dove
Open source · your infrastructure

Send a file.
Then forget it.

dove is a small CLI for sharing files from your own cloud. Links expire. Access is limited. In full mode, the server serving the file cannot read it. Under 2 GB, the recipient needs only their browser.

Install dove View on GitHub
~/project

$ dove share release.zip \

--expires 2d --downloads 3

encrypting •••••••••• 100%

uploaded 842 MB

https://share.example/d/k7mx2#key

expires in 2 days · 3 downloads

One command. No dashboard to babysit.

The model

A backup tool encrypts to you and locks everything down. dove turns that inside out: it encrypts to a link, grants exactly the access you allow, then cleans up.

Why dove

Control for the sender.
Almost nothing for the receiver.

Running the secure side from your own infrastructure should not turn every recipient into an operator.

< 2 GB

A link and a browser. That’s it.

For an encrypted dove share under 2 GB, the recipient needs no account, extension, CLI, or cloud login. They open the link, click once, and the browser decrypts the file locally before saving it.

Opening the page does not consume a one-time download.

  1. 01
    Open the link

    The key stays in the URL fragment.

  2. 02
    Click decrypt & save

    The explicit click starts the real download.

  3. 03
    Save the file

    Decryption happens on the recipient’s device.

Why not just use…

Good tools. Different boundaries.

These products are reasonable choices in their lanes. dove is for the combination of your cloud, verifiable client-side encryption, enforceable access policy, and a recipient path that stays simple.

Hosted transferWeTransfer

Familiar hosted delivery.

Useful when a managed transfer service is the priority. Choose dove when the file should live in infrastructure you control and, in full mode, the serving system must never receive the decryption key.

Cloud suiteDropbox Transfer

Strong inside a Dropbox workflow.

Recipients can download without an account, and eligible plans add passwords and longer expirations. dove adds client-side ciphertext, one/N download policy, and storage in your cloud.

Encrypted web transferWormhole

The closest browser-first alternative.

Wormhole offers end-to-end encrypted, expiring transfers in the browser. dove is for teams that also want own-cloud deployment, CLI automation, PIN gates, download counts, and signed releases.

Peer-to-peer CLIMagic Wormhole

Excellent between technical users.

Both people run a client and enter the same short code. dove keeps the sender’s CLI workflow while letting recipients handle encrypted files under 2 GB with only a browser.

Product features and plans change. The names above link to each product’s current documentation or site; the comparison is about architecture, not a claim that one tool fits every transfer.

Choose your boundary

Simple when simple is enough.
Full when privacy matters.

01
Simple

A private bucket and an expiring link.

dove uploads to your S3 bucket and creates a presigned URL. The bucket lifecycle cleans up later.

  • Provisions in seconds
  • No server to run
  • Expires in up to 7 days
dove provision simple
02
Full · encrypted

The server serves it.
The server can't read it.

Files are encrypted on your machine before upload. Your cloud enforces expiry and download counts without ever receiving the key.

  • AES-256-GCM, client-side
  • One-time or N-time access
  • Optional PIN over a second channel
  • Links can live beyond 7 days
dove provision full
Why the server can't read it

The secret stays after the #.

In a dove link, the decryption key lives in the URL fragment. Browsers never send that part to a server. The page reads it locally and decrypts the file on your device.

Your infrastructure sees the share ID and encrypted bytes. It can approve a download, count it, or expire it—but it never sees the key.

https://share.example/d/k7mx2#ve4P...8q
sent to servershare idstays in browserdecryption key
ciphertext
key in #
your file
PIN-locked shares

A link plus a PIN, over two channels.

For credentials, recovery codes, or banking details, require a short PIN and send it separately by text or call. The gate rate-limits guesses and locks the share after repeated failures. The PIN controls access; the fragment secret stays on the recipient’s device and controls decryption. The server can’t read the file either way.

Security boundaries

What dove protects—and what it doesn’t.

Trust starts with a precise claim. These boundaries are part of the design, not fine print.

Full mode hides content

Encryption happens before upload. Storage, CDN, and the access gate receive ciphertext, never the fragment key.

Simple mode is plaintext

The bucket is private and the link expires, but your cloud provider can read the object. Use full mode when that matters.

Operators host share pages

An operator controls their page’s HTML. Treat dove.sh and the official GitHub repository as the only software sources.

No audit claim

The design and source are public. dove does not claim an independent security audit unless one is completed and published.

Straight answers

Before you trust dove with a file.

The useful details, without turning the security model into a slogan.

What is dove?
dove is an open-source command-line tool for sharing expiring files from your own cloud. It supports simple presigned links and full, client-side encrypted shares.
Can the server read a shared file?
Not in full mode. dove encrypts the file on the sender’s machine and keeps the decryption key in the URL fragment, which browsers do not send to servers. Simple mode uses a private bucket and expiring URL, but the cloud provider can read the object.
Does the recipient need to install dove?
Not for encrypted files under 2 GB. The recipient opens the link, clicks once, and the browser decrypts and saves the file locally. Files 2 GB and larger use a pre-filled dove get command so decryption can stream to disk.
Where does dove store files?
In infrastructure you control. Simple mode uploads to your private S3 bucket. Full mode stores encrypted chunks and lets your access gate enforce expiry and download limits without receiving the decryption key.
How are releases verified?
Official releases include checksums, a Sigstore certificate, and a signature tied to dove’s public GitHub Actions release workflow. macOS releases are also notarized.
Which platforms does dove support?
dove provides install paths for macOS, Linux, and Windows through Homebrew, Scoop, Cargo, and the official shell installer.
Here for a shared file?

Under 2 GB? Just open the link.

No account, extension, or dove install. Click once and your browser decrypts the file locally, then offers it to save.

Browser receive
project-archive.zip24.8 MB
Decrypt & save file

2 GB or larger? The same page gives you an exact, pre-filled dove get <url> command to stream it to disk.

Canonical install

Get dove from the source.

This is dove's official install page. Release binaries are checksummed, signed with Sigstore, recorded in a public transparency log, and notarized on macOS.

Verify a release on GitHub 
brew install boomctl/tap/dove

Inspect install.sh on GitHub before running it.

Verify a release

Don’t take the download on faith.

Every release includes a checksum manifest, a Sigstore certificate, and a signature. The signer must be dove’s GitHub release workflow—not a private key or an unknown account.

01

Download the binary, SHA256SUMS, and matching .sig and .pem files from the same release.

02

Check the bytes.

sha256sum --check SHA256SUMS --ignore-missing
03

Verify the GitHub Actions identity.

cosign verify-blob --certificate dove-…pem --signature dove-…sig
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
  --certificate-identity-regexp 'github.com/boomctl/dove/.github/workflows/release.yml' dove-…
Inspect the signing workflow