Send a file
through a gist.

fog encrypts a file with a passcode and uploads it to a secret GitHub gist. The receiver needs the link and the passcode. No GitHub account to receive.

Download fog Other platforms
terminal
# sender
$ fog send ./report.pdf
https://gist.github.com/you/3f9c…
passcode: (24 random characters)

# receiver — no token needed
$ fog recv https://gist.github.com/you/3f9c…
passcode: ••••••••
wrote report.pdf

# sender, after the receiver has the file
$ fog rm https://gist.github.com/you/3f9c…

How it works

01

Encrypt

age encrypts the file with your passcode (scrypt). The file name is encrypted too.

02

Split and upload

The armored text goes into parts in one secret gist. fog.json is written last, so a partial upload is easy to see.

03

Download and decrypt

One API call lists the parts. fog downloads them from raw URLs and decrypts as a stream. A wrong passcode stops it before the download.

A secret gist is not private. Any person with the URL can download the encrypted data. The passcode is the only protection. Send the URL and the passcode on different channels.

Install

Static binaries for Linux, macOS and Windows on x86_64 and arm64. Each release has a SHA256SUMS file and a signed build provenance attestation.

macOS / Linux
$ chmod +x fog-*  &&  mv fog-* /usr/local/bin/fog
$ gh attestation verify /usr/local/bin/fog --repo javorszky/fog

To send, fog needs a GitHub token: GITHUB_TOKEN, or gh auth login. To receive, no token is necessary. On macOS, a downloaded binary may need xattr -d com.apple.quarantine fog.

Limits

LimitValue
Size per transfer (default)about 35 MiB (6 parts)
With --unlock-unlimited-powerabout 1.7 GiB (298 parts)
Uploads80 per minute, 500 per hour (GitHub limit)
Receives60 per hour per IP address (GitHub limit)

GitHub Acceptable Use Policies do not permit gists as a file-hosting service. Use fog only for small, occasional transfers.