ProtonDrive vs HexaTransfer: Detailed Privacy Comparison
Compare ProtonDrive and HexaTransfer in detail on privacy, Swiss vs French hosting, encryption approaches, and file transfer capabilities.
Proton Drive and HexaTransfer both use client-side encryption but differ fundamentally in model and jurisdiction. Proton Drive is a Swiss-hosted cloud storage service with accounts, OpenPGP-based encryption, 5 GB free and up to 3 TB paid, and cross-device sync. HexaTransfer is a French-hosted ephemeral transfer tool with no accounts, AES-256-GCM encryption, 10 GB per transfer, and 7-day expiration. For ongoing encrypted personal storage integrated with mail and calendar, Proton Drive wins. For one-off encrypted sends without creating accounts, HexaTransfer is simpler and keeps data under French (EU) jurisdiction rather than Swiss (adequacy-decision EEA-equivalent).
Encryption Stack Comparison
Proton Drive uses OpenPGP (RFC 9580) for file and key encryption, with AES-256 for symmetric content encryption and ECC (Curve25519) for key exchange. Keys are derived from user passwords via bcrypt plus client-side key derivation. Every file, folder, and share has its own key, with a key hierarchy designed for granular sharing. The implementation is based on the open-source OpenPGP.js library, maintained by Proton.
HexaTransfer uses AES-256-GCM via the Web Crypto API (SubtleCrypto.encrypt) for direct content encryption. No OpenPGP layer — a simpler stack focused on single-file transfers. The decryption key lives in the URL fragment (not transmitted to the server) and PBKDF2 with 600,000 iterations wraps the key when a password is added.
Both are legitimate zero-knowledge approaches. Proton's design supports a more complex use case (persistent storage with hierarchical sharing); HexaTransfer's design is optimized for the specific case of ephemeral sends.
Jurisdiction: Swiss vs French
Proton is headquartered in Geneva, Switzerland, with data centers in Plan-les-Ouates (Switzerland) and expansion into Germany. Switzerland has an EU adequacy decision and its own Federal Act on Data Protection (FADP) updated in September 2023 to mirror GDPR. The Swiss legal environment is generally considered privacy-friendly, though Swiss surveillance law has evolved — the 2016 Nachrichtendienstgesetz (NDG) expanded signals intelligence capabilities.
HexaTransfer hosts exclusively in France under GDPR directly (not via adequacy decision). The CNIL is an aggressive regulator, and French data protection law adds national provisions on top of GDPR. For organizations needing an EU-jurisdiction answer rather than an EU-adjacent answer, French hosting is more direct.
Account Model and Onboarding
Proton Drive requires a Proton account, which unifies access across Mail, Calendar, VPN, and Pass. The account has its own encryption keys, password reset flow (with legitimate limitations for zero-knowledge recovery), and two-factor authentication. Desktop and mobile apps keep devices synced.
HexaTransfer has no account. Open the site, upload, share the link. The lack of accounts means no identity to subpoena, no usage patterns to track, no password to forget. The trade-off is no persistent identity across transfers — every transfer is fully independent.
File Size and Storage
Proton Drive free tier is 5 GB total storage (shared across Proton services). Drive Plus at €3.99/month offers 500 GB; Unlimited at €9.99/month offers 1 TB; Family and Business tiers go to 3 TB per user. File size per upload is limited by quota.
HexaTransfer caps at 10 GB per transfer — larger than Proton's 5 GB free tier but per-transfer rather than persistent. For a single 8 GB file, HexaTransfer handles it free; Proton Drive would need a Plus subscription.
Retention and Expiration
Proton Drive files persist until you delete them or cancel the account (with a grace period). There's no automatic expiration; you decide when files go away. Shared links can be set to expire, but stored files don't.
HexaTransfer expires files after 7 days, with no extension option. This is deliberate — the service is for sending, not keeping. If you need the file longer, use cloud storage (including Proton Drive) instead. The automatic deletion removes the exposure window.
Comparison Matrix
| Feature | Proton Drive | HexaTransfer | |---------|--------------|--------------| | Company location | Switzerland | France | | Data hosting | Switzerland, Germany | France only | | Encryption | AES-256 + OpenPGP | AES-256-GCM + PBKDF2 | | Key derivation | bcrypt + ECC | PBKDF2 600k | | Zero-knowledge | Yes | Yes | | Free tier | 5 GB total | 10 GB per transfer | | Max paid size | 3 TB total | N/A | | Retention | Indefinite | 7 days | | Account | Required | None | | Desktop apps | Yes (Win, Mac, Linux) | Browser only | | Mobile apps | iOS, Android | Browser | | Ecosystem | Mail, Calendar, VPN, Pass | Standalone | | Open source | Client apps | Partial | | Pricing | €3.99–€9.99/month | Free |
Ecosystem Integration
Proton Drive is part of a broader Proton ecosystem. If you use Proton Mail for email, Proton Calendar for scheduling, and Proton VPN for transit privacy, Drive slots in as the storage piece. Single sign-on across services, unified billing, and consistent encryption architecture make the suite coherent.
HexaTransfer is standalone. No ecosystem, no integrations. For users who want an encrypted transfer tool without buying into a broader product family, the independence is a feature.
Sharing Model
Proton Drive shares can be password-protected links (public), shared with specific Proton users (identity-verified), or shared via email with recipient-specific encryption. Permissions include view, comment, and edit. Sharing can be revoked at any time from the web or desktop app.
HexaTransfer sharing is link-only. You get a URL, share it however you want. Optional password wrapping adds a second factor. No permission granularity (every recipient gets full access to the file), no revocation once the link is out (though expiration effectively revokes within 7 days).
When Each Is the Right Tool
Choose Proton Drive for ongoing encrypted personal storage, integration with Proton Mail/Calendar/VPN, cross-device sync, granular sharing, and persistent encrypted vaults. If you're building a privacy-focused personal cloud, Proton Drive is a comprehensive answer.
Choose HexaTransfer for sending a single sensitive file to a recipient without creating accounts (yours or theirs), keeping the data under French jurisdiction specifically, and preferring automatic deletion over indefinite storage. If you just need to send a 6 GB encrypted ZIP once, HexaTransfer is zero-overhead.
Layered Privacy in Practice
Many privacy-conscious users combine both. Proton Drive for personal storage (documents, photos, backups), Proton Mail for communication, Proton VPN for transit. HexaTransfer for one-off external deliveries where creating Proton accounts for recipients would be friction.
The jurisdictional diversity (Swiss Proton, French HexaTransfer) arguably strengthens the overall posture. No single legal system controls your entire stack. For individuals and small organizations with elevated privacy needs, this kind of thoughtful layering is often more effective than picking one "perfect" service.
Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file