You are right. From page 26 of their whitepaper: When a public file link is shared publicly, the following is embedded into the public link: https://mega.nz/#

You are right. From page 26 of their whitepaper: When a public file link is shared publicly, the following is embedded into the public link: https://mega.nz/# https://mega.nz/#! || Base64( File Handle ) || ! || Base64( Obfuscated File Key ) This is enough information to find the file identified by its File Handle on the server, then download it, verify the Condensed MAC of the overall file, unobfuscate the File Key, then decrypt the file using the File Key and IV. It should be noted that everything after an anchor hash (#) in the URL is not sent to the MEGA servers and is kept locally in the client’s browser[0] Didn't think of that. So I guess my idea isn't adding too much. Just a lot of compute without so much in return. It still simplifies moderating the files, however. [0]https://mega.nz/SecurityWhitepaper.pdf https://mega.nz/SecurityWhitepaper.pdf