Internxt on GitHub: Encrypted Cloud from Europe — With Open Source Clients and a CLI

“Zero knowledge” appears on every second cloud provider’s website these days. The claim is cheap, and it can only be checked when the code is open. With Internxt, it is: the company’s GitHub organisation holds the desktop, web, and mobile clients, the CLI, and further building blocks of the platform, mostly under AGPL-3.0 or MIT.

That alone doesn’t make a good service. But it moves the discussion from marketing promises to verifiable statements — which is exactly why it is worth a closer look.

Key Takeaways

• Internxt runs a suite of encrypted services: Drive (storage), Send (file transfer), Meet (video conferencing, a Jitsi fork), VPN, Antivirus, Photos, Mail, and Cleaner.
• Files are encrypted on the device before upload. The provider states that keys never leave the user’s control — zero-knowledge architecture, AES-256 at rest, TLS 1.3 in transit.
• Internxt markets itself as a cloud storage service with post-quantum cryptography, specifically Kyber-512 combined with AES-256.
• The source is on GitHub: drive-desktop, drive-web, drive-mobile, cli, and others — mostly TypeScript, licensed AGPL-3.0 or MIT.
• Of particular interest to developers and admins: the CLI with a built-in WebDAV server, plus stated support for NAS and Rclone.
• The company is based in Europe and operates under GDPR. It lists ISO 27001:2022, HIPAA compliance, and an independent audit by Securitum in 2024.

Who Internxt Is

Internxt states its mission on GitHub in one line: “Securing the world’s data. Private by default, secure by design, and free as in freedom.” All three parts are programmatic — encrypted without user effort, open source, European jurisdiction.

Unlike many competitors that start with one service and grow outwards, the product portfolio is broad by design. It now covers:

On top of that come free standalone tools on the website: a password generator, virus scanner, metadata remover, file compressor, and byte converter. They work without an account and clearly serve reach — which doesn’t make them less useful.

The Encryption Model

The decisive question with encrypted storage is always: where does encryption happen, and who holds the keys?

Internxt encrypts on the device before data leaves it. The provider states that encryption keys never leave the user’s control. AES-256 is used for the data itself, TLS 1.3 for transport.

The consequence of this model is inconvenient and often overlooked: lose the password, lose the data. A provider that doesn’t hold the keys cannot reset anything. That is not a flaw but the logical result of the promise — you just want to know it before uploading the family photos.

Post-Quantum Cryptography

Internxt highlights its use of Kyber-512 combined with AES-256 and markets itself as a cloud storage service that automatically protects files with post-quantum cryptography.

For context: Kyber is the key encapsulation mechanism NIST selected as its standard for quantum-safe key exchange. The threat model behind it is called “harvest now, decrypt later” — encrypted data is intercepted and stored today in the expectation that a sufficiently capable quantum computer will decrypt it later. For data with a long protection horizon — contracts, medical records, engineering data — that is a real consideration, even if nobody knows when “later” is.

The phrasing “the only cloud storage that…” comes from the provider itself and should be read as a marketing claim. That Kyber-512 is in use is independent of it.

The Open Part: the GitHub Organisation

This is where it gets interesting for developers. The main public repositories:

The stack is mostly TypeScript and JavaScript, with Python, Go, and Swift alongside. Licences are usually AGPL-3.0 or MIT.

What that means in practice: the encryption logic in the clients is inspectable. If you want to know whether encryption really happens locally, you don’t have to take the provider’s word for it — you can read the drive-desktop repository. For security researchers and for companies with their own due-diligence obligations, that is the actual difference from a closed provider.

The star counts are an honest indicator of scale, though. This is not a project with a large external developer community — it is a commercial product whose source happens to be open. Both are legitimate, but they are different things.

