File Transfer Encryption Methods Compared in Detail
To compare encryption, trace the file and key separately
Updated on
Published by HexaTransfer, a service operated by Gaprod — Groupe Dwenola SAS. These guides discuss our own service alongside other products. About the publisher
To compare encryption, trace the file and key separately. TLS encrypts the network connection but terminates at the server. Encryption at rest protects stored data under the provider's key management. End-to-end encryption encrypts before upload and decrypts at the intended recipient; the provider should not receive the decryption key.
What HexaTransfer actually does
The browser generates a random AES-256-GCM key using Web Crypto. It does not derive that key from the optional password. The key is carried in the URL fragment after #; the fragment is separated before the HTTP request, as described by RFC 3986. JavaScript in the receiving page uses it locally to decrypt.
The optional password is a separate server-side access check stored as a hash. Calling that password a PBKDF2 encryption key would misdescribe the implementation. AES-GCM provides authentication as part of the encryption mode; a separate HMAC is not the file format used here.
Ask who controls the key
A vendor mentioning AES-256 has not necessarily promised end-to-end encryption. Infomaniak's SwissTransfer documentation describes encryption on transport and storage servers. Check each product's own design before assigning it a cipher, key derivation method or zero-knowledge label.
Browser encryption does not protect against a compromised endpoint, malicious browser extension or a recipient forwarding the complete link. It also does not make operational metadata disappear. Keep links private, use trusted devices and save an independent copy before expiry. This is a technical explanation of the transfer, not certification for a regulated workflow.
HexaTransfer in practice
HexaTransfer is a free, account-free tool for occasional deliveries up to 50 GB. Links expire after 14 days by default; choose 1–30 whole days when creating the transfer; keep your own copy. Files and their names are encrypted in the browser with AES-256-GCM. The browser generates a random key and puts it after # in the share link. Send the complete link only to intended recipients: anyone holding it can decrypt the transfer, subject to any additional password protection.
The optional password controls access at the server; it does not derive the encryption key. Keep the tab open until the link appears, and allow enough disk space when downloading. Uploading does not remove the original file.
Sources checked on 2026-09-27
Related guides
Send large files securely with end-to-end encryption
Send up to 50 GiB free with end-to-end encryption, no account or email. Choose 1–30 days; 14 days by default.
Send a file