ProtectedShare vs EnvShare
EnvShare showed how simple sharing a .env file can be: encrypt in the browser, put the key in the link, limit the reads. ProtectedShare keeps that model and adds the tools around it.
Feature comparison
| Feature | EnvShare | ProtectedShare |
|---|---|---|
| Encrypts in your browser before upload | ||
| Encrypts in your browser before upload | Yes | Yes |
| Read limits | ||
| Read limits | Yes | Yes |
| Expires after a set time | ||
| Expires after a set time | Yes | Yes |
| Separate password instead of a key in the link | ||
| Separate password instead of a key in the link | Not stated | Yes |
| Check status or revoke after sending | ||
| Check status or revoke after sending | Not stated | Partial |
| Encrypted file sharing | ||
| Encrypted file sharing | No | Yes |
| Ask someone to send you a secret | ||
| Ask someone to send you a secret | No | Yes |
| Open source | ||
| Open source | Yes | Yes |
| Self-hostable | ||
| Self-hostable | Yes | Yes |
| Works without an account | ||
| Works without an account | Yes | Yes |
Same core, different stack
Both encrypt with AES-GCM before upload and keep the key out of the server's hands. EnvShare stores ciphertext in Upstash Redis and deploys on Vercel. ProtectedShare stores it in Cloudflare D1, behind a Worker, with a cron that deletes expired rows every 30 minutes.
ProtectedShare's v2 format derives two values from your key with HKDF: one encrypts, the other is a token whose hash the server checks before releasing ciphertext. So a guessed link id alone gets nothing.
What ProtectedShare adds
- Secure notes that can burn after reading and use a separately sent password.
- File drop: encrypted files up to 25 MB, with a download limit.
- Secret request: ask someone for a credential, encrypted to a key only you hold.
- My links: see if a link was opened, and revoke it, from the browser that made it.
Try it on ProtectedShare
Free, with no account. Each tool encrypts in your browser before anything is uploaded. The security model lists exactly what the server stores.
- Secure NotesA note encrypted in your browser. Burns after one read by default; add a password to send separately.
- EnvShare.env files, API keys and passwords, deleted after 1 to 100 reads or at expiry.
- File dropFiles up to 25 MB, encrypted in your browser and deleted after 1 to 100 downloads.
- Secret requestSend someone a link. What they type back is encrypted to a key only your browser holds.
Questions
What makes ProtectedShare a good EnvShare alternative?
EnvShare and ProtectedShare share the same core idea: encrypt in the browser with AES-GCM and keep the key in the link. ProtectedShare builds around it with secure notes that can use a separate password, encrypted file drops up to 25 MB, secret requests, and a My links page to check whether a link was opened or revoke it.
How does EnvShare compare to ProtectedShare's Secure Notes?
ProtectedShare's EnvShare tool works like EnvShare: the key is in the link and the secret deletes after a set number of reads. Secure Notes can do the same, or keep the password off the link so you can send it through a second channel.
Can I self-host my own instance of ProtectedShare?
Yes. It's MIT licensed. The API runs as a Cloudflare Worker with a D1 database and a 30-minute cleanup cron, and the web app is published as a Docker image you point at your API with API_BACKEND_URL. The self-host page walks through it.