End-to-end encrypted vaults, in your browser

A vault is a folder that your browser encrypts before anything is uploaded: the files, the file names and the folder names. The keys never reach Filexco, so only the people who hold them can read what is inside. Keep backups for your tools in Standard folders, and keep what must stay private in a vault.

Encrypted before it leaves your browser

Your browser makes the vault's key and encrypts every file and every name. Filexco stores only the encrypted result. It sees sizes, times and the shape of your folder tree, but not names, content or keys.

  • File content is encrypted in chunks of 1 MiB with AES-256-GCM, and every file version has its own key
  • File and folder names are encrypted too, and Filexco sees only opaque ids
  • Your Master Key protects the vault keys. If you lose both your password and your key file, a vault cannot be recovered by anyone
  • Vaults work in the browser only: WebDAV can never reach one

Move files in with one click

Choose Move to... on a file or folder and pick a vault. Your browser encrypts each file and name on the way, and Filexco removes an original only once its copy has arrived.

  • Folders, files, file names and all sub-folders come along
  • A Standard original waits in the Trash for 30 days, and Undo puts it back
  • If you stop or something fails, nothing is removed from the old place, and you can run the same move again
  • Moving out of a vault decrypts the files again, after you tick a box, and their share links stop working

Share by link or with another account

Items in a vault stay end-to-end encrypted when you share them.

  • A link opens in any browser without an account. Its key is in the part after the # sign, which browsers never send to us
  • Add a password or an expiry to a link
  • Guests can preview PDF, Word, Excel, PowerPoint and CSV files without an account
  • To share with another Filexco user, send the vault to their account after you compare their key fingerprint

Sharing built to last

File encryption uses AES-256, which is considered safe against quantum attacks. Sharing a vault with another account uses a hybrid of X25519 and ML-KEM-768, signed with Ed25519 and ML-DSA-65.

  • A recorded share cannot be opened later by a quantum computer
  • A quantum computer cannot forge who sent a share
  • A share link is not a key exchange: anyone who has the whole link can open the file, so add a password for sensitive files
  • Other parts, such as the TLS connection to the site, depend on your browser and on Filexco

Vault or Standard folder?

Both are encrypted. They differ in who holds the keys, and that decides what else can work with your files.

What we see, and what you must keep safe

A vault only helps when you know where its limits are.

What Filexco can see

In a vault we see sizes, times, the shape of your folder tree and IP addresses, but not names, content or keys. We do not sell personal data and there are no ads.

Your Master Key

It is created when you sign up. Keep the key file safe: if you lose both your password and your key file, vault files cannot be recovered by anyone. Standard folders are not affected.

Vaults in a team

A workspace can hold vaults too. Only the people who hold the key can open them, and a Key holders list shows exactly who they are.

Questions about vaults

What is the difference between a vault and a Standard folder?

A vault is end-to-end encrypted; a Standard folder is encrypted at rest. Your browser encrypts a vault's files and names before upload with a key that Filexco never sees. In a Standard folder Filexco manages the keys, which is what lets WebDAV, search and previews of every format work. Use a Standard folder for backups, cameras and tools, and a vault for what must stay private from everyone. Vaults work in the browser only. Share links work for vault items and for files and folders in Standard folders.

What can Filexco see about my files?

In a vault we see sizes, times and the shape of your folder tree, but not names, content or keys. In a Standard folder Filexco manages the keys, so use a vault for anything that must stay private from everyone. We do not sell personal data and there are no ads. For Sign we also know the title, the signers' names and e-mail addresses, and the time, IP address and browser of each step.

Can I move files into a vault?

Yes. Choose Move on a file or folder and pick a vault as the destination. Your browser reads each file, encrypts it and its name with the vault's key and uploads it. Filexco removes the original only once its copy has arrived, and the original waits in the Trash for 30 days. Keep the tab open until it finishes. Moving out of a vault decrypts the files again, and share links to them stop working. You can move within your own folders and vaults, or within one workspace, but not between the two.

What if I lose my master key?

If you still have your password you are fine, and you can download the key again. If you lose both, vault files cannot be recovered by anyone. Standard folders are not affected.

Make your first vault

Create a free account. No card needed.