How Filetico protects your files
This page describes, with the same technical detail we'd use internally, what gets encrypted, when, with which algorithm, and what falls outside end-to-end encryption. No marketing language — just how it works.
The model in four points
End-to-end encryption per folder
Mark any folder as encrypted and its contents are encrypted with AES-256-GCM using a key derived from your password (PBKDF2-SHA256, 210,000 iterations) directly on your browser or device. The key is never transmitted to or stored on our servers.
Verification without knowing your password
To check that you typed the right password, we only store an encrypted verifier and its salt — useless data without the original password. This lets us validate access without your real key ever passing through our servers.
TLS in transit, across the platform
All communication between your devices (web, Windows, iOS, Android) and our servers travels over TLS, whether you use encrypted folders or not.
No backdoor, by design
There is no "recover password" feature for encrypted folders. If you lose it, we can't open them either — that's the proof the encryption is real.
How the encryption works, step by step
- You mark a folder as encrypted and choose a password. Everything you upload to that folder (and its subfolders, which inherit the encryption) goes through this process.
- Your device generates a random 16-byte salt and derives an AES-256 key from your password using PBKDF2-HMAC-SHA256 (210,000 iterations), via the browser's or app's native Web Crypto API.
- That key encrypts a known constant value to create a verifier: it lets us later confirm you typed the correct password without the password or the key ever reaching our servers. We only store the salt, the encrypted verifier and its IV — non-secret data by design.
- Each file is individually encrypted with AES-256-GCM and a random 12-byte IV before upload. Our servers receive and store only the already-encrypted file, along with the IV (needed to decrypt, but useless without the key).
- When you open the file, your device re-derives the same key from your password and the stored salt, and decrypts the content locally. Decryption never happens on our servers.
What Filetico encrypts, and what it doesn't
An honest comparison between an encrypted folder and a regular one.
Authentication, sessions and infrastructure
Your account password (the one you use to sign in) is independent from an encrypted folder's password and is never stored in plain text — it's kept as a hash unique to your account. Sessions are managed with signed, expiring tokens (JWT).
Files are stored with an S3-compatible object storage provider. Neither your browser nor any app uploads or downloads files against permanent credentials: every operation uses a one-time, short-lived signed URL, and all transfers travel over TLS.
When you delete a file, it's also removed from the underlying storage (and its thumbnail, if one existed) — no copy remains accessible from your account.
Known limitations
We publish this on purpose: a security model with no stated limits isn't credible.
- End-to-end encryption is opt-in and applies per folder. Folders you don't mark as encrypted don't get this extra layer of protection.
- File and folder names, size, type and upload date are not encrypted, even inside an encrypted folder — only the file content is.
- There is no password recovery for encrypted folders. Losing the password means permanently losing access to that content.
- Files inside encrypted folders cannot be shared via a public link; this is a design restriction, not a bug.
Frequently asked questions
Can Filetico see the content of my files?
Inside encrypted folders, no: content is encrypted and decrypted only on your device, and our servers only ever store the encrypted result. In regular folders, content is stored without this extra end-to-end encryption layer, though all transmission still travels over TLS.
What encryption algorithm does Filetico use?
AES-256-GCM for file content. The key is derived from your password with PBKDF2-SHA256 (210,000 iterations) directly on your device via the Web Crypto API; that key is never transmitted to our servers.
Are my file names encrypted too?
No. Currently only file content is end-to-end encrypted. The file name, folder name, size and upload date are stored unencrypted so they can be displayed in your file manager.
What happens if I forget the password to an encrypted folder?
We can't recover it for you. Since we never store your password or the derived key, there's no backdoor for us either. Keep encrypted-folder passwords in a trusted password manager.
Can I share a file that's inside an encrypted folder?
Not via a public link — that's an intentional restriction. Files in regular (non-encrypted) folders can be shared with a link, an optional password and an expiration date.