resfss

resfss API

Local list (this browser). del deletes the shared file. × drops from list only.

↑ Upload

All files

Path

Upload

Uploads (14d)

Storage split

Encryption

Top users

auto-refresh 15s

not loaded

Requests

not loaded

Database

not loaded

Transfers and spool

not loaded

Storage, cache, and S3

not loaded

Cold storage

not loaded

Workers

not loaded

Runtime

not loaded

Failures

not loaded

Auth

Allow new registrations Allow anonymous share uploads

Cold storage

Show cold status to members Verify uploaded archives before sealing Mode Optimization Cold cost ratio Restore cost ratio Minimum benefit ratio Risk archive bytes Repack minimum bytes Repack minimum age Repack max archives per run Repack max bytes per run Repack retry base Repack retry max Archive affinity Archive minimum fill ratio Partial restore bytes Partial restore fraction Restore repeat count Restore repeat window Archive scrub interval Archive scrub bytes Archive scrub batch Decode scrub interval Decode scrub bytes Decode scrub batch Auto-tune model threshold Auto-tune minimum probability Auto-tune maximum probability Auto-tune maximum daily step Model minimum outcomes Model outcome batch Model outcomes per evaluation Codec profile minimum samples Codec exploration (%) Catalog backfill batch Demand restore weight Retry restore weight Pack workers CPU duty (%) Read rate (bytes/s) Write rate (bytes/s) Files per run Bytes per run History retention (days) Restore attempts Restore retry base

Limits

Max upload (bytes) Delegated decrypt max

Anonymous

Max file size Daily uploads Bandwidth (bytes)

Member

Default quota BW upload BW download

Rate limit (RPM)

Global Per IP Per key

Cold storage policies

not loaded

Filter

crypto.js

// resfss client-side encryption — RSFC chunked AES-256-GCM + Argon2id wrapped DEK

const ARGON2_TIME = 3;
const ARGON2_MEM = 19456;
const ARGON2_PAR = 4;
const SALT_LEN = 16;
const NONCE_LEN = 12;
const KEY_LEN = 32;
const CHUNK_PLAIN = 4 << 20;
const CHUNK_MAGIC = 'RSFC';

async function deriveKey(password, salt) {
  const { hash } = await argon2.hash({
    pass: password,
    salt,
    time: ARGON2_TIME,
    mem: ARGON2_MEM,
    hashLen: KEY_LEN,
    parallelism: ARGON2_PAR,
    type: argon2.ArgonType.Argon2id,
    raw: true,
  });
  return crypto.subtle.importKey('raw', hash, 'AES-GCM', false, ['encrypt', 'decrypt']);
}

async function wrapKey(password, dek) {
  const salt = crypto.getRandomValues(new Uint8Array(SALT_LEN));
  const kek = await deriveKey(password, salt);
  const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LEN));
  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, kek, dek);
  return JSON.stringify({
    salt: b64(salt),
    nonce: b64(nonce),
    ciphertext: b64(new Uint8Array(ct)),
  });
}

async function unwrapKey(password, wrappedJSON) {
  const wk = JSON.parse(wrappedJSON);
  const salt = unb64(wk.salt);
  const nonce = unb64(wk.nonce);
  const ct = unb64(wk.ciphertext);
  const kek = await deriveKey(password, salt);
  return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, kek, ct));
}

function chunkHeader() {
  const h = new Uint8Array(12);
  h[0] = CHUNK_MAGIC.charCodeAt(0);
  h[1] = CHUNK_MAGIC.charCodeAt(1);
  h[2] = CHUNK_MAGIC.charCodeAt(2);
  h[3] = CHUNK_MAGIC.charCodeAt(3);
  h[4] = 2;
  new DataView(h.buffer).setUint32(8, CHUNK_PLAIN, false);
  return h;
}

function streamAAD(index, final) {
  const aad = new Uint8Array(14);
  aad.set(new TextEncoder().encode('RSFC2'));
  new DataView(aad.buffer).setBigUint64(5, BigInt(index), false);
  aad[13] = final ? 1 : 0;
  return aad;
}

async function encryptChunk(key, plain, index, final = false) {
  const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LEN));
  const ct = new Uint8Array(await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv: nonce, additionalData: streamAAD(index, final) }, key, plain));
  const meta = new Uint8Array(NONCE_LEN + 4 + ct.length);
  meta.set(nonce, 0);
  new DataView(meta.buffer).setUint32(NONCE_LEN, ct.length, false);
  meta.set(ct, NONCE_LEN + 4);
  return meta;
}

