MEGA

Is MEGA safe?

MEGA is safe for storing files you do not want a cloud company to read, with two catches: its encryption has a weaker record than its marketing suggests, and the free app tracks you for advertising. Files and chats are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, so MEGA holds no key to your data. But researchers showed in 2022 and again in 2023 that MEGA's own servers could have recovered users' keys, and Apple's privacy label for the iPhone app lists location and usage data used to track you across other companies' apps. We score MEGA 67/100, well below Proton Drive and just above Dropbox (63).

How MEGA's encryption works, and how it was broken

Everything you upload is encrypted on your device with keys that come from your password. MEGA cannot reset that password for you: if you lose both the password and the recovery key, your files are gone. That is the price of a provider that cannot read your data.

The design has been attacked by people who know cryptography. In March 2022 researchers at ETH Zurich reported five attacks to MEGA. The most serious let an attacker who controlled MEGA's servers, or a rogue insider, rebuild a user's private RSA key after the user logged in 512 times, and then decrypt their files. MEGA released fixes in June 2022 for the two attacks that could expose data and said it knew of no affected accounts.

The fix did not hold for long. In a 2023 paper, Albrecht, Haller, Mareková and Paterson showed that MEGA's new key checks could themselves be used to recover a user's private key, at only slightly higher cost than the original attack. They also cut the original attack to two logins. The researchers' broader point was that the system lacked integrity protection for stored keys, which a quick patch does not fix.

MEGA's answer came in March 2023. A security update released alongside that paper made its apps immune to the known key-recovery attacks and to servers that slip in false public keys, and asked users to verify their contacts' keys before sharing folders. None of the attacks was used against users as far as anyone has reported. The episode still shows that MEGA's "not even we can read your files" rested for years on a design that outside cryptographers could break.

A more practical incident came in September 2018. An attacker uploaded a trojaned version of MEGA's Chrome extension to the Chrome Web Store. Users who accepted its new permissions had logins for Amazon, GitHub, Google and crypto wallets sent to a server in Ukraine.

What the app collects

The privacy label is the surprise. Apple lists location and usage data "used to track you", and usage and advertising data linked to you for third-party advertising. The App Store notes that the app contains ads. MEGA's policy confirms it may use third-party advertising companies to serve ads on its services and on other sites.

The policy is also clear about what MEGA keeps readable: IP addresses with times for logins, uploads and link use, a device ID, file sizes, how files and folders connect, your contacts' email addresses and when your chats took place. It says it never sells personal data, stores it in Japan, Canada or the EU and keeps none in the US. Google Play's data safety section says only crash logs are shared, for analytics.

Public links and illegal content

MEGA's biggest problem is not what it does with your data but what other people share through it. Free storage, large file sizes and encryption make public links popular for piracy and worse. MEGA's 2025 transparency report says it closed about 3.33 million accounts for sharing illegal content in its first 12 years. Since 2022 it has downloaded files from reported public links, matched them against child abuse image databases from INTERPOL, NCMEC and the Canadian Centre for Child Protection, and removed every identical copy. That project closed 415,579 accounts in 2025 alone. MEGA says it aims to take down reported links within four hours.

This matters for ordinary users in two ways. A stranger's MEGA link can lead to anything, including malware hidden in pirated software. And because MEGA cannot see private files, it relies on reports and hash matching rather than scanning.

Who runs MEGA?

MEGA launched in New Zealand in January 2013, and Kim Dotcom was its best-known backer. In July 2015 he said he had no management role or shares any more and told users not to trust it, alleging a hostile takeover; MEGA rejected that. Those claims are more than 10 years old and do not affect the score. Since March 2025 the cloud service has been provided by MEGA Privacy LLC, registered in Hungary, which puts it under EU data protection law. MEGA says it may give police basic subscriber details such as registration data and IP addresses in serious cases.

How to use MEGA more safely

1. Save your recovery key somewhere offline the day you sign up.
2. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app.
3. Refuse tracking when iOS asks, or turn off "Allow Apps to Request to Track" in iPhone privacy settings.
4. When sharing, send the decryption key separately from the link, so a leaked link alone does not open the file.
5. Treat files from strangers' links as untrusted, especially software.

How we scored it

Regulatory record (87) is MEGA's strongest factor: we found no fines or orders. Scams and harmful content (55) is the weakest, because public links carry large amounts of illegal material. Security (72) credits default end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, open-source apps and the 2023 fixes but counts the 2022 and 2023 key-recovery attacks and the 2018 extension hijack, and privacy (60) reflects the ad tracking declared on the App Store.