API Documentation
Everything you need to integrate with transfer.injected.wtf — upload and download encrypted files with curl, wget, or any HTTP client.
One-Command Upload
Upload any file with a single curl command and get a shareable link back instantly.
Encrypted at Rest
XChaCha20-Poly1305 encryption on the server. No client-side setup, no keys to manage.
Auto-Expiring
Files are automatically deleted after the configured expiration period. 30-day maximum.
Overview
transfer.injected.wtf is an encrypted, ephemeral file sharing service. Every file uploaded is encrypted on the server with XChaCha20-Poly1305 before it touches disk. Downloads are decrypted on-the-fly and streamed over TLS.
There is no client-side encryption and no decryption key needed. URLs are public and work everywhere — browsers, curl, wget, scripts. The goal is protecting data at rest in case of a server-side data leak.
Quick Start
CLI Upload
Upload files from the command line using PUT requests. The filename in the URL path determines the download filename.
PUT /:filename
Stream a file to the server via HTTP PUT. This is the simplest method and works with curl's --upload-file flag.
POST /api/upload
Alternatively, use a multipart form POST. This is what the web UI uses internally. Accepts a file field and an optional maxDays field.
Request Headers
| Header | Description | Default |
|---|---|---|
| X-Filename | Override the filename from the URL path | Path segment |
| X-Max-Days | Number of days before the file auto-deletes (1–30) | 14 |
| Content-Type | MIME type of the file (auto-detected if not provided) | application/octet-stream |
Web Upload
The web interface provides a drag-and-drop upload experience with real-time progress tracking.
How It Works
The web uploader uses the POST /api/upload endpoint internally. Simply drag a file onto the upload card, set your desired expiry, and click Upload.
Features
| Feature | Details |
|---|---|
| Drag & drop | Drop files anywhere on the upload card |
| Clipboard paste | Paste files or screenshots directly with Ctrl+V |
| Progress bar | Real-time XHR upload progress with percentage |
| Custom expiry | Choose 1–30 days via the stepper control |
| Copy link | One-click copy of the resulting download URL |
Download
Every uploaded file gets a unique, shareable download URL that works in any browser or HTTP client.
URL Format
Download URLs follow this pattern:
The server decrypts the file on-the-fly and streams it directly to you over TLS. No special client or decryption key is needed.
curl Download
File Info API
Get metadata about a file without downloading it:
Raw Download API
Force a raw binary download (bypasses browser content negotiation):
Content-Length header so progress bars work correctly in curl, wget, and browsers.
Encryption
All files are encrypted server-side before being written to disk, protecting against data breaches and disk theft.
Algorithm
| Property | Value |
|---|---|
| Cipher | XChaCha20-Poly1305 |
| Key size | 256-bit |
| Nonce size | 192-bit (extended nonce) |
| Authentication | Poly1305 MAC (authenticated encryption) |
| Key derivation | Unique random key per file |
How It Works
1. You upload a file via PUT or POST.
2. The server generates a unique 256-bit key and 192-bit nonce.
3. The file is encrypted with XChaCha20-Poly1305 and written to disk.
4. The key and nonce are stored in a metadata database (not on disk with the file).
5. On download, the server reads the key from the database, decrypts the file in a stream, and sends it over TLS.
6. When the file expires, both the encrypted file and metadata are permanently deleted.
Limits
The following limits are enforced to keep the service running smoothly for everyone.
Service Limits
| Limit | Value | Notes |
|---|---|---|
| Max file size | 10 GB | Per-upload limit. Larger files are rejected. |
| Max expiry | 30 days | Files are auto-deleted after expiry. Default is 14 days. |
| Min expiry | 1 day | Cannot be set lower than 24 hours. |
| Rate limit | 10 req/min | Per-IP upload rate limit. Downloads are not rate limited. |
429 Too Many Requests response. Wait a minute and try again.
Response Format
All API responses are JSON. Here are the response shapes for each endpoint.
Upload Success (200)
File Info (200)
Error Response (4xx / 5xx)
HTTP Status Codes
| Code | Meaning |
|---|---|
| 200 | Success — upload complete or file info returned |
| 400 | Bad request — missing file, invalid parameters |
| 404 | File not found or expired |
| 413 | File too large (exceeds 10 GB limit) |
| 429 | Rate limit exceeded — wait and retry |
| 500 | Server error — unexpected failure |