u5.io

Easy secure transfer. Any device. No accounts, no logins.

How u5 works

u5 lets you send text, images, and files to yourself across devices. No account needed - just visit the same URL on any device to access your session.

Two types of sessions

Passwordless sessions

Quick and easy. Your data is encrypted using a key derived from the session URL. Anyone with the URL can access the session.

Expire after 7 days of inactivity
Messages older than 7 days are deleted
Good for temporary transfers between your own devices

Password-protected sessions

Add a password for real security. Your data is encrypted with a key derived from both the URL and your password.

Never expire - keep them forever
True end-to-end encryption - even the server operator cannot read your data
Suitable for sensitive information

Is it secure?

Passwordless: Reasonably secure for everyday use. The server could technically decrypt your data since the URL is known to it. Think of it like a private link - secure unless someone gets the link.

Password-protected: Fully secure. The encryption key is derived partly from your password, which only exists in your head. Without the password, the data is meaningless - even to someone with full server access.

Technical details

Encryption

All data is encrypted client-side using AES-256-GCM, an authenticated encryption scheme that provides both confidentiality and integrity.

Key derivation

Encryption keys are derived using PBKDF2 with SHA-256:

Passwordless: Key = PBKDF2(session_slug, server_salt, 100,000 iterations)
Password-protected: Key = PBKDF2(session_slug + password, server_salt, 100,000 iterations)

The session slug is hashed before being sent to the server, so the server only sees a hash, not the actual slug you type.

What the server stores

A hash of your session slug (SHA-256, 100,000 PBKDF2 iterations)
A random salt used for key derivation
Your encrypted messages (ciphertext + IV)
Whether the session has a password (boolean flag)

What the server never sees

Your actual session slug (only its hash)
Your password (never transmitted)
Your decrypted messages
Your encryption key

Security boundaries

Passwordless sessions: The encryption key can be reconstructed by the server since it knows the slug hash and salt. An attacker with server access could potentially derive the key by brute-forcing common slugs. For this reason, passwordless sessions should be considered secure against network eavesdroppers and casual attackers, but not against a compromised server.

Password-protected sessions: The key derivation includes your password, which is never sent to the server. Even with full database access, an attacker would need to brute-force both your slug AND your password simultaneously, which is computationally infeasible with a strong password (minimum 10 characters required).

Implementation

All cryptography uses the Web Crypto API - the browser's built-in cryptographic primitives. No third-party crypto libraries. The entire client is vanilla JavaScript with no dependencies.

To access anywhere, nav to:

Protected

Delete Session?

This action is permanent and irreversible. All messages and images in this session will be deleted forever.

Session:

Session Not Found

This session doesn't exist or has expired. Passwordless sessions are deleted after 7 days of inactivity.

Password-Protected Sessions

Password-protected sessions offer significant advantages:

Permanent storage - Your session never expires, regardless of inactivity
True end-to-end encryption - Even with full server access, your data cannot be read
Stronger security - The encryption key is derived from your password, which only you know

You can add password protection to any session at any time using the "Protect" button.

Password Required

This session is password-protected.

Incorrect password

Key remembered on this device

Session Unlocked

Remember on this device

Anyone with access to this browser can view this session without the password.

Add Password Protection

Once set, a password will be required to access this session. This cannot be undone.

Re-encrypting messages...

Install u5.io

To install u5 on your iPhone or iPad:

Tap the Share button in Safari's toolbar
Scroll down and tap "Add to Home Screen"
Tap "Add" in the top right

Once installed, you can share directly to u5 from any app.

Session expires after 7 days of inactivity. More info

Messages older than 7 days are automatically deleted from passwordless sessions.

Passwordless sessions are reasonably secure against casual attackers, but not against determined ones. For actual security (real end-to-end encryption), add a password - your session becomes permanent and fully encrypted. Even root access to the server cannot read your messages.

Add password protection for permanent, secure storage

Loading more...

— Beginning of history —

Send text or images to yourself from any device.