Andreas Reinhold / reiniandClaude Opus 5
504971ad7f
Uploaders no longer have to make up a share password. With "Password protect" on, the upload page has Generate and Copy under the field, and the page the upload leads to offers the password once more beside the link: masked, with the same copy button at the end of the field as the link's. The password also derives the share's encryption key and only its hash is stored, so a lost one means files nobody can open. - PasswordGeneratorService draws from Random\Randomizer's secure engine. Characters are drawn uniformly and redrawn until every chosen set appears; passphrases come from EFF's large word list (CC BY 3.0 US, credited in the README), without its four hyphenated words. - Admin settings gain a "Share Passwords" card: mode (off, on request, prefilled as protection is switched on), kind (characters: length 12–64, the sets, look-alikes left out; passphrase: 4–10 words and a separator), and an example with its estimated entropy that follows the form before saving. Fields the chosen mode or kind hides are excluded from validation and keep their saved value. The default is on request, 20 letters and numbers without look-alikes. - FileUploader flashes the password encrypted with the share's token; ShareCreated shows it only when the token matches, so a reload or any other visitor sees nothing. Crypt covers installs without SESSION_ENCRYPT, which the Docker setup does not set. - The symbol set leaves out what chat apps turn into formatting and what breaks inside quotes, so a pasted password arrives unchanged. - app.css imports group.css for <x-group>; .ai/rules/views.md records that <x-group> drops data-test and other attributes. - Tests cover the generator, the admin card's saving, validation and example, prefill and generate on the upload page, the flash, and in Chromium Generate and Copy on the upload page and the masked copy on the share page. The admin settings page now has six headed sections. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
SealShare
A simple, self-hosted file sharing solution built with Laravel. Upload files, get a shareable link, done. All files are encrypted at rest with AES-256-GCM.
Website: sealshare.nonameweb.ch
Screenshots
Features
- File Uploading — Drag & drop or browse to upload single/multiple files and folders with real-time progress
- Shareable Links — Each upload generates a unique link for recipients, also as a QR code (saved as a PNG) or through the device's share sheet
- Encryption at Rest — Files are encrypted on the server as they arrive, with AES-256-GCM (chunked, streaming); with a share password the key is derived from it and never stored. It is not end-to-end encryption: the server handles the files unencrypted while they are uploaded and downloaded
- Password Protection — Optionally protect shares with a password, typed or generated (random characters or a passphrase, as the admin configures) and copied on the upload page or next to the new link
- Expiration — Shares auto-expire after a configurable duration (1 hour to 30 days)
- Download Limits — Set a maximum number of downloads per share
- ZIP Downloads — Download all files in a share as a single ZIP archive
- Auto-Cleanup — Expired shares and files are automatically deleted (hourly)
- Admin Dashboard — View, manage, and delete all shares
- Admin Settings — Configure upload limits, storage quotas, branding, and more
- Site Branding — Custom logo, title, and description
- Colour Profiles — Eight Material 3 colour profiles (Indigo, Blue, Teal, Green, Amber, Rose, Violet, Graphite); the admin picks one for every page, mail and error page
- System Password — Optional global password gate to restrict upload access
- User Authentication — Login, password reset, email verification
- Two-Factor Authentication — TOTP-based 2FA via Laravel Fortify
- Light and Dark Themes — Material 3 Expressive design that follows the system theme, or light or dark by choice
- Setup Wizard — First-run wizard to create the initial admin account
Tech Stack
| Layer | Technology |
|---|---|
| Framework | Laravel 13 |
| Application Server | FrankenPHP (via Laravel Octane) |
| Frontend | Livewire 4, Tailwind CSS 4, Livewire Material (Material 3 Expressive) |
| Authentication | Laravel Fortify |
| Encryption | Chunked AES-256-GCM with PBKDF2-SHA256 key derivation |
| ZIP Downloads | Native PHP ZipArchive |
| Testing | Pest 5 with browser tests (Playwright) |
| Code Style | Laravel Pint |
| Build Tool | Vite |
Installation — Development
Docker (recommended)
# Build and start the dev container
docker compose -f docker-compose.dev.yml up -d --build
# View logs (including Vite output)
docker compose -f docker-compose.dev.yml logs -f
The app is available at http://localhost:8000 with Vite HMR on port 5173.
Installation — Production
Docker (recommended)
mkdir sealshare && cd sealshare
curl -O https://gitea.nonameweb.ch/noNameWEB/SealShare/raw/branch/main/docker-compose.example.yml
cp docker-compose.example.yml docker-compose.yml
# Generate an app key and paste it into docker-compose.yml
docker run --rm gitea.nonameweb.ch/nonameweb/sealshare:latest php artisan key:generate --show
# Edit docker-compose.yml — set APP_KEY, APP_URL, and SERVER_NAME
# Then start:
docker compose up -d
Migrations run automatically on startup. Open your configured domain — the Setup Wizard will create the first admin account.
Key environment variables:
| Variable | Required | Description |
|---|---|---|
APP_KEY |
Yes | Laravel encryption key |
APP_URL |
Yes | Full URL (e.g. https://share.example.com) |
SERVER_NAME |
Yes | Domain for auto-TLS (e.g. share.example.com) |
Volumes:
| Volume | Path | Purpose |
|---|---|---|
sealshare_storage |
/app/storage/app |
Encrypted uploaded files |
sealshare_database |
/app/database |
SQLite database |
caddy_data |
/data |
TLS certificates |
caddy_config |
/config |
Caddy configuration |
Large files:
Uploads beyond the defaults need these limits raised together:
| Limit | Where | Default |
|---|---|---|
PHP_UPLOAD_MAX_FILESIZE / PHP_POST_MAX_SIZE |
Environment | 4G — hard cap per file / per upload batch |
| Max file size / Max size per share | Admin → Settings | 100 MB / 2 GB |
LIVEWIRE_MAX_UPLOAD_TIME |
Environment | 30 minutes per upload |
OCTANE_MAX_EXECUTION_TIME / PHP_MAX_EXECUTION_TIME |
Environment | 300 seconds — encrypting a large file takes a while |
Behind a reverse proxy, raise its request body limit and read timeout as well (nginx: client_max_body_size, proxy_read_timeout).
Manual (without Docker)
git clone https://gitea.nonameweb.ch/noNameWEB/SealShare.git
cd SealShare
composer install --no-dev --optimize-autoloader
npm install && npm run build
cp .env.example .env
php artisan key:generate
# Edit .env — set APP_ENV=production, APP_DEBUG=false, APP_URL=https://your-domain.com
touch database/database.sqlite
php artisan migrate --force
php artisan storage:link
php artisan config:cache
php artisan route:cache
php artisan view:cache
Start with Octane:
php artisan octane:frankenphp --host=0.0.0.0 --port=80
Or point your web server (Nginx/Apache) to the public/ directory for a traditional PHP-FPM setup.
Add the scheduler to your crontab:
* * * * * cd /path-to-sealshare && php artisan schedule:run >> /dev/null 2>&1
License
This project is open-source software licensed under the MIT License.
Generated passphrases draw from the EFF Large Wordlist by the Electronic Frontier Foundation, licensed under CC BY 3.0 US (resources/wordlists/eff-large-wordlist.txt, without its four hyphenated words).