Previewing Files Without Downloading Them First

Zero-knowledge encryption sounds like it should mean every file is a black box until you download and decrypt it manually. It doesn't — you can preview images, video, audio, PDFs and text files right inside the vault. Here's how that's possible without ever giving up the "provider can't read your files" guarantee.

What you can preview

Anything else — ZIP archives, RAW camera formats, spreadsheets, and other binary formats — doesn't have a preview and shows a plain file icon instead; you'd download those to open them in their native app.

The part that keeps it zero-knowledge

Clicking a preview doesn't quietly send your file to a server-side renderer somewhere. Instead:

1. The browser fetches the same encrypted blob it would for a download.
2. Your locally-held key decrypts it — in memory, using the file's stored IV.
3. A temporary in-browser object URL is created from the decrypted bytes and handed to an <img>, <video>, <audio> or <iframe> element to render.
4. Nothing decrypted is written to disk — it exists only as long as the preview window is open.

Close the preview and that object URL is explicitly revoked, freeing the decrypted data from memory. It's the same trust model as a download, just without a file landing in your Downloads folder.

Preview vs. download — when to use which

• Preview when you just need to confirm which photo this is, check a document's contents, or listen to a voice memo before deciding what to do with it.
• Download when you actually need the file locally — to edit it, share it outside the vault, or open it in a dedicated app.

A "Download" button sits right inside the preview modal, so if you open a file just to look and then decide you need it, there's no need to close the preview and hunt for it again.

Why this matters for real workflows

Without preview, checking twenty photos before choosing which to keep would mean twenty separate download-decrypt-open-delete cycles. With it, you click through them the way you would in a normal photo app — the encryption stays invisible until you actively need the raw file. This is the same principle behind our WebDAV guide for mounting the vault as a drive: strong encryption doesn't have to mean a clunky workflow.