Personal
Family, friends, private groups… Handshake once — that peer is on the ring. No handshake, no drop.
Or join with a code / pasted link (no QR needed):
📝 Drop Memo
🌐 Live Translation QR Code (Optional myLingo.ai Translation Service)
⚠️ This is the one feature that sends data off your device unencrypted.
While it is on, your memo text is transmitted in plaintext to the myLingo translation
service as you type. Your files and everything else in the drop remain end-to-end
encrypted, and turning this off stops transmission immediately.
Session: ------
Scan with myLingo.ai for live translation
Drop files here
or click to browse • Free Tier up to 30 MB per drop
📡 Initiate Handshake
Handshake once for trust — then that peer is on the ring. Share the XXXX-XXXX code with your peer via voice, SMS, or in person. The code is never sent through OmniDROP.
🔑 Respond to Handshake
Enter the XXXX-XXXX code your peer shared with you. You’ll assign an alias so they’re easy to find in PO Boxes.
No PO Boxes yet
Handshake once to add a two-way PO Box. No handshake, no drop.
No activity yet
Transfers and handshakes will appear here. This log stays on this tab until you save or clear it.
🛡️ Sovereign Security Baseline
OmniDROP encrypts payloads on your device before they hit the relay. The gateway is a ciphertext-only RAM conduit—it never holds your keys or file plaintext—but it can still see connection metadata (who connects when, sizes, timing). That is by design for a global relay, not a mixnet. Your OS and ISP can also leak browsing metadata; privacy-first DNS (below) helps that layer.
Cloudflare WARP (1.1.1.1)
A fast, free VPN-like app that encrypts your internet traffic and hides it from your ISP. The easiest way to secure a phone or laptop on public Wi-Fi.
Get Cloudflare WARPQuad9 (9.9.9.9)
A non-profit Swiss DNS resolver that automatically blocks known malware, phishing, and spyware domains across your entire device.
Quad9 Setup Guide🔑 Sovereign Key Backup & Passphrase Recovery
Your private keys are generated and kept on this device—OmniDROP operators cannot recover them or decrypt your sealed packages. Create an encrypted backup bundle with a secret passphrase to restore your identity on a new phone or computer. Passphrase at-rest protection and lock-on-hide reduce exposure; they do not make unlocked keys safe against XSS on this origin.
Node ID:
--
Key Fingerprint:
--
Your plan
Plan
Free Tier
Allowance
10 drops / day · up to 30 MB
Pass Code
—
On-Demand is a one-time pass — no subscription to manage; no refunds.
No paid drops left — you’re on Free Tier. Daily free drops reset at midnight UTC. Upgrade anytime for high-capacity drops.
Paid drops follow your pass key (pass_…), not your key backup. Save it when you buy — OmniDROP cannot recover a lost pass key. The DROP-XXXX shown above is a receipt label for support, not something you can restore with.
Protect Identity At Rest (this browser)
Encrypt local private keys with your passphrase (PBKDF2 600k + AES-GCM). Required on each new session. Stronger than origin-derived obfuscation.
Passphrase protects keys at rest. While unlocked, any script on this origin (XSS or extension) can read keys.
CSP and lock-on-hide reduce risk — they do not make keys XSS-proof. See THREAT_MODEL.md.
Export Encrypted Key Backup
🔒 Encrypted with XSalsa20-Poly1305 + Argon2id key derivation (BLAKE2b fallback if Argon2id unavailable).
Restore Identity from Backup File
No file selected
🚨 Emergency Memory Wipe
Permanently purge local keys and PO Boxes from this device.
📇 Register Email / Phone (2FA)
Link your public key to an email via 2FA. Registration is stored in the
shared directory (Vercel → Supabase), so other browsers can look you up.
Hash-only: Only a domain-separated SHA-256
of your email is stored (server may wrap it with a pepper). Raw email is used only to send the code — never persisted.
🔍 Lookup & Pair by Email
Search the shared hash-only directory by email to discover a peer’s public key, then Establish Trust. Works across browsers once they have registered.
📥 Ready to receive
Stay Connected — trusted PO Boxes can send to you without a QR. No handshake, no drop: strangers are not in the channel. Sharing a link is optional for a new Quick Share pair.
Files stay in this tab until you leave Receive, close the tab, or Clear. Download what you need.
1
Wait until Connected
Green Connected in the header — the homepage alone is not enough.
2
Trusted peer can send
If you’re already in their PO Boxes, just keep this tab open — there is no auto-wipe countdown.
3
Optional: share QR / link
Only needed for a new Quick Share pair — not for Directory / Handshake peers.
Have a code or link from someone else? Join on Send (paste there — Receive only creates).