Nygma security
Built so we can’t read your files.
Military-grade encryption happens on your device, with keys only you hold. Our servers store scrambled data and nothing that could unscramble it — so it stays private even from us, and even under a court order.
In plain words
What we can see. What we can’t.
Never readable by us
- What is inside your files
- File and folder names
- Photo thumbnails and video previews
- File details such as the file type
- Your drive passwords and Quick PINs
- Your 24-word recovery keys
- The password on a protected share link
What our servers do know
- Your email address and name
- The names you give your drives
- How many files you have and how big they are
- File dates, such as when each was uploaded
- Your plan and payments
- IP addresses in our server logs
Tip: give a drive an everyday name. The name is the one thing about a drive we can read.
If we are ever made to hand over an account, all we can give is the list on the right and data nobody can read without your password.
Proof of encryption, on every file.
Open a file’s menu and choose Proof of encryption. You see your file next to exactly what our servers store for it: scrambled bytes and a scrambled name.
The technical details
How it works under the hood.
File encryption
AES-256-GCM on every plan, with a separate key for every file and every preview (HKDF-SHA256 subkeys, a fresh IV each time). ChaCha20-Poly1305 is also available on Professional and Power in the phone apps.
Your drive key
Made on your device from your drive password with PBKDF2-SHA256 and 100,000 iterations. The password never leaves your device; we keep only a value that checks it, which cannot be turned back into it.
Recovery key
Each drive has 24 words, shown once when you make it. They can set a new password. We have no copy, so we cannot reset a drive for you — and nobody can ask us to.
Share links
A public link carries its key after the # sign, which browsers never send to a server. A protected link is unlocked with a password we never see. Files are decrypted in the recipient’s browser.
Sign-in
No account password: a 6-digit code by email, plus an authenticator app if you turn on two-step sign-in. Signing out ends every session, on every device.
In transit
Everything travels over TLS on top of the encryption above. The phone apps also pin our certificates.
Step by step: encrypted drives, sharing and Advanced protection. More detail in our zero-knowledge statement and security practices.
Private by design. Free to try.
Make your first encrypted drive in a minute.
4 GB free, up to 10 GB with friends. No card. Works in your browser today.