A private file-transfer service with Discord sign-in. Accepted uploads are scanned and encrypted before persistent storage.
FAQ
Accounts, scanning, encryption, limits, and API access.
Most images, videos, archives, documents, and audio. Executables and SVG images are blocked. Archives are recursively inspected by ClamAV, and raster images receive an additional content-safety scan.
200 MB per file by default. An administrator can give an individual account a larger limit, up to 2 GB. Images also have a separate safety-scanner limit.
3 per day by default. An administrator can set a custom daily amount or unlimited usage. The counter resets at midnight.
It is the copyable ID beginning with
mbu_ on the upload page. It is safe to give to a Mysticbin administrator, who can use it to change your API access, quota, or per-file limit without asking for your Discord ID.Discord provides one stable identity for ownership and per-user limits. Mysticbin requests only the
identify scope, and does not persist Discord OAuth access tokens.Yes. A signed-in owner can delete their file. Every upload also returns a one-time delete token; save it if you need to delete through the API later.
Yes. Add a password before uploading. File passwords are bcrypt hashes, never stored as plaintext. API downloads provide it with the
X-File-Password header.Yes. Enter a maximum from 1 to 1,000,000 before uploading, or leave it blank for no download-count limit. The file stops serving after its limit is reached.
After scanning, the service encrypts the entire file with authenticated encryption and keeps only ciphertext in persistent upload storage. A real file cannot generally be reduced to 1 KB without losing its contents.
The running API needs the master key to decrypt a requested download, so someone controlling both the server and its live key technically can. Client-side encryption would prevent this, but would also prevent server-side malware and explicit-content scanning.
Discord profile fields and filenames are encrypted. Session tokens and API keys are hash-only, and network identifiers use keyed hashes. The service still needs operational metadata such as file size, MIME type, timestamps, ownership, limits, and scan status.
There is currently no automatic expiry. This can change as storage policy evolves. Owners and delete-token holders can remove files at any time.
An administrator first enables API access for your account. You can then create a personal key; it is shown once and stored only as a one-way hash. Send it with the
X-Api-Key header.Yes. Send up to 10 files to
/upload/bulk. Each successful file counts against your daily limit.Yes, for API-key users and only to operator-allowlisted HTTPS hosts. Events include uploads, downloads, deletions, and new collections. Every payload is signed with HMAC-SHA256.
Members can use upload, status, and invite commands. Allowlisted server administrators can enable API access, issue or revoke keys, and change per-user quota or size exceptions using a Discord member or
mbu_ user ID./files/{id}/view can serve safe media inline. /files/{id}/download forces an attachment. Unsafe MIME types are always forced to download.The API returns HTTP
429. Check /status for current usage, wait for the daily reset, or ask an administrator to adjust your account policy.