Self-host kurpod
v0.1.6Encrypted file storage with plausible deniability
- Stars
- 161
- Port
- 3000 (HTTP web interface and API)
ghcr.io/srv1n/kurpod-serverWhat is kurpod?
KURPOD is a self-hosted encrypted file storage system written in Rust that stores all files in a single encrypted blob file. Its key feature is dual-volume plausible deniability: each container has a standard volume and a hidden volume, each unlocked with a different password. Under coercion, you can reveal the decoy password showing innocent files while your real data remains cryptographically hidden. The server is a single ~2MB binary with no external dependencies or databases, offering a React-based web interface with dark/light themes, drag-and-drop upload, file previews, and a REST API. It runs on Linux, macOS, Windows, and ARM64 (including Raspberry Pi), installable via Docker, Homebrew, direct binary download, or building from source. The project is in early release (v0.1.x) with known limitations including single-user sessions, no built-in TLS, no native mobile apps, and manual backups.
Should you self-host kurpod?
kurpod scores 41/100 on selfhost.directory (how scoring works) and ranks #12 of 15 in File Storage. It has 161 GitHub stars.
It shipped 3 stable releases in the past year. The latest, v0.1.6, came out on 31 July 2026. New versions land roughly every 3 months.
Setup is easy: most people get it running in one sitting. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in JavaScript.
Its closest alternative on selfhost.directory is juicefs (73/100, 14 583 stars). It scores higher overall, so compare the two before you pick. See kurpod vs juicefs side by side.
Features
- Binary verification
- Blob compaction
- Cross-platform single binary
- Dual-volume plausible deniability
- Encrypted File Storage
- File Preview
- No External Database
- Password-based key derivation
- REST API
- Session-based Authentication
- Thumbnail generation
- Video Streaming
- Web Interface
kurpod README
FAQ
Can I use this with cloud storage?
Yes! The blob file can be stored on cloud services (Dropbox, Google Drive, etc.) for backup, but KURPOD itself handles the encryption.
How does session management work?
Sessions timeout after 15 minutes of inactivity or 2 hours maximum. All cryptographic material is automatically cleaned from memory.
Can I run this on a Raspberry Pi?
Yes! Use the ARM64 builds on 64-bit Raspberry Pi OS (Raspberry Pi 3B+ or newer).
What's the difference between GNU and musl builds?
GNU libc is standard on most Linux distributions. musl is smaller and works on Alpine Linux and static deployments.
How do I verify downloads?
All releases include SHA256 checksums and GPG signatures. Download SHA256SUMS and verify with sha256sum -c SHA256SUMS.
Is this ready for production use?
This is an initial release that works well for personal use and testing. The core cryptography uses established algorithms, but thorough testing is recommended before critical use.
What happens when I delete files?
Deleting a file removes its metadata immediately. The encrypted data remains until you run compaction to reclaim space.
Can the UI prove I didn't create a hidden volume?
No. The blob is indistinguishable from random data, so the server/frontend cannot reveal whether a hidden volume exists.
More in Encryption
Onetime SecretKeep passwords and other sensitive information out of your chat logs and inboxes.
PeergosSelf-hosted, open-source p2p drive with post-quantum end-to-end encryption: hidden file names, sizes and contacts, secret links, folder sync, chat and social feed.
PyBitmessagePyBitmessage is the open-source reference client for Bitmessage, a self-hosted encrypted P2P messenger with chans, broadcasts and Tor support.
s3-encryption-gatewaySelf-hosted transparent HTTP proxy adding client-side encryption to any S3-compatible storage without code changes, with envelope encryption via local or external KMS.- SchleuderSchleuder is an OpenPGP-enabled mailing list manager with resending capabilities, allowing subscribers to communicate encrypted and pseudonymously.
SendOpen-source, self-hosted fork of Firefox Send: share files with links that expire, client-side AES-GCM encryption, password and download limits.
Signal TLS ProxyOpen-source Docker Compose proxy that fronts Signal's servers with a Let's Encrypt certificate on your own domain, shareable with other users via signal.tube.
Standard NotesSelf-hosted, open-source note-taking app with end-to-end encryption, cross-platform sync on unlimited devices, extensible note types, and a plugin system.
vaultSelf-hosted, source-available secrets server that issues dynamic cloud and database credentials, offers encryption as a service, and logs every access for audit.
wireOpen-source end-to-end encrypted messenger for teams: calls, file sharing, SSO. The self-hosted wire-server runs on Kubernetes under GPL-3.0.
YopassOpen-source, self-hosted secret sharing: Yopass encrypts passwords and files in the browser with OpenPGP, so links carry the key and secrets expire or burn after reading.
CondensationDBAn open-source distributed data system: build apps with its client libraries and run a self-hosted store server, with semilattice merging and end-to-end encryption.
0 comments