RookFile Encrypted Sessions

Architecture overview of ephemeral file sharing sessions with optional E2EE on rookvpn.com/file.

RookFile (rookvpn.com/file) is an ephemeral file and text sharing tool built for quick handoffs without accounts. This document explains the session model, transport security, optional end-to-end encryption, and how indexing is limited to protect active session URLs.

Session model

RookFile creates ephemeral sharing sessions identified by a random session ID in the URL. Files and collaborative text live for the session lifetime only — there is no permanent user storage or searchable archive. Sessions expire automatically after inactivity and can be closed by any participant with the link.

Each session supports multiple participants over WebSockets for real-time text sync. File uploads attach to the same session namespace. When the session ends, server-side blobs are deleted; clients should not treat RookFile as long-term cloud storage.

Transport security

All traffic uses HTTPS (TLS 1.2+). Files upload via REST with optional chunked transfer for large files (above ~80 MB per chunk policy documented in the app). Real-time sync uses WebSockets with the same origin policy as the REST API. Session IDs are unguessable UUIDs; security relies on link secrecy — treat share URLs like passwords.

Optional end-to-end encryption (E2EE)

When E2EE is enabled at session creation, encryption keys are generated in the browser and must be shared out-of-band (separate channel from the session link). The server stores ciphertext only and cannot decrypt file contents or collaborative text. Chunked E2EE uses per-chunk cipher metadata compatible with the client download pipeline so large files stream without loading entirely into memory.

Without E2EE, files are encrypted at rest on the server with standard disk encryption but are readable by the service during the session lifetime — similar to most paste-and-share tools. Enable E2EE when sharing credentials, contracts, or key material.

Rate limits and abuse controls

Upload and API endpoints are rate-limited per IP to reduce abuse. Very large uploads use a coordinator on the client to serialize chunk commits and avoid thundering herds. OAuth sign-in is optional for extended quotas; anonymous sessions remain supported for basic sharing.

Privacy defaults and SEO

Active session URLs are marked noindex for search engines. Only the RookFile homepage is indexed with public marketing copy. OAuth callback routes are also excluded from indexing. Server-side SEO injection serves homepage meta only for crawlers hitting the root path.

When to use RookFile vs email or cloud drive

Use RookFile for temporary handoffs: log excerpts, config snippets, screenshots, or paired text editing. Avoid it for regulated long-term retention — use your organization’s approved storage with audit trails. For encrypted archives with expiry, enable E2EE and set expectations that recipients must save locally before the session closes.

Try RookFile

Create a session at rookvpn.com/file — no account required for basic sharing. Related: RookSecret for one-time secret links, RookScrub for PII redaction in text.