1. Wallet login: no sign-up, no gas
Connect an EVM wallet in your browser (MetaMask, Rabby, OKX and any wallet that supports EIP-6963) and sign an EIP-4361 (Sign-In with Ethereum) message. Once the server verifies the signature, you get a session valid for 7 days.
No email, phone number or password. Signing is not a transaction and costs no gas. Your wallet address is your account.
2. Key derivation: the key lives only in your browser's memory
After signing in, you sign once more: your wallet signs a fixed message, and your browser derives an AES-256 master key from the signature with HKDF-SHA-256. The same wallet signing the same message on any device yields the same key, so switching devices only takes signing in with the same wallet.
For new accounts, this message uses the SIWE format bound to our domain, so your wallet warns you if you're asked to sign it on a look-alike site. The master key stays in the page's memory and is never uploaded or stored; the server only keeps a public verifier derived from it to detect unstable wallet signatures, which can't be used to decrypt anything.
3. Client-side encryption: end-to-end with AES-256-GCM
Files are encrypted before they leave your device. We, the upload path and the storage nodes only ever handle ciphertext.
- Each file gets its own random file key, and its contents are encrypted with AES-256-GCM.
- The file key and the file name are then encrypted with your master key, so we can't even see file names.
- Files over 10MB are split into 64MiB chunks in your browser and each chunk is encrypted separately; the chunk index and total count are bound in GCM's additional authenticated data, so reordered or missing chunks fail to decrypt. Up to 500.0 MB per file (2.00 GB when paying with SUI).
- Each encrypted envelope carries everything needed to decrypt it (apart from your wallet signature) in a fixed format that doesn't depend on our database.
4. Stored on the Walrus decentralized storage network
Walrus is a decentralized storage network built on the Sui blockchain. After upload, Walrus erasure-codes the ciphertext into slivers and spreads them across many independent storage nodes run by different operators; even if some nodes go offline, the data can be fully recovered from the rest.
Each piece of data has a Blob object on Sui that records its blobId and expiry, which anyone can look up onchain. Uploading 2 or more small files totaling 9.5MB or less at once bundles them into a single storage unit, so you pay the storage overhead only once.
When you pay in USDC on Base, the ciphertext is written to Walrus through our upload service. When you pay in SUI on Sui, your browser sends the ciphertext straight to the official Walrus upload relay without passing through our servers, which suits large files. Either way, only ciphertext is uploaded.
5. Pay as you go: itemized up front, checked onchain
After choosing files and a storage term, you see a quote first: the combined cost (storage, conversion fee and network gas) plus the service fee. Storage is charged at $0.023/GB/month for the space your files take up on the Walrus network.
When you pay in USDC, the payment contract on Base checks every amount in the quote against the published pricing rules, and the transaction fails if anything doesn't match. You can also pay in SUI from a Sui wallet. There's no subscription. One order holds up to 100 files and 4GB in total, storage can be prepaid for up to 2 years, and you can renew before it expires.
7. No lock-in: retrieve files without us
Your files' blobIds are recorded on Sui, and each encrypted envelope carries what's needed to decrypt it. With the blobId and the same wallet, you can read the ciphertext directly from the Walrus network and decrypt it locally with the key derived from your wallet signature, without relying on Onchain Drive's servers.
8. What we can and can't see
To handle uploads, billing and sharing, we keep some records; your file contents and keys always stay with you.
- We can't see: file contents, file names, your master key or file keys, or the key after the # in share links.
- We can see: your wallet address, file sizes and counts, upload and expiry times, blobIds, and order and payment records.
- Keep in mind: your wallet is your key. We don't store keys and can't recover them for you, so back up your seed phrase and never sign on look-alike sites.
- Storage isn't permanent: it's prepaid for a term and must be renewed before it expires; data that isn't renewed may be removed by the Walrus network.
Next: see pricing and the storage cost calculator, or how Onchain Drive compares with Google Drive, IPFS and Arweave.