"Encrypted" File Transfer: What It Does and Doesn't Mean

Nearly every file sharing site says it’s “encrypted”. It’s technically true almost everywhere, which is exactly why it doesn’t tell you much. The useful question is: encrypted between whom?

There are three kinds you’ll see, and they protect against different things.

1. Encryption in transit

This means the connection between your device and the next machine along is encrypted. It’s the padlock in your browser’s address bar (HTTPS, also called TLS).

It protects you from: people on the same Wi-Fi, your internet provider, anyone snooping on the network cables between you and the server.

It doesn’t protect you from: the server itself. Once your file arrives, the server decrypts it to handle it. A service with only in-transit encryption can technically see your file while it’s handling it.

Every reputable service has this. It’s the baseline, not a feature.

2. Encryption at rest

This means files are encrypted while they’re stored on the service’s disks.

It protects you from: someone stealing a hard drive out of a data centre, or a sloppy backup getting leaked.

It doesn’t protect you from: the service. They hold the keys, because they need to decrypt your file when the recipient downloads it.

You’ll mostly see this with upload-and-store services. A direct transfer doesn’t store anything, so there’s nothing at rest to encrypt.

3. End-to-end encryption (E2E)

This means the file is encrypted on the sender’s device and only decrypted on the receiver’s device. Any server in the middle only ever sees scrambled data, and doesn’t have the key to unscramble it.

It protects you from: basically everyone in between, including the service itself.

It doesn’t protect you from: a compromised device at either end, or sending the link to the wrong person.

This is the strongest of the three. It’s also where the marketing gets fuzzy, so it’s worth checking how a service actually achieves it.

How BoltShare fits in

We’d rather be specific than vague, so here’s exactly how each BoltShare mode works:

• Direct P2P mode is end-to-end encrypted. The two browsers connect with WebRTC, which encrypts everything with keys the browsers create themselves. If the connection has to go through a TURN relay, the relay only forwards encrypted packets.
• Bolt Tunnel mode is encrypted in transit, not end to end. Your browser has a secure (TLS) connection to our relay, and so does the receiver’s. The relay forwards the file between them in memory. It doesn’t store it, inspect it or log it, but it does technically handle the unencrypted bytes in between.

Bolt Tunnel exists because direct connections fail on a lot of networks (here’s why). If the files are sensitive and you can use Direct P2P, use it. Or add your own encryption, below. There’s more on the two modes in this post, and our privacy policy spells out exactly what our servers see.

Adding your own layer (works with any service)

If something is genuinely sensitive (contracts, medical records, ID scans), don’t rely on any single service’s promise. Encrypt the file yourself before sending it. Then it doesn’t matter how the transfer works, because what travels is already locked.

The easiest free way is 7-Zip (Windows) or Keka (Mac):

1. Add the files to a new archive.
2. Set a strong password, and pick AES-256 encryption.
3. If you use the .7z format, turn on Encrypt file names too, so the archive doesn’t even reveal what’s inside.
4. Send the archive however you like.
5. Send the password a different way: a text message, a phone call, Signal. Never in the same email as the link.

That last step matters more than the encryption itself. If the link and the password travel together, anyone who gets one gets both.

The bit encryption can’t fix

The most common way files end up in the wrong hands isn’t hacking. It’s a link pasted into the wrong chat, or forwarded by a recipient. Before you hit send:

• Double-check who you’re sending to.
• Prefer tools where links stop working once the transfer is done or the session ends. Direct transfer links stop working when the sender closes their tab.
• For upload services, set the shortest expiry you can live with, and a password if it’s offered.