anywhere. Senders and recipients need no account at all.
listings for
Everything published under this address, including keys still awaiting confirmation. Removing a listing does not affect files already encrypted to it — those still open.
two-step sign-in
The emailed link proves you have the mailbox. A second step proves you also have your phone or security key — so someone who gets into your email still cannot get in here. Required for admins.
plan
license verification
Licensed professionals can raise this address to tier 2: a badge senders see, and the tier they can require before sending you anything. We check your license on the licensing registry and post a one-time code to the practice address the registry lists — never to an address you give us.
record keeping
Which rules your records fall under. Deliveries to this address keep their delivery log and signed receipts as long as the strictest of them requires — fixed when each delivery is made. Files themselves still vanish from the relay after download or within days.
remove a listing
Takes a key out of the directory. A confirmation link is emailed to the address first. Files already encrypted to it still open.
1 · Who can open it
Look up people by the email address they published their key under.
Who may receive it?
verified organizations
Add a second person and you'll be asked whether either of them can open it, or only both together.
Read the fingerprint on each recipient out loud with them — over the phone, not over the same channel you're sending through. That is what proves the key is theirs and not a substituted one.
2 · What you're sending
Drop a file here, or click to choose
Encrypted in this browser before anything is uploaded
3 · Delivery
Sensible defaults — most people never change these
How long should the link work?
After this, the link stops working and the encrypted file is deleted from the relay.
How many times can it be opened?
“Once” destroys the file after the first download. If you open the link yourself to check it worked, your recipient never can.
Nothing is uploaded until you press Encrypt. The relay only ever holds the encrypted blob — it cannot open it, and neither can we.
sent links
Tracked only in this browser. Counts come live from the relay.
Delivered to you
Files sent to a key you've published, still waiting on the relay. Each one opens only with that key.
Your secure upload link — give it to anyone who needs to send you something:
Someone sent you a file
It was encrypted to a key on this device, so it opens here and nowhere else. The relay held it as unreadable ciphertext the whole time.
This one can only be opened once. Do it on the device where you want to keep the file — as soon as it downloads, the copy on the relay is destroyed.
Open an encrypted file you already have
If someone sent you a .cell file over email or chat instead of a link, drop it here. It never leaves this browser.
Drop a .cell file here, or click to choose
Opens only if it was encrypted to a key on this device
Decrypted.
Sends the operator this one file's encrypted copy and the key that opens only this file — never your own key, and nothing else you have received. Child sexual abuse material and malware stop being served immediately.
service
Everything here is what the service already stores to run. Blob contents are not shown because the server cannot read them, and rate-limit figures are aggregate because the client keys are salted per boot and per day — this shows pressure, never who.
directory
abuse reports
Each report carries the key to one cell only. Opening decrypts it in this browser and offers the file as a download — nothing is displayed automatically. For suspected CSAM you need not open it to report it: file with the NCMEC CyberTipline and record the report number as an escalation, which holds the evidence for a year.
license applications
Check each license on its registry. Approve only if it is active, and copy the practice address from the registry record — the letter's code is the proof, and it is only proof if it goes where the board says the licensee works.
relay
audit log
Security-relevant actions, hash-chained: each entry commits to the one before, so editing or deleting history breaks verification. The newest hash is published in .well-known.
sessions & pressure
reset two-step sign-in
For someone who lost every key, phone and recovery code. Check who is asking first, on a phone number you already have — a stolen mailbox asks for exactly this. Removes their factors and signs them out everywhere; recorded in the audit log with your note.