async function encryptFile(file, password, onProgress) {
  const dek = crypto.getRandomValues(new Uint8Array(KEY_LEN));
  const key = await crypto.subtle.importKey('raw', dek, 'AES-GCM', false, ['encrypt']);
  const parts = [chunkHeader()];
  let offset = 0;
  let index = 0;
  while (offset < file.size) {
    const end = Math.min(offset + CHUNK_PLAIN, file.size);
    const buf = new Uint8Array(await file.slice(offset, end).arrayBuffer());
    parts.push(await encryptChunk(key, buf, index++));
    offset = end;
    if (onProgress) onProgress(offset, file.size);
  }
  parts.push(await encryptChunk(key, new Uint8Array(), index, true));
  const wrapped_key = await wrapKey(password, dek);
  return { ciphertext: new Blob(parts), wrapped_key };
}

async function decryptFile(ciphertext, password, wrappedKeyJSON) {
  const dek = await unwrapKey(password, wrappedKeyJSON);
  const blob = ciphertext instanceof Blob ? ciphertext : new Blob([ciphertext]);
  const head = new Uint8Array(await blob.slice(0, 12).arrayBuffer());
  if (head.length !== 12 || head[0] !== CHUNK_MAGIC.charCodeAt(0) || head[1] !== CHUNK_MAGIC.charCodeAt(1) ||
      head[2] !== CHUNK_MAGIC.charCodeAt(2) || head[3] !== CHUNK_MAGIC.charCodeAt(3) ||
      head[4] !== 2 || new DataView(head.buffer).getUint32(8, false) !== CHUNK_PLAIN) {
    throw new Error('invalid ciphertext format');
  }
  const key = await crypto.subtle.importKey('raw', dek, 'AES-GCM', false, ['decrypt']);
  const parts = [];
  let offset = 12;
  let index = 0;
  let terminal = false;
  while (offset < blob.size) {
    const meta = new Uint8Array(await blob.slice(offset, offset + NONCE_LEN + 4).arrayBuffer());
    if (meta.length !== NONCE_LEN + 4) throw new Error('truncated ciphertext metadata');
    const ctLen = new DataView(meta.buffer).getUint32(NONCE_LEN, false);
    if (ctLen < 16 || ctLen > CHUNK_PLAIN + 16) throw new Error('invalid ciphertext chunk length');
    offset += NONCE_LEN + 4;
    const ct = new Uint8Array(await blob.slice(offset, offset + ctLen).arrayBuffer());
    if (ct.length !== ctLen) throw new Error('truncated ciphertext chunk');
    offset += ctLen;
    const final = ctLen === 16;
    const alg = { name: 'AES-GCM', iv: meta.slice(0, NONCE_LEN) };
    alg.additionalData = streamAAD(index, final);
    const pt = await crypto.subtle.decrypt(alg, key, ct);
    if (final) {
      if (pt.byteLength !== 0 || offset !== blob.size) throw new Error('invalid ciphertext terminal chunk');
      terminal = true;
      break;
    }
    if (pt.byteLength === 0) throw new Error('invalid empty ciphertext chunk');
    parts.push(new Uint8Array(pt));
    index++;
  }
  if (!terminal) throw new Error('truncated ciphertext');
  const total = parts.reduce((n, p) => n + p.length, 0);
  const out = new Uint8Array(total);
  let pos = 0;
  for (const p of parts) {
    out.set(p, pos);
    pos += p.length;
  }
  return out;
}

function b64(buf) {
  return btoa(String.fromCharCode(...buf));
}

function unb64(s) {
  return Uint8Array.from(atob(s), c => c.charCodeAt(0));
}

Verify email

Register

Resend verification

API key login

API keys

S3-compatible access

Usage

Profile

Delete account

Uploads (14d)

Storage split

Encryption

Top users

Requests

Database

Transfers and spool

Storage, cache, and S3

Cold storage

Workers

Runtime

Failures

Auth

Cold storage

Limits

Anonymous

Member

Rate limit (RPM)

Cold storage policies

Share

Verify email

Login

Register

Resend verification

API key login

API keys

S3-compatible access

Usage

Profile

Delete account

Uploads (14d)

Storage split

Encryption

Top users

Requests

Database

Transfers and spool

Storage, cache, and S3

Cold storage

Workers

Runtime

Failures

Auth

Cold storage

Limits

Anonymous

Member

Rate limit (RPM)

Cold storage policies