← Back to home

Sefaly CLI (sef)

End-to-end encrypted file storage from your terminal. Same guarantees as the web app: files encrypt in your shell before they leave the machine, and the server never has the keys to decrypt them.

Install (Linux + macOS)

curl -fsSL https://www.sefaly.com/install.sh | sh

The script detects your OS and architecture, downloads the matching release from GitHub, verifies its SHA-256 against the published checksums, and drops the sef binary in ~/.local/bin. It won’t touch sudo or modify your shell config.

If you’d rather not pipe a remote script into sh (fair), inspect it first: /install.sh. It’s about 130 lines of POSIX shell. Or use the manual install below.

Install (Windows)

Grab sef_<version>_windows_amd64.zip from the latest release, extract sef.exe, and add the containing folder to your PATH.

Manual install

Download a release manually:

  1. Open the Releases page.
  2. Download the archive matching your OS and architecture (e.g. sef_0.1.0_linux_amd64.tar.gz).
  3. Verify its SHA-256 against sha256sums.txt from the same release.
  4. Extract and put sef on your PATH.

Build from source

Requires Go 1.26+.

git clone https://github.com/shokace/sefaly-cli
cd sefaly-cli
go build -o sef .
mv sef /usr/local/bin/

Quick start

sef login          # opens a browser, approve the device
sef whoami         # confirm you're signed in
sef ls             # list files + folders at the root
sef upload report.pdf --to Documents
sef download Documents/report.pdf --out ./report.pdf
sef logout         # revoke this device's token

Run sef --help for the full command list. Each subcommand has its own --help with examples.

TUI mode

For interactive browsing, sef gui launches a two-pane file-manager TUI in your terminal. Arrow keys to navigate, Enter to descend, c or F5 to copy between panes, q to quit.

How auth works

Sefaly is zero-knowledge: your password and your private key never reach the server, web app or CLI. The CLI uses a device-flow ceremony:

  1. sef login generates an ephemeral ML-KEM-768 keypair and asks the server to mint a one-time user code.
  2. You open the URL in a browser, sign in normally, and approve the device request.
  3. The browser encapsulates an access token against the CLI’s ephemeral public key plus an encrypted copy of your account’s private key.
  4. The CLI polls, receives the wrap material, decrypts both locally, and stores them in the OS keychain (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows).

From then on, the CLI calls the API with a bearer token and decrypts files locally with its copy of your private key. The server only ever sees a SHA-256 hash of the token.

Source + security

  • Repository: github.com/shokace/sefaly-cli (public, MIT-licensed).
  • Disclosure policy: SECURITY.md. Vulnerabilities go to security@sefaly.com.
  • Crypto primitives: ML-KEM-768 (FIPS 203) for key wrap, AES-256-GCM for file content + filenames, HKDF-SHA256 for wrapping-key derivation. Same wire format the web app uses, byte-for-byte compatible.