Filen vs MEGA: Wider Encryption or More Free Storage
Published October 22, 2026· By Juan Martinez
Filen says it encrypts more file details and costs less up to 2 TB. MEGA gives 20 GB free and costs less above 2 TB, but researchers found attacks on its keys.
Filen vs MEGA is a choice between two cloud storage services that both say your files are encrypted on your device with keys made from your password, so the company cannot read them. MEGA is the older and better known one, launched in New Zealand in 2013 and run since 2025 by a company registered in Hungary. Filen is run by a small German company founded in 2021. Both have a free plan, apps for every major system and no published security audit.
They differ in three places. Filen says it encrypts more details of each file, including its size and type, while MEGA’s privacy policy lists sizes and folder structure among what it keeps unencrypted. MEGA gives twice the free storage and is cheaper once you need more than 2 TB; Filen is cheaper up to 2 TB. And MEGA’s encryption has been examined by outside cryptographers, who found serious attacks in 2022 and 2023, while Filen’s has never been audited by anyone outside the company.
Filen is rated 7.0 and MEGA 6.6. Filen is ahead in three categories out of five, with the widest gap in Encryption & Key Custody (8.0 against 6.5); it also leads in Trust & Transparency (5.0 against 4.5) and Price & Value (9.0 against 8.5). MEGA is ahead in Features & Sync and in Usability & Platforms, 7.5 against 7.0 in both.
| Filen | MEGA | |
|---|---|---|
| Rating | 7.0 | 6.6 |
| Who Holds the Keys | You hold the keys | You hold the keys |
| Also Encrypted | File names and metadata | File names only |
| Outside Review of the Encryption | No audit; the planned one has no date | No published audit; three academic papers (2022–2023) found key-recovery attacks, which MEGA says its 2023 update closes |
| Client Code | Open source | Partly open |
| Known Security Incidents | None known | 2018: a hacked Chrome extension sent passwords for other sites to attackers; replaced after four hours; stored files not affected |
| Free Plan | 10 GiB (none if you sign up through a VPN, Tor or a proxy); no public links | 20 GB; downloads limited by a transfer quota |
| Price for 200 GB a Year | €19.99 (Pro I, 200 GiB) | €40 (Essential, 200 GB) |
| Larger Plans, per Year | €89.99 for 2 TiB, €399.99 for 10 TiB | €99.99 for 3 TB, €199.99 for 10 TB, €299.99 for 20 TB |
| Refunds | Within 14 days of the first purchase | 14 days in the EU, 7 in Brazil and South Korea; elsewhere only for billing errors |
Want to compare every field side by side? Open the full comparison table.
What each one encrypts
In both services the keys are derived from your password on your own device, and each file gets its own random key. Both call the result “zero-knowledge” storage. In both cases that is the company’s own description: no published audit has confirmed it for either.
The difference is in the metadata. Filen says it encrypts the file content, the file name, the folder name and the file’s metadata, which its whitepaper lists as the file’s size and type among other things. It still sees your email address, your IP address, how much storage you use and payment references, and its privacy policy adds that it keeps “a small amount of metadata about the file type”.
MEGA says it encrypts the file content, file names, folder names and thumbnails. Its privacy policy lists what it keeps unencrypted: file sizes, the order of file versions, which file sits in which folder, event timestamps, and the IP address and time of each login, upload and link. MEGA’s whitepaper says it chose not to protect the folder structure cryptographically, so that it can move or remove files itself.
Both turn your password into a key with PBKDF2 and SHA-512, a key derivation method that both companies’ whitepapers describe in the same words as “not the latest, best or state of the art”. Filen runs it 200,000 times; MEGA’s 2022 whitepaper gives 100,000. With either service a long, unique password matters more than it would with a slower method.
Both web versions load their encryption code from the company’s servers on every visit, so in the browser you rely on the company sending unaltered code each time. MEGA offers an extension for Chrome and Edge that keeps the code on your computer. Filen’s web app also keeps your keys in the browser’s local storage. The desktop and phone apps of both change only when you install an update.
