Toss it.
It's gone.
A file drop with an actual off switch. Upload something, hand out the link, and the whole transfer deletes itself when the timer runs out — or the first time somebody opens it, if that is what you asked for.
Most file hosts are hoarders.
You upload something once and it sits there for years, quietly waiting to leak. We built the opposite: storage that is embarrassed to still be holding your file.
Expiry is the default
Every drop has a deadline. There is no "keep forever" toggle, and the longest you can pick is thirty days. If you need an archive, use an archive.
Burn after reading
Flip it on and the link dies the moment the first byte of the last chunk goes out. Handy for credentials, exports and things you'd rather not repeat.
Encrypted in the tab
Add a passphrase and the file is sealed with AES-256-GCM before upload. The key lives in the URL fragment, which browsers never send to a server.
No crawler bait
Drop pages are noindex, return no preview metadata and are not linkable from anywhere on this site. Nothing to scrape, nothing to enumerate.
Deletion you can verify
Once expired, the object id returns a hard 410 forever — we never re-issue one. The blocks are zeroed by the sweeper, not just unlinked.
Fast where it matters
Three regions, direct peering, and no per-account throttle. A 20 GB drop from a decent line finishes in about four minutes.
One binary, one pipe, one link.
The web page is a convenience. The real interface is a POST — which means tar, pg_dump and anything else that writes to stdout can hand you a link without touching disk.
- Streaming uploads. No Content-Length needed; we chunk as it arrives.
- Exit codes that mean something. 0 on sealed, 4 on quota, 7 on rejected type.
- Keys are scoped. One key per host, revoke it from the dashboard and it dies instantly.
# pipe a dump straight in, no temp file $ pg_dump prod | gzip | \ curl -sST- "https://api.tossit.lol/v1/drop?ttl=1h&burn=1" \ -H "X-Toss-Key: $TOSS_KEY" https://tossit.lol/x/q7Fm2p#k=Zk9tR2xQ # check what is still alive $ toss ls ID SIZE TTL LEFT BURN q7Fm2p 418 MB 57m 12s yes b3Kd9x 12.1 GB 6d 04h no # kill it early $ toss rm q7Fm2p gone (410)
Cheap, because we delete everything.
Storage costs go away when nothing sticks around. That saving is the whole business model.
Things people ask
Why do I need a key to upload?
Because an open uploader becomes a malware host in about forty minutes. Keys are free, they are just gated behind a human reading your request. It usually takes a day or two.
Can you recover something I let expire?
No, and that is the product. Once the sweeper has run, the blocks are overwritten and the object id is retired permanently. There is no support ticket that reverses this.
Do you look at what I upload?
We do not open files. We do hash them and check that hash against known-malware lists, and we act on abuse reports. If you encrypt with a passphrase, even that is not possible — we only see ciphertext.
What is logged?
Drop id, size, creation and expiry time, and a truncated source address kept for seven days for rate limiting. Downloads increment a counter; we do not store who did it.
Something bad is being hosted here.
Send the link to the address on our acceptable use page. Malware and CSAM are killed on sight, usually within the hour, and the key behind them is burned.
Stop leaving files lying around.
Ask for a key. It is free and it takes a day or two.