Passwords, galleries and backgrounds

The options panel in the composer — the slider icon next to the retention selector — carries everything about how a transfer is presented and protected.

Password protection

Set a password and the recipient must enter it before they see anything. Until they do, the page shows only that a password is required: no filenames, no sizes, no message. A list of filenames is often as revealing as the files.

The password is not included in the e-mail. That would defeat the point — anyone who could read the mail could open the transfer. Pass it on by another channel.

Share passwords have a lower minimum than account passwords (4 characters rather than 8) on purpose. They guard a link that already carries 256 bits of entropy in its token, so the password exists to make a forwarded link insufficient — and it gets typed by people reading it off a text message. Online guessing is handled by the download rate limiter instead.

Unlocking sets a cookie scoped to that one transfer. Unlocking one password-protected transfer does not unlock any other.

Choose Gallery and image files are shown as thumbnails in a grid rather than as a list of filenames. This is what makes the app usable for a shoot, an event or a family occasion rather than only for documents. Non-image files in the same transfer are still listed underneath.

Thumbnails are decided by the file's leading bytes, not by its name or the type the uploader declared. A .png containing HTML fails the signature check and is never rendered — it appears in the other-files list and downloads as an attachment like anything else. SVG is deliberately excluded: it is an image, but it is also a document that can carry scripts.

Background images

A sender can put their own photograph behind a transfer's download page, or an instance default can be set with NUXT_PUBLIC_BACKGROUND_IMAGE.

Members can also set a default background under Account. Every transfer they send then carries it — from the web interface, the REST API and the MCP server alike — unless they choose another image for that transfer or remove it in the composer. The compose page shows it too, so the page a member works on looks like the pages their recipients open.

Each transfer gets its own copy of the default when it is created. Replacing or removing the default changes what the next transfer looks like; transfers already created keep the background they started with. The default is deleted with the account.

The download page places its card against one edge specifically to leave the rest of the viewport to the image, and shows it unwashed — there is no text outside the card to protect, so fading the picture would only hide what the sender chose it for.

An image chosen in the composer belongs to the transfer it was set on. It appears on that download page and nowhere else.