Who has checked Filen and MEGA
Neither has a published security audit. The difference is that academic cryptographers have published detailed attacks on MEGA’s encryption, while Filen’s has had no outside review of that kind.
In 2022 Matilda Backendal, Miro Haller and Kenneth Paterson of ETH Zurich described five attacks open to anyone controlling MEGA’s servers. The main one recovered a user’s private key after 512 logins with a password; with it, the attacker could decrypt the user’s files and plant files the apps would accept as the user’s own. Researchers at UC San Diego cut the number of logins to six. The ETH team named the root cause: one master key protects all other keys in a mode with no check that the stored keys have not been altered.
MEGA added checks to its apps in June 2022 and said it knew of no account compromised this way. In 2023 a team from Royal Holloway and ETH Zurich showed that those checks could themselves be used to recover the private key, with hundreds of logins. MEGA’s update of March 2023, it says, makes its apps immune to the private-key recovery in all three papers. Its announcement does not say whether the stored keys are now protected against alteration, the root cause the researchers named, and its whitepaper dates from June 2022, before that update.
Filen has never had an independent audit. Its knowledge base says an external company will test it “in the future” with no date set, and its roadmap puts the next larger audit after API v4, a backend rewrite that is itself only planned. Its whitepaper dates from August 2021, and Filen calls it slightly outdated. Fewer published problems is not evidence of a stronger design: MEGA’s flaws came to light because cryptographers studied it, and Filen has not had that kind of review.
Code, bug reports and incidents
Filen publishes the code of all its apps under AGPL-3.0, an open-source licence. MEGA publishes the source of its apps too, but most of it under its own licence, which allows reading and testing the code and is not an open-source licence. Both keep the server code closed. MEGA pays up to €10,000 for each reported vulnerability; Filen ended its public bug bounty and rewards serious reports only at its discretion.
Filen has no known data breach. MEGA has one known security incident, and it did not touch stored files: on 4 September 2018 an attacker published a malicious version of MEGA’s Chrome extension that sent passwords typed into other websites, such as Amazon, GitHub and Google, to a server in Ukraine. MEGA replaced it with a clean version four hours later.
Sharing
In both, sharing keeps the encryption. A public link carries the file’s key after the # sign, a part of the address that browsers do not send to the server, and on paid plans you can add a password and an expiry date. When you share with another user of the same service, the key of the shared file or folder is encrypted with that user’s public key.
MEGA’s free plan can create public links, and you can send the key separately from the link. Filen’s free plan cannot: it allows sharing only with other Filen users. On MEGA, checking that a contact’s public key really belongs to that person, called contact verification, is optional. Since March 2023 MEGA accepts folders from unverified people with a warning, and if you share a folder with someone you have not verified, a compromised MEGA server could hand you a different key and read the folders you share with that person afterwards.
The free plans
MEGA’s free plan holds 20 GB, twice Filen’s 10 GiB. Each comes with conditions.
Filen checks your IP address once at signup: an account created through a VPN, Tor or a proxy gets no free storage at all. A free Filen account cannot make public links and is deleted after 3 months without a login, after reminder emails.
MEGA limits downloads by free users and by people without an account who open your links. The limit is a transfer quota based on how much has been sent to their IP address in the past six hours, and it can pause a download. A file starts to count against it only after it has been downloaded in full more than 10 times. MEGA may delete the files of a free account after at least 10 months without a sign-in, following warning emails.
Paid plans: which is cheaper depends on how much you store
Both price in euros. Filen sells storage in GiB and TiB and MEGA in GB and TB; the sizes below are as each company lists them.
Up to 2 TB, Filen costs less. Its smallest plan, Starter, is €11.99 a year for 100 GiB, a size MEGA does not sell. For about 200 GB, Filen’s Pro I costs €19.99 a year and MEGA’s Essential €40. Filen’s Pro II is €39.99 a year for 500 GiB, and MEGA’s Pro Lite €59.99 for 750 GB. For 2 TB, Filen’s Pro III costs €89.99 a year; MEGA’s nearest plan, Pro I, costs €99.99 a year and holds 3 TB.
