- Who runs MEGA and where it came from
- MEGA's encryption: what it says and what it means
- What researchers found in MEGA's encryption
- The 2018 MEGA extension compromise
- Losing your MEGA password or recovery key
- Who can use MEGA, and the rules on free accounts
- Fake MEGA pages and download scams
- So, is MEGA safe?
- Frequently asked questions
MEGA is a real cloud storage service that launched in 2013 and says it uses user-controlled end-to-end encryption, so only you and the people you share keys with can read your files. The catch is that MEGA says it can't reset your password: lose the recovery key and you lose access to the account.
MEGA gets searched a lot because of its past, its big free allowance and its privacy claims. If you're wondering whether it's safe to keep your files there, it helps to separate what the company says, what researchers have found and what's down to how you use it. I've read MEGA's security page and terms, plus Wikipedia and the researchers' own site, so you can see the full picture.
Who runs MEGA and where it came from
According to Wikipedia, Kim Dotcom launched MEGA in 2013. He had earlier founded Megaupload, which the U.S. government seized in 2012, and Wikipedia says he stepped down as Director later that year. Dotcom's history is a big reason people hesitate, but it's a story about a person and a different service, so judge MEGA on how it works today.
Today, MEGA's terms say which company you deal with depends on how you use it. For MEGA Cloud users, including free users, the operator is MEGA Privacy Kft in Hungary. If you got the service through the Apple App Store or Google Play, MEGA Networks LLC in Delaware applies. The terms also say primary data centres are in Japan, Canada and/or the European Union.
MEGA's encryption: what it says and what it means
MEGA's security page describes zero-knowledge encryption as user-controlled end-to-end encryption. It says only you and those you share information with have the keys to see, read or listen to your data, and that anyone else, MEGA included, would see gibberish.
It also says the complete source code for its client apps is available to the public, and that its design and security processes are published in a whitepaper. That doesn't prove the system is flawless, but it lets outsiders examine it.
What researchers found in MEGA's encryption
The most useful independent check I found comes from the Applied Crypto Group at ETH Zurich. Its researchers, Matilda Backendal, Miro Haller and Prof. Kenny Paterson, reported attacks on MEGA's encryption. They contacted MEGA about the findings in 2022.
On their site, the researchers say MEGA acknowledged the attacks, confirmed the system was vulnerable and awarded a bug bounty. MEGA added client-side checks on the format of RSA private keys. The researchers say that patch directly prevents the RSA key recovery attack, but doesn't directly protect against some of the other attacks they described, and they hadn't analysed whether the patch can be bypassed.
So the honest summary is that the claims are strong, the system has been poked at by academics, and some issues were found and addressed. If you store anything sensitive, add your own protection before you upload, such as an encrypted archive.
The 2018 MEGA extension compromise
Wikipedia reports that in 2018 a MEGA extension on the Chrome Web Store was altered to steal website logins and cryptocurrency data. Browser extensions run with wide access, so this is a reminder to install MEGA tools only from official sources and to keep your browser extensions to a minimum. It's also why I'd use the official apps and the website rather than anything a stranger links you to.
Losing your MEGA password or recovery key
This is the safety point that catches people out. MEGA says it can't send password reset links or restore access on its end. In its words, the only way to regain access to your account is with your recovery key: no key, no access.
Store the recovery key somewhere separate from the password. A reputable password manager works well, and my comparison of password managers, Bitwarden against its main rival, explains the differences. That protects you from your own mistakes, which are a bigger risk for most people than any attacker.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Who can use MEGA, and the rules on free accounts
MEGA's terms say users must be at least 18 years old, or the age of majority where they live. They also say MEGA may suspend or terminate a free account that has been inactive for over 3 months and you have been given notice to act. If you only use MEGA as a backup, log in now and then.
On copyright, the terms say MEGA reserves the right to remove data alleged to be infringing without prior notice and will suspend an account after repeated copyright takedown notices. You can file a counter-notice at mega.io/dispute if you think access was wrongly disabled. MEGA is a storage service, and the malware risk comes from what you download from other people's links. Sharing or downloading copyrighted content without permission isn't allowed.
| What I checked | What MEGA's own pages say |
|---|---|
| Encryption | User-controlled end-to-end, only you and people you share with hold keys |
| Password loss | No reset; the recovery key is the only way back in |
| Source code | Complete client app code is public |
| Minimum age | At least 18, or the age of majority where you live |
| Inactive free accounts | May be suspended after over 3 months, with notice |
| Data centres | Japan, Canada and/or the European Union |
Fake MEGA pages and download scams
Download MEGA apps only from the official site or the official app stores. Copycat download pages, cracked software and pop-ups telling you to update an app are classic ways to spread malware. Never share your recovery key or password with anyone, including someone claiming to be MEGA support.
- Type the address yourself rather than following a link in a message.
- Treat a shared MEGA link like any file from a stranger: scan it before opening.
- Turn on two-factor authentication; MEGA says it uses a code from an authenticator app.
- Keep a copy of your recovery key offline.
If you're weighing cloud services for work, my guide to Dropbox alternatives for syncing, sharing and teams covers the wider choice.
So, is MEGA safe?
MEGA is a real service with published security claims and public client code, and its main weakness for ordinary users is the recovery key. Researchers have found issues in the past, and MEGA says it responded. Use two-factor authentication, keep your recovery key safe and only open links you trust.
Frequently asked questions
Is MEGA safe to use?
MEGA says it uses user-controlled end-to-end encryption and publishes its client app code. Researchers at ETH Zurich reported attacks in 2022, and MEGA says it acknowledged them and added fixes.
Who owns MEGA?
According to Wikipedia, Kim Dotcom launched it in 2013. MEGA's terms say the operating company depends on how you use it, with MEGA Privacy Kft in Hungary covering MEGA Cloud users including free users.
What happens if I forget my MEGA password?
MEGA says it can't send password reset links or restore access on its end. The only way back in is your recovery key.
Do I need to be an adult to use MEGA?
MEGA's terms say users must be at least 18 years old, or the age of majority where they live.
Can MEGA delete inactive free accounts?
The terms say MEGA may suspend or terminate a free account that has been inactive for over 3 months, after giving notice to act.
