Wormhole File Sharing Review: 10GB Free, 24-Hour Expiry

Short answer: Wormhole (wormhole.app) is free, needs no account, and encrypts files with 128-bit AES-GCM before they ever leave your browser — the decryption key sits inside the link itself, not on Wormhole's servers. Files up to 5GB stay on those servers for exactly 24 hours; anything past that, up to a 10GB cap per transfer, moves browser-to-browser instead. That combination makes Wormhole one of the more genuinely private ways to send a file to one person, once. It's a worse fit the moment "once" turns into "this client, every week" — there's no password protection live yet, no way to extend the link past 24 hours, and no paid tier shipped today to change either of those.

Wormhole shows up in the same searches as WeTransfer and Dropbox Transfer, but it's a different kind of tool. It was built around one idea: send a file without creating an account, without asking the recipient to create one, and without the company running the servers being able to read what's inside. That's worth taking seriously — and worth being specific about, since "is Wormhole safe" and "is Wormhole enough for my work" are two different questions with two different answers.

The people who search for Wormhole tend to fall into two camps. One is genuinely privacy-driven: a journalist sending a source document, a lawyer sending a file they don't want sitting on a third party's server indefinitely, someone sending a scan of an ID or a signed contract they'd rather not have living in an inbox forever. The other camp is anyone who just wants to send a large file fast without an account wall. Wormhole serves both well. The question this review is actually answering is what happens when either of those sends needs to survive past today, and where the line sits between "private one-off" and "recurring client delivery."

What Wormhole actually does

Detail	What's true as of September 2026
Account required	No — for sender or recipient
Encryption	128-bit AES-GCM, encrypted in your browser before upload
Where the decryption key lives	In the link's URL fragment, never sent to Wormhole's servers
Max transfer size	Up to 10GB
Storage window	Files up to 5GB: stored on Wormhole's servers for 24 hours, then deleted
Larger files	Above 5GB: sent directly browser-to-browser; both sides generally need to stay online
Expiration control	You can set a shorter expiration time and a maximum download count; 24 hours is the ceiling
Password protection	Not live — listed on Wormhole's roadmap as planned
Pricing	Free; no paid Pro tier has shipped yet

Two things stand out against most of the field. First: no account, on either end. You paste a link, they click it, that's the whole interaction. Second: the 24-hour number isn't a marketing floor designed to nudge you toward an upgrade — it reads more like a deliberate design decision. Even the shortest tiers among competitors sit above it; WeTransfer's Free and Starter plans, for comparison, keep transfers active for up to three days.

Is Wormhole safe? What the encryption actually buys you

Yes, within the scope it's built for. Wormhole encrypts your file with AES-GCM in your browser before it ever reaches its servers. The key that can decrypt it is generated on your device and attached to the share link's URL fragment — the part after the # — which browsers don't transmit to servers by design. Wormhole's own security documentation is direct about this: the company doesn't hold the key, so it can't open your file even if it wanted to. Transport is covered separately with TLS 1.2/1.3, and Wormhole's TLS setup carries A+ ratings from both Qualys SSL Labs and Mozilla Observatory.

That's a real, verifiable end-to-end encryption model — closer to what someone searching "is Wormhole safe" is actually asking for than most consumer file-sharing tools offer. WeTransfer and Dropbox encrypt files in transit and at rest, but they hold the keys. Wormhole doesn't.

What the encryption doesn't cover is the link itself. Anyone who gets the URL — forwarded in a group chat, screenshotted, pasted into the wrong Slack channel — can open the file inside the 24-hour window, because there's no password layer sitting on top of it. If you want a password as a second lock on the link, that's not something Wormhole does today.

One point in Wormhole's favor for anyone doing their own diligence: its cryptography code is open source, so the encryption claims above aren't just marketing copy to take on faith — they're inspectable. That's a meaningfully different trust posture than a closed-source tool asking you to believe an "encrypted" label on a landing page.

