skip to content
feather drive

security

feather drive has no server that sees your files or your google sign-in. your mac talks straight to google. with encryption on, google only ever stores ciphertext, and the keys stay with you. here is how that works.

keys

  • a random 256-bit master key is created on your mac when you turn on encryption. it never leaves your devices unwrapped.
  • your passphrase is stretched with Argon2id (64 MiB of memory, 3 passes, random salt) into a key that wraps the master key.
  • a 24-word recovery key (a standard bip39 phrase encoding 256 bits) wraps a second copy of the master key, so you can get back in if you forget the passphrase.
  • the wrapped copies are stored in your drive so a new mac or the web app can unlock with your passphrase. the unwrapped keys live in the macOS keychain on your mac.

files

  • every file gets its own random file key, wrapped by the master key and stored in a small header at the start of the file.
  • contents are encrypted with AES-256-GCM in 4 MiB segments. each segment has its own nonce and authentication tag, and its position and an “is last” flag are bound in, so segments can't be reordered, swapped between files or truncated without detection.
  • segments are what make instant open work with encryption: feather drive fetches and decrypts only the segments an app reads, not the whole file.
  • file and folder names, and the original file size, are encrypted too. google sees random-looking names.

sharing

a share link carries the file key in the url fragment (the part after #). browsers never send fragments to servers, so neither google nor feather drive receives it. anyone you give the link to can decrypt that one file or folder, and nothing else.

what this protects against, and what it doesn't

  • protects: someone with access to your google drive (including google) reading your encrypted files or their names.
  • doesn't protect: malware on your unlocked mac, or anyone you send a share link to. file sizes and timing are approximately visible to google.
  • if you lose both your passphrase and your recovery key, your encrypted files can't be recovered by anyone.

google access

feather drive asks only for the drive.file scope, so it can touch only files it created. sign-in uses oauth with pkce; no client secret ships in the app. refresh tokens are kept in the keychain.

reporting a vulnerability

please email security@featherdrive.app with details and steps to reproduce. we'll reply within a few days and credit you if you'd like. please don't open a public issue for security problems.