From 3 TB, MEGA costs less. Filen’s next plan after 2 TiB is Pro X, €399.99 a year for 10 TiB; MEGA’s Pro II is €199.99 a year for 10 TB, and Pro III is €299.99 for 20 TB. Filen’s plans stack on one account, so 4 TiB means buying Pro III twice, €179.98 a year. Both also bill monthly, from €1.99 for 200 GiB at Filen and €4.99 for 750 GB at MEGA. Every paid MEGA plan includes MEGA’s VPN and password manager.
Refunds favour Filen outside the EU. Filen refunds within 14 days of the first purchase, not renewals. MEGA offers no money-back guarantee: EU residents can cancel within 14 days and residents of Brazil and South Korea within 7, and elsewhere a payment is refunded only if it was charged in error.
Features and sync
Both have desktop sync apps for Windows, macOS and Linux and phone apps that upload photos automatically, and neither limits file size. Filen is the more technical tool: its desktop app syncs in five modes, including one-way backup, and mounts the storage as a network drive; its command-line tool can run a local WebDAV or S3 server, and Filen is a built-in backend in rclone. MEGA’s desktop app syncs chosen folders, backs up folders from your computer and streams audio and video.
File versioning is close: both keep up to 100 versions of each file with no time limit. For deleted files, MEGA has Rewind, which brings back the files and folders deleted from a folder since a chosen date, 30 days back on the free plan (view only) and up to 60 days on paid plans. Filen keeps deleted files in the trash for up to 30 days.
Neither has an editor for office documents. Filen’s only collaborative editing is in its encrypted notes, and it has no family plan yet.
If you lose the password
Neither company keeps a copy of your keys, so neither can restore access to your files on its own. Filen’s only account recovery is an export of your master keys made beforehand; resetting the password without it creates new keys that cannot open anything you uploaded earlier.
MEGA has a recovery key, which you can export only while signed in. A device that is still signed in can also change the password without the old one. Without either, MEGA can only reset the account, and the files in it become unreadable; if the password or key turns up within 60 days, support can bring the old account back. On both services, export the key on the first day and keep it somewhere other than the account itself.
Who runs each service
Filen is run by Filen Cloud Dienste UG, a small company in Recklinghausen, Germany. The company says it has no outside investors. It keeps its servers as its own hardware in German data centers and publishes a PGP-signed warrant canary every week.
MEGA’s cloud service has been run since May 2025 by MEGA Privacy Kft, registered in Hungary; before that the operator was in New Zealand. MEGA does not name its shareholders. It says personal data is stored in Japan, Canada and the EU, and its privacy policy allows it to hand your files, in encrypted form, and your account data to authorities. It publishes a yearly transparency report.
What a legal request could reach in readable form is the account data each company holds. At Filen that is your email address, IP address, storage used and payment references; on MEGA’s side it also includes file sizes, folder structure and login times.
What we didn’t compare, and why
Speed and reliability of sync. Neither review includes transfer-speed or reliability tests, so no winner is named. If you sync large libraries, try both free plans first.
Business use. MEGA sells business plans; Filen lists them as planned. This article covers personal use.
Which one to pick
Read the full Filen review if you want more of each file’s details encrypted, store up to 2 TB, use tools such as rclone or software that talks WebDAV or S3, and can accept a service nobody outside the company has audited. Sign up without a VPN if you want the free 10 GiB, and export your master keys on day one.
Read the full MEGA review if you want the larger free plan, store more than 2 TB, or want public links on a free account. You accept that MEGA’s own policy lists file sizes and folder structure as unencrypted, and that it has not said whether the root cause of the 2022–2023 attacks is gone. Verify the contacts you share folders with, and export the recovery key before you upload anything you cannot afford to lose.