Best Firefox Send Replacement for Secure Sharing 2026
Firefox Send was discontinued but you still need secure file sharing. Discover the best replacements with end-to-end encryption in 2026.
Firefox Send was shut down by Mozilla in September 2020 after abuse by malware distributors. Five years on, the best replacements that preserve Send's original DNA — client-side AES-GCM, URL-fragment keys, no account required — are HexaTransfer (10 GB, EU-hosted), Send (the open-source fork running at send.vis.ee and send.tuta.com), OnionShare (Tor-native, zero server), and Bitwarden Send (text and small files only, 500 MB free). Each keeps the "encrypt in browser, share a link, let it expire" workflow that made Firefox Send beloved. None are run by Mozilla, but the code lineage is direct for several.
Why Firefox Send Mattered
Mozilla Send (launched 2017, killed 2020) set the blueprint: upload a file through firefox.com/send, the browser encrypts with AES-128-GCM, the ciphertext goes to Mozilla's servers, the key rides in the URL fragment. Recipients click the link and decrypt in their browser. Optional password, optional download-count limit, files auto-deleted after 24 hours to 7 days. 1 GB free, 2.5 GB with a Firefox Account.
The architecture was open-source (github.com/mozilla/send), cryptographically audited, and deeply aligned with Mozilla's mission. Its demise came not from a security failure but from abuse — malware authors loved the same features (no account, auto-delete, encrypted payload) that privacy users loved. Mozilla paused service citing abuse, then made it permanent in 2020 citing organizational refocus.
HexaTransfer: The Closest Spiritual Successor
HexaTransfer carries forward the model Firefox Send established and upgrades it: AES-256-GCM instead of Firefox Send's AES-128-GCM, 10 GB ceiling instead of 2.5 GB, no account requirement at all (Firefox Send required one for the larger tier), and EU jurisdiction. Encryption happens in the browser via the WebCrypto API. Keys stay in URL fragments. Retention is 7 days with an optional download-count limit.
For someone who bookmarked firefox.com/send in 2019, HexaTransfer is the least jarring switch. Same paradigm, bigger ceiling, modern crypto.
Send (the Community Fork)
Mozilla open-sourced Send's code under MPL 2.0. The community picked it up and runs several public instances: send.vis.ee (hosted by volunteers), send.tuta.com (operated by Tutanota, tied to their encrypted-email service), and private deployments on organizations' infrastructure. The code is at github.com/timvisee/send and stays reasonably maintained.
These instances preserve Firefox Send's exact UI and flow — if you miss the original interface, running the fork or picking a public instance is the nostalgia-preserving choice. Trust shifts from Mozilla to whoever operates the instance, so check the operator's privacy policy and funding model. Several instances run on donations and could disappear without notice.
OnionShare: When Even Metadata Matters
OnionShare doesn't host anything. You run a local Tor hidden service from your laptop, it gives you a .onion URL, and the recipient downloads directly from your machine over Tor. Nothing touches a third-party server. Encryption is end-to-end inherent to Tor's onion-routing construction.
The trade-offs: both parties must be online simultaneously (no "leave it on the server for a week" model), and Tor bandwidth caps practical speeds around 5-10 MB/s. For sensitive journalism, sources, and legal scenarios where "which service saw this" is itself damaging intelligence, OnionShare is unmatched. Firefox Send never had this metadata-zero capability.
Bitwarden Send: Small Files and Text Secrets
Bitwarden Send is built into the Bitwarden password manager. It handles text snippets (API keys, passwords, one-time secrets) and files up to 500 MB on the free tier, 10 GB on Premium ($10/year). Encryption is AES-256-CBC with HMAC-SHA256 authentication, client-side. Links support download-count limits and expiration windows.
It's narrower than Firefox Send — smaller file ceiling, shorter retention — but it fits a real gap: sharing a single credential or a screenshot without spinning up a separate tool. For teams already using Bitwarden, Send is one click away from the vault UI.
Replacement Comparison
| Service | Max size | Encryption | Account | Retention | |---|---|---|---|---| | Firefox Send (defunct) | 2.5 GB | AES-128-GCM | Optional | 24h–7d | | HexaTransfer | 10 GB | AES-256-GCM | No | 7 days | | Send (vis.ee fork) | 2.5 GB | AES-128-GCM | No | 24h–7d | | OnionShare | Unlimited | Tor E2EE | No | Session only | | Bitwarden Send (Premium) | 10 GB | AES-256-CBC+HMAC | Yes | 1d–30d |
What to Watch Out For in Replacements
A few services claim to be "Firefox Send replacements" but break the core security properties. Red flags: any service that requires you to log in before sending (defeats the no-account property), any service that shows the filename to the server (leaks metadata), any service that decrypts on the server to scan content (not actually E2EE), any service that omits URL fragments and embeds keys in query strings (those get logged by proxies and analytics).
The Firefox Send model depends on three specific properties: client-side crypto, key in URL fragment, ciphertext-only server storage. Verify those before trusting any replacement with sensitive data.
Self-Hosting the Fork
If you don't want to trust any public instance, Timvisee's Send fork deploys via Docker in about ten minutes. Run it on a cheap VPS ($5/month at Hetzner or OVH), put Caddy in front for automatic Let's Encrypt TLS 1.3, and point your team at the URL. Storage goes to local disk or S3-compatible buckets like Backblaze B2.
Self-hosting eliminates external trust entirely but shifts you into ops duty: OS patches, log rotation, backup of configuration, monitoring uptime. For a five-person legal boutique or a journalism nonprofit, it's often worth it. For a solo freelancer, using HexaTransfer or a public instance saves the hassle.
Picking the Right Replacement
If you want the lowest-friction switch with better crypto and bigger files, HexaTransfer. If you want the identical Firefox Send UI, run or use the open-source fork. If you want metadata-level privacy beyond what Firefox Send offered, OnionShare. If you want small-file secret sharing inside a password manager workflow, Bitwarden Send.
For the simplest direct swap, try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file