Where the 24-hour window stops working

The same design choice that makes Wormhole feel trustworthy for a single private send is what breaks it for anything resembling ongoing client work. A few concrete cases:

• The client opens the email late. Send a deliverable Friday afternoon, and a client who checks their inbox Monday morning finds a dead link. You resend, they redownload, and the "quick private handoff" turns into a back-and-forth.
• Multiple stakeholders, staggered review. If three people on the client side need to open the same asset across a week, at least one of them is going to hit a broken link.
• Anything that needs a paper trail. Wormhole doesn't track opens or downloads — there's no record of who retrieved the file or when. If your process requires proof of delivery, this isn't the tool for it.
• Large files sent to someone who isn't online right now. Above 5GB, Wormhole moves the file directly between browsers, which generally means both sides need an active connection at the same time. An 8GB project file sent to a client asleep in a different timezone doesn't complete the way a server-stored file would.
• Anything you need to send from your own name. A Wormhole link is a wormhole.app URL, full stop. There's no way to put it on your own domain, so a client opening it sees Wormhole's brand, not yours.

To be fair to Wormhole, it isn't standing still. Its shipped feature list already includes QR codes for handing a link from a desktop to a phone, a delete button to pull a file early instead of waiting out the clock, Tor Browser compatibility, and an inline viewer for images, audio, and video so a recipient doesn't have to download a file just to check what's inside. Those are useful, and they're live today — they just don't change the 24-hour ceiling or the missing password layer.

None of this makes Wormhole a bad product. It makes it a single-purpose one: encrypted, anonymous, gone by tomorrow. That's exactly right for sending a sensitive document to someone once. It's the wrong shape for a link that's meant to represent a piece of client work sitting in a folder they'll get to when they get to it.

Wormhole's pricing: still free, no Pro tier yet

As of this writing, Wormhole doesn't charge for anything. There's no free-vs-paid split to weigh, because there's only the free version. Wormhole's public roadmap lists a Pro tier — longer expiration, higher download counts, larger files — as planned, alongside password protection and a handful of other features. None of it has shipped. If you're comparing Wormhole's pricing against WeTransfer's or Dropbox Transfer's paid plans expecting a like-for-like table, there currently isn't one to build. Wormhole's entire offering today is the free one.

Wormhole vs BulkShare

Disclosure: I built BulkShare. These two tools solve different problems, and being clear about which one is which matters more than picking a winner.

Need	Wormhole	BulkShare
Price	Free	$29/mo or $240/yr, 7-day trial
Account required	No	Yes
End-to-end / zero-knowledge encryption	Yes — AES-GCM, key never leaves your device	No
Link expiry	24 hours, maximum	Your choice, 24 hours to never
Password protection	Not live yet	Included, per link
Custom domain for links	No — link stays on wormhole.app	Up to 5 custom domains (e.g. files.your-agency.com)
Open/download analytics	Not live yet	Included, per link
Max file size	Up to 10GB	Up to 100GB

Pick Wormhole when the file is sensitive, the send is a one-off, and you don't want either side creating an account or leaving a record behind. That's a real, specific strength — genuine end-to-end encryption with no sign-up is rare.

Pick BulkShare when the link needs to outlive tomorrow, needs a password instead of just obscurity, and needs to look like it came from your business rather than from wormhole.app. See pricing for the current plan.

The honest verdict

Wormhole does what it says: end-to-end encrypted, no account, gone in a day. That's a legitimate answer to "is Wormhole safe" — the encryption model holds up, and the company genuinely can't read your files. It's a weaker answer to "can I use this for client delivery," because the same 24-hour ceiling that makes it trustworthy for a single sensitive send makes it unreliable for anything with a longer timeline, multiple recipients, or a need for proof the file was opened.

Use Wormhole for the file you need one person to see once, today. Use something built for ongoing delivery — a password, expiry you control, your own domain — for everything else.