New accounts must be on the administrator's whitelist.
Connect an Ethereum wallet. If it holds an M7 token you're signed in instantly as a holder — no sign-up. On mobile this opens your wallet app; on desktop it uses your browser wallet.
PARACYT is the native M7 wallet. Sign a one-time challenge with your PARACYT (ed25519) wallet — the signature authenticates you and derives your encryption key locally; it never leaves this device.
This is a shared console. Every file you upload is encrypted inside your browser with AES-256-GCM before it is sent. The server only ever stores opaque ciphertext. The operator and the other user cannot read your files.
Where your key comes from
Your encryption key is derived locally with PBKDF2 (250,000 rounds, SHA-256) from either your password or your wallet signature, combined with a per-account salt. The key is held in memory for this session only and is never transmitted or stored.
Quantum posture
AES-256 is a quantum-resistant symmetric cipher — the best known quantum attack (Grover) only halves its strength, leaving an effective 128-bit security margin. Wallet sign-in keeps the whole path server-blind: the signature that unlocks your data never touches the network.
What this means for you
If you forget your password or lose your wallet, your encrypted files cannot be recovered — not even by the administrator. That is the point. Published websites are served publicly and are stored unencrypted; keep anything private in the File Vault.
