Hoodik vs MEGA: An Encrypted MEGA Alternative You Can Audit

MEGA gives you 20 GB free and 2 TB for around €9.99 a month, all end-to-end encrypted by default. On price and free tier it beats everything else in this comparison, Hoodik included, and by a wide margin. If storage economics are the deciding factor, stop reading and use MEGA.

The rest of this page is about the one thing that should make you hesitate.

The 2022 Attacks

In 2022, Matilda Backendal, Miro Haller, and Kenneth Paterson at ETH Zurich published "MEGA: Malleable Encryption Goes Awry," a set of practical attacks against MEGA's cryptographic design. The headline result: a malicious MEGA server could recover a user's RSA private key after roughly 512 logins, by using the client as an oracle. With that key, it could then decrypt file keys and read files.

The paper also described plaintext recovery and a framing attack that let a malicious server plant files in a user's account that appear to have been uploaded by the user. A separate team followed with a related Bleichenbacher-style attack on the same RSA handling.

The important detail is the threat model. These are not attacks by an outsider who breached MEGA. They are attacks available to MEGA's own servers, or to anyone who controls them. That is precisely the adversary end-to-end encryption is supposed to make irrelevant. The property MEGA sells is the property the attacks broke.

MEGA responded quickly and shipped fixes. The researchers' assessment was that the changes were targeted patches rather than the architectural rework they had recommended. MEGA has continued to make improvements since.

Two things are worth saying plainly. First, there is no evidence any of this was exploited against real users. Second, these bugs were findable because MEGA publishes its client source, which is more transparency than pCloud, Icedrive, or Sync.com's desktop apps offer. Publishing the code is what got them fixed.

What Hoodik Does Differently

Hoodik's cryptography was designed knowing how the earlier generation went wrong, which is an advantage of arriving later rather than of being smarter.

Key wrapping is a hybrid of X25519 and ML-KEM-768, the post-quantum KEM standardized by NIST, rather than raw RSA. Hybrid construction means an attacker has to break both the classical and post-quantum halves. It also sidesteps the family of RSA padding and malleability problems the MEGA attacks lived in.

File encryption uses AEGIS-128L, an authenticated cipher, so ciphertext that has been tampered with fails to decrypt rather than producing attacker-influenced plaintext. Ascon-128a and ChaCha20-Poly1305 are also supported, and the cipher used for each file is recorded so old files keep decrypting after a default changes.

Authentication uses OPAQUE, an asymmetric password-authenticated key exchange. The server never receives your password or any value derived from it that could be attacked offline, which removes the login path as a place to build an oracle.

The server is source-available Rust. You can read what the server does with every request, which is the half of the system MEGA does not publish and the half the 2022 attacks were mounted from.

On the client side MEGA is ahead of us and it should be said plainly. MEGA publishes its full client source; Hoodik publishes the web client and the cryptfns and transfer crates that do the actual encryption in every client, including the mobile apps through Rust FFI, but not the Flutter application built around them. So the encryption path is readable on both sides, and MEGA's app shells are readable where ours are not.

Where MEGA Wins

Price, clearly. Around €4.99/month for 400 GB and €9.99/month for 2 TB. A Hoodik Cloud instance is €19/month for 500 GB, because it provisions a dedicated instance with its own database and storage bucket rather than space on a shared system. Per gigabyte, MEGA is several times cheaper and there is no argument to make there.

The free tier. 20 GB at no cost with no card, against a 14-day Hoodik Cloud trial. Self-hosted Hoodik is free and unlimited, but that requires a machine.

Desktop sync, MEGAcmd, browser extensions, chat, and meetings. MEGA is a broad product with years of client development behind it, and Hoodik has no folder-sync daemon.

Maturity. MEGA has been running at large scale since 2013 and has handled far more traffic and far more edge cases than Hoodik has.

MEGA does meter transfer volume per plan, which self-hosted Hoodik does not, but for most usage that quota is generous.

Who Should Use Which

For a large media library where the encryption is a nice default rather than a requirement, MEGA is the rational choice on price alone. Nothing here changes that.

Hoodik is the answer when the encryption is the actual product. If you are choosing an encrypted service because you need the provider to be unable to read your files, then a documented, published break of exactly that property is the most relevant fact available about the candidates, and it should weigh heavily even after the patches.

Beyond the history, the practical differences are the post-quantum key wrap for anything with a long secrecy lifetime, a published server rather than a published client, and the ability to stop depending on a vendor. Run Hoodik on your own hardware for free, or on Hoodik Cloud at €9/month for 100 GB or €19/month for 500 GB, with the whole instance exportable to a server you control whenever you want it.