Internxt

Internxt is cloud storage from Internxt Universal Technologies, a company founded in 2020 in Valencia, Spain. According to Internxt, your files are encrypted on your device before upload, and its apps and server code are published as open source. It sells storage both as yearly plans and as lifetime plans paid once.

The encryption covers less than the marketing suggests. File and folder names, the folder structure, file sizes and dates are readable by Internxt, and public sharing links hand their code to Internxt’s server. The only published audit reports date from 2022 and describe serious flaws, most of them fixed by March 2023, that Internxt’s own pages do not mention.

Who Holds the Keys

When you create an account, the app generates a passphrase that Internxt calls a mnemonic and encrypts it with your password before it leaves your device. File keys are derived from that passphrase, and the file contents are encrypted on your device with AES-256 before upload. Internxt does not receive the keys derived from your password, so under this key custody model it holds no key to the contents of your files. Internxt calls the result zero-knowledge encryption; no published audit has confirmed that description.

Internxt advertises post-quantum encryption with Kyber-512. In the published code of the web app, Kyber-512 is combined with elliptic-curve keys to protect the keys passed to people you invite to a folder. File contents themselves use AES-256.

What Internxt Can Still See

File contents are the only part of your storage that is encrypted on your device. Internxt’s help center says that file and folder names, the folder structure, file sizes and timestamps are encrypted only on its servers, so Internxt can read them. In other words, Internxt has no metadata encryption on your device. It explains this as a choice for faster search, sharing and sync, and suggests neutral file names or an encrypted archive for files whose names are sensitive.

Payment details go to a payment provider, and the privacy policy allows analytics providers to collect your IP address and browsing data on Internxt’s sites. The login page of the web app loads Google Analytics, Google advertising tags and the Meta (Facebook) pixel without asking first, so Google and Meta learn when you open it. The desktop and phone apps do not include an analytics library in their published code.

The web app at drive.internxt.com gets its encryption code from Internxt’s servers every time it loads, so a web user trusts that Internxt serves unaltered code on each visit. The desktop and phone apps run code installed on your device and change only when you install an update.

Sharing

Sharing keeps the encryption only when you invite people by email. The key to the shared folder is locked with each person’s public key, using Kyber-512 together with elliptic-curve keys, so it does not reach Internxt in readable form.

A public link works differently. Its address ends with a short code, and the web app sends that code to Internxt’s server when someone opens the link; the server already stores the link’s key locked with the same code. Once the link is opened, Internxt holds both the locked key and the code that unlocks it. Anyone with the link can open the file without an Internxt account. Links can carry a password, and shared items are limited to 10 GB.

Losing Your Password

Internxt does not store your password and cannot reset access to your files. The only account recovery is a backup key: a list of words that you download from the web app’s security settings. If you forget the password without it, the reset erases the account and every file in it. A device where you are still logged in can change the password without the old one, because it already holds the key. Download the backup key on the first day and keep it outside Internxt; this is the usual trade-off of private cloud storage, where nobody else holds a copy of your key.

Open Source and Audits

Internxt publishes its web, desktop and phone apps on GitHub under the AGPL-3.0 and MIT open-source licences, and also its main server and the storage server, under AGPL-3.0. Internxt does not document reproducible builds, so you cannot confirm that a store app or the running server was built from the published code.

The published security audits are three penetration tests by Securitum, a Polish security firm, from 2022. Internxt ordered them. The reports on the web and phone apps open with the statement that “it’s difficult to provide unequivocally positive assessment of products security”. They found broken encryption of file names, a way for anyone with one shared folder link to reach all of the owner’s decrypted files, and a design in which files could be decrypted using only data sent to Internxt’s servers. The two flaws with file names and shared folders were fixed by the last retest in March 2023. The finding about data sent to the servers was marked out of scope at retest, and no published report shows it fixed. The desktop report found remote code execution, fixed by the retest.

Internxt’s help center and blog describe the same audit as finding “no significant issues”, and Internxt removed its copies of the reports from its own site in 2024; the web report is still on Securitum’s site. In 2025 Internxt announced a second Securitum audit of all its apps and its backend with no severe vulnerabilities, but it has not published that report. No data breach at Internxt is known.

Ownership and Jurisdiction

Internxt Universal Technologies SL is registered in Valencia and answers to Spanish law. Internxt says all its infrastructure is in the European Union and that it stores files in data centers run by OVHcloud. The company is run by its founder, Fran Villalba Segarra, and lists Juan Roig, Prosegur, Telefónica, Notion Capital, Andorra Telecom and European Union funds among its investors.

Sync and Features

The desktop app for Windows, macOS and Linux keeps folders in two-way sync and can keep files online only. It also backs up chosen folders every 6, 12 or 24 hours on paid plans bought from Internxt. The top plan, Ultimate, adds a command-line tool, WebDAV, rclone and NAS support. The largest file you can upload is 10 GB on Essential, 50 GB on Premium and 100 GB on Ultimate.

File versioning is narrow. It exists only on Premium and Ultimate, works only for PDF, Word, Excel and CSV files up to 10 MB or 20 MB, and keeps up to 10 or 20 versions for 15 or 30 days; a new version is made by uploading the file again. Deleted files stay in the trash for 2 days on the free plan, 7 on Essential, 15 on Premium and 30 on Ultimate. Internxt has no editor for documents, so there is no collaborative editing.

Price and Lifetime Plans

The free plan gives 1 GB with a 100 MB limit per file. The paid plans, Essential with 1 TB, Premium with 2 TB and Ultimate with 5 TB, are sold as yearly plans paid monthly. The first month costs €1.99, €3.99 or €5.99, and every later month €9.99, €19.99 or €29.99. A year of 1 TB therefore costs about €112 in the first year and about €120 after that. Paid plans also include Internxt’s VPN and antivirus, with more extras on the larger plans.

A lifetime plan costs one payment of €380 for 1 TB, €580 for 2 TB or €780 for 5 TB, and plans stack up to 100 TB. The pricing page shows these as 80% off €1,900, €2,900 and €3,900. “Lifetime” here means the lifetime of the company and of its terms, not storage forever. Under the terms, a lifetime plan lasts until you turn 99, and if you do not log in, upload or download anything for 12 months and do not answer Internxt’s notice within 30 days, Internxt may close the account and delete the files without a refund. Lifetime plans are also subject to a fair-usage policy that lets Internxt throttle or close accounts it considers excessive.

Refunds are available within 30 days of payment, not for renewals and not for payments in cryptocurrency.

Pros and Cons

Our Rating

Internxt suits people who want low-maintenance storage with contents encrypted on their own device, a desktop app on Linux, and a one-time payment instead of a subscription. It is a weaker fit if file names and folder structure are themselves sensitive, if you share through public links, or if you want an audit you can read for the current product.