Security · Updated Jun 8, 2026
How client-side encryption works in a data room
Token encrypts each file in your browser with AES-256-GCM and PBKDF2 key derivation before anything uploads. The service stores ciphertext only; the room password never leaves the people you share it with. Recipients decrypt in their own browser — nothing is decrypted on Token servers.
Read guide