Lufi

Free plan AndroidAPIiPhoneSelf-hostedWeb

What Lufi is

Lufi is free, AGPL-licensed file-sharing software for storing files and letting recipients download them. Files are encrypted and decrypted in the browser, and the key stays in the URL fragment instead of being sent over the network. File names, sizes, and MIME types are transmitted without encryption. Lufi provides a web interface, command-line client, and Python client, with several languages and API access. It can run through web, Android, iOS, API, or self-hosted deployments. Deployment options include an Ansible role, a Terraform plan for AWS, and a documented Docker recipe. The project lists Firefox, Chrome, Internet Explorer 11, Microsoft Edge, Safari, and iOS and Android devices as tested and working. A demonstration site has strong time and file-size limits. Only the latest release receives security fixes; vulnerabilities in the develop branch may also be reported. Security reports go to a confidential Framagit issue, and no bounty program is offered.

Who it suits

It suits users wanting open-source encrypted sharing or administrators able to self-host. Developers can use the API, CLI, Python client, or deployment recipes.

What it does well

Free and AGPL licensed
Browser-based end-to-end encryption
Key never sent over network
Supports self-hosted deployment
Provides API, CLI, and Python clients

What to know first

File metadata is unencrypted
Demo has time and size limits
Only latest release gets security fixes
No bounty program

Verdict

Lufi provides browser encryption, multiple clients, API access, and several self-hosting paths without a listed fee. Review its unencrypted metadata and release-support policy before deploying it for sensitive sharing.

Facts from Lufi's own pages

API access: Yes · github.com, 23 Sept 2026
Browser compatibility: The README lists Firefox, Chrome, Internet Explorer 11, Edge, Safari, and iOS and Android devices as tested and working. · github.com, 5 Oct 2026
Browser encryption: Files are encrypted and decrypted in the browser, so they do not leave the user's computer unencrypted. · github.com, 12 Oct 2026
Browser support: The project lists Firefox, Chrome, Internet Explorer 11, Microsoft Edge, and Safari as tested browsers. · github.com, 12 Oct 2026
Clients: Lufi offers a web interface, a CLI client, and a Python client. · github.com, 5 Oct 2026
Command-line clients: The project links to a CLI client installable through npm and to a separate Python client. · github.com, 12 Oct 2026
Contributions: The project invites issue reports, internationalization help, and code contributions. · github.com, 12 Oct 2026
Demo instance: The project links to a demonstration site and says it has strong time and file-size limitations. · github.com, 12 Oct 2026
Demo limits: The project links to a demonstration site and says it has strong limits on time and file size. · github.com, 5 Oct 2026
Deployment: The project includes an Ansible role and Terraform plan for deployment, and documents Docker deployment through a separate recipe. · github.com, 5 Oct 2026
Encryption: Encryption and decryption happen in the browser, and the encryption key is never sent over the network. · github.com, 5 Oct 2026
Encryption key: The encryption key is kept in the URL fragment and is never sent over the network. · github.com, 12 Oct 2026
Languages: The project says Lufi comes with several languages. · github.com, 12 Oct 2026
License: Lufi is licensed under the AGPL. · github.com, 12 Oct 2026
Metadata: The file name, size, and MIME type are sent unencrypted. · github.com, 5 Oct 2026
Mobile support: The project says it has been tested on iOS devices, including iPad and iPhone, and Android devices, including Galaxy Tab and Galaxy S8. · github.com, 12 Oct 2026
No bounty: The security policy says Lufi has no bounty program at this time. · github.com, 5 Oct 2026
Purpose: Lufi is end-to-end encrypted file-sharing software that stores files and lets recipients download them. · github.com, 12 Oct 2026
Security support: Only the latest Lufi release is supported and receives security fixes; vulnerabilities in the develop branch may also be reported. · github.com, 5 Oct 2026
Self-hosting: Deployment options described include an Ansible role, a Terraform plan for AWS, and a Docker recipe. · github.com, 12 Oct 2026
Support and contributions: The README invites users to report issues, help with internationalization, and contribute code. · github.com, 5 Oct 2026
Unencrypted metadata: The file name, size, and MIME type are sent unencrypted. · github.com, 12 Oct 2026
Vulnerability reports: The security policy directs vulnerability reports to a confidential issue on the project's Framagit instance. · github.com, 5 Oct 2026

Where Lufi stands on Freedom251

File transfer services#36 of 105