Overview
SetCheck lets you share a file with one named person, encrypted before it ever leaves your machine. The recipient opens a link and the file decrypts locally in their browser. The server only ever holds ciphertext, never the keys and never the content.
The Problem
Sharing an unreleased track meant either uploading it to a service that could read it, or zipping it with a password and hoping the other person could figure it out. I wanted private, per-person sharing that a non-technical friend could open in one click, and I did not want to be responsible for holding data I did not need.
My Approach
Encrypt on the sender's device and put the decryption key in the link fragment, which browsers never send to a server. Store only the encrypted blob. Give recipients a plain web page that decrypts locally, so there is nothing to install and no account to make. Hold as little as technically possible.
Technical Implementation
The crypto is dependency-free: X25519 key exchange with HKDF, AES-256-GCM for the content, and ed25519 signatures so the recipient can verify who sent it. It is WebCrypto-compatible, so any modern browser can decrypt without a plugin. Encrypted blobs live on Cloudflare R2, with expiry, revocation, and download caps, plus a preflight that checks a project is clean before you send it.
Results
A recipient with no account and no software opens a link and gets the decrypted file, while the server never sees plaintext or keys. It does the one thing I actually needed: get a private track to one person, safely, without friction on their end.
What I Learned
The hard part of a privacy tool is the trust story, not the math. Holding less data is a feature you can sell, and making the recipient side completely frictionless is what decides whether anyone actually uses it.