The CLI: the Most Practical Entry Point for Technical Teams

@internxt/cli is the tool that lets you wire Internxt into existing workflows. Installed via npm, requires Node 22.13.0 or newer:

npm i -g @internxt/cli

Authentication runs either through a web-based flow or the classic route:

internxt login
internxt login-legacy   # email/password, optional 2FA

File operations cover what you would expect:

internxt upload-file
internxt upload-folder
internxt download-file
internxt list
internxt create-folder
internxt rename-file
internxt move-file
internxt trash-file
internxt trash-folder
internxt trash-clear

The most interesting part is the built-in WebDAV server:

internxt webdav start       # also: stop, restart, status
internxt webdav-config      # port, HTTP/HTTPS, authentication

This lets you mount encrypted Internxt storage locally as a drive — and any tool that speaks WebDAV can use it without knowing Internxt exists. Combined with the stated Rclone and NAS support, that is a workable foundation for backup strategies.

One limitation the project names itself: maximum upload file size depends on the account tier. For CLI and WebDAV, the top tier currently caps out at 100 GB per file.

Use Cases

Encrypted backup with no extra software. Start the WebDAV server, mount it with Rclone or your operating system’s built-in client, and point an existing backup script at it. Encryption happens before upload; the script doesn’t need to know.

Automated storage from CI pipelines. internxt upload-file after a build stores artefacts encrypted without adding an S3 bucket and its permission model.

GDPR-sensitive storage. For companies that need data processing within European jurisdiction, European domicile plus ISO 27001:2022 plus open client code is a combination that is easier to explain to a data protection officer than a US cloud with standard contractual clauses.

Consolidating a sprawling tool stack. If you currently hold four contracts for storage, video conferencing, VPN, and password management, it is worth running the numbers on a single-suite provider. Whether each individual product matches the respective market leader is a separate question — and should be checked separately.

Tiers and Jurisdiction

There is a free tier with 1 GB of storage, permanently and without a time limit, including the apps for Linux, Windows, macOS, iOS, Android, and web plus two-factor authentication. Enough to try it, not enough to run on.

The paid tiers are Essential (1 TB), Premium (3 TB), and Ultimate (5 TB), offered annually, as a lifetime purchase, or as a business plan. Prices change and are loaded dynamically on the website, so check them there directly. Listed for all paid tiers: VPN access with tier-dependent server selection, antivirus, file versioning, password-protected sharing, Cleaner, Meet, Photos, and Mail, plus CLI, WebDAV, NAS, and Rclone support. Maximum file size scales with the tier (10 GB → 50 GB → 100 GB), as does trash retention (7 → 14 → 30 days). A 30-day money-back guarantee applies.

Legally: domiciled in Europe, operating under GDPR. As evidence the company cites ISO 27001:2022, HIPAA compliance, and an independent audit by Securitum in 2024.

What to Realistically Expect

Three points for context.

Open source covers the clients, not the operation. That the encryption logic is auditable is worth a lot. It says nothing about how the server infrastructure is run. You cannot self-host the whole thing.

Breadth costs depth. Eight products from a provider the size of this GitHub organisation means not every one of them beats the respective specialist. If you compare Meet against Zoom or the VPN against an established provider, do it soberly.

Zero knowledge costs convenience. No password reset through support, no server-side search across file contents, no preview without local decryption. That is the price of the model, and it is the same at every serious zero-knowledge provider.

Conclusion

Internxt is neither a hidden gem nor hype — it is a European provider doing the obvious thing: encrypting on the device and publishing the source that does it. That is less spectacular than the website suggests, and considerably more than most competitors offer.

For developers and technical teams, the CLI with its WebDAV server is the most convincing part. It turns the service into a building block that fits into existing workflows rather than yet another interface you have to open.

The pragmatic way in: create a free account, install the CLI, start WebDAV, point a backup script at it. If that holds up, the paid tiers are worth a look. And if you don’t believe the encryption claim, read the drive-desktop repository — that’s what open source is for.

Sources: internxt.com · GitHub: internxt · GitHub: internxt/cli · Pricing