NDEVR OWL · Performance
OWL Cache.
Speed without compromise.
OWL makes repeat opens near-instant by keeping the encrypted payloads you've already transferred close to you — on your device, and on your other devices nearby. Nothing is ever cached in the clear: the cache stores exactly the same AES-256 sealed ciphertext the OWL Cloud stores, and verifies every byte before it's trusted.
Encrypted at rest, everywhere
The cache stores only the opaque, compressed-then-encrypted payload — the exact ciphertext OWL Cloud stores. Filenames, plaintext and keys never enter it.
Instant repeat opens
When a current payload is already on your device, OWL skips the download entirely — saving time, bandwidth, server egress and your download allowance.
Verified before trusted
A cached or peer-supplied payload is only used when its revision, exact size and server-authenticated SHA-256 all match. Anything else is a quiet miss.
Step by step
The automatic encrypted cache
Every file in OWL is sealed with AES-256 before it travels. The cache works on the same principle: it never unwraps anything — it just keeps the sealed payloads you've already paid the bandwidth for, so you never pay twice.
First transfer
The first time you upload or download a file, its encrypted payload passes through your device. Instead of discarding those sealed bytes, OWL retains them in a protected local store — still encrypted, still opaque.
📦 Ciphertext retained locally
Identity check
On the next open, OWL asks the server only for the file's current payload revision — a version fingerprint. A cached entry is used only when it matches that authoritative revision exactly, so you can never see a stale file.
✓ Current revision confirmed
Local, instant open
The sealed payload is served from disk at local-storage speed — no cloud round-trip for the bytes. Your device then decrypts it with keys it is already authorized to hold, exactly as it would after a download.
⚡ Zero payload downloadWhy this is fast
Bytes beat round-trips. A cache hit replaces an entire payload download with one lightweight revision check — for large files that's the difference between seconds and milliseconds.
Streams cache in ranges. Media doesn't need the whole file to benefit: byte ranges you've already streamed are cached individually, so seeking back is instant.
A true byte-budget LRU. The cache tracks exact sizes and evicts the least-recently-used payloads first, staying inside the limit you choose — from 0.25 GB up to 1,024 GB.
It measures itself. OWL continuously estimates your real transfer speeds, so the “time saved” figure in settings reflects what those downloads would actually have cost you.
The lookup order
Where your bytes come from
When you open a file, OWL tries the fastest verified source first and falls back gracefully. Every path delivers the same sealed ciphertext — only the distance changes.
A miss at any tier falls through silently to the next — the cloud path is always there, so caching can only ever make things faster, never break an open.
Your devices, working together
Nearby Cache
Downloaded a video on your laptop and opening it on your desktop? If both are signed into your account and active on the same network, the payload can hop straight across the room instead of crossing the internet again.
Authenticated rendezvous
Your devices find each other through OWL's existing authenticated, account-bound stream. The server relays only short-lived “who has this payload?” messages — never the payload itself.
🔐 Same-account only
Direct LAN transfer
The sealed payload moves over a direct WebRTC channel restricted to private, local addresses — no STUN, no TURN, no relay. Bytes never leave your network, and they're ciphertext the whole way.
🏠 Never leaves your networkVerify, then accept
The receiver accepts the transfer only after the exact size and the server-authenticated SHA-256 of the ciphertext match. A peer can never inject a byte the server didn't vouch for. Any mismatch → quiet fallback to OWL Cloud.
✓ SHA-256 verifiedWorks between browsers too. Two different browsers on one computer can discover each other over loopback — no install, no second cloud download.
On by default, off in one tap. Nearby Cache ships enabled because every transfer is account-authenticated, LAN-restricted and hash-verified — and the toggle in cache settings turns it off per device.
The zero-knowledge boundary, kept
What the cache stores — and what it never will
A cache is only as trustworthy as what it refuses to remember. OWL's cache is deliberately blind: it holds sealed bytes and the minimum bookkeeping needed to budget and verify them.
📦 Stored on your device
- The opaque, compressed-then-encrypted payload — identical to the ciphertext in OWL Cloud
- Exact byte sizes, for the LRU budget
- Opaque identity fingerprints and payload revisions, for staleness checks
- Anonymous transfer statistics (hits, bytes and time saved)
🚫 Never stored
- Plaintext — of anything, ever
- Filenames or MIME types
- Content Keys or key envelopes
- Folder structure or sharing metadata
Someone with your unlocked device but not your OWL account gets nothing from the cache: without the keys your account holds, the cached payloads are the same unreadable ciphertext the server stores. Learn how those keys work in OWL Encryption.
Beyond payloads
Transfer optimizations at every layer
The payload cache is the headline, but OWL tunes the whole pipe — so listings, apps and metadata feel as fast as the files.
Folder listings and resource metadata must never be stale — so instead of blind caching, the server fingerprints each response. Your client revalidates automatically: unchanged data comes back as a tiny “nothing changed” reply instead of the full payload, saving bandwidth on every refresh while guaranteeing you always see the current state.
Every app script and stylesheet ships under a content-hashed name that never changes meaning. Your browser caches them indefinitely and re-downloads only what a release actually changed — which is why an update loads in a blink instead of refetching the world.
Responses are compressed with Brotli where your browser supports it, falling back to gzip — smaller transfers before caching even enters the picture. Payloads are compressed before they're encrypted, so sealed data stays small too.
Streams are fetched and cached in byte ranges, so scrubbing backwards replays from your device and resuming a video doesn't re-download what you've already watched.
Defense in depth
Security guarantees
Caching never weakens OWL's encryption model — it operates entirely on the sealed side of the boundary.
Ciphertext in, ciphertext out. The cache stores payloads exactly as encrypted for OWL Cloud. Decryption happens only on your device, only with keys your account is authorized to hold.
Scoped to your account and server. Cache entries are namespaced per account per server. One account's entries can never be read, trimmed or cleared by another — even a corrupted index can't cross that line.
Nothing unverified is ever served. Local entries must match the server's current payload revision; Nearby transfers must additionally match the exact size and server-authenticated SHA-256 of the ciphertext.
Nearby is LAN-locked by construction. Rendezvous requires your signed-in account; transfer candidates are restricted to private, link-local and loopback addresses. There is no relay server that could see your traffic — the design has no path off your network.
Clearing is instant and local. “Clear cache” deletes the local sealed payloads on that device only. Your files in OWL Cloud are untouched.
Settings stay on the device. Your cache limit and Nearby toggle are per-device choices, deliberately not synced — a shared computer's settings never follow you home.
You're in control
Settings & what the numbers mean
Open your OWL Dashboard and choose OWL Cache — or find Automatic encrypted cache in your account settings. Both show the same live picture:
Estimated time saved — what the skipped downloads would have cost, computed from transfer speeds actually observed on your device.
Bandwidth saved & fetches skipped — bytes and round-trips that never had to cross the internet, which also spares your OWL download allowance.
Stored locally — how much sealed data currently sits on this device, against the limit you chose (presets, or any custom size from 0.25 GB to 1,024 GB).
Nearby devices — how much arrived over your local network instead of the cloud, and the per-device toggle to turn Nearby Cache off.
The cache is automatic and best-effort — the operating system may reclaim space when storage is tight. For files that must be guaranteed available offline, use NEST's Keep on Device instead; the cache is the invisible speed layer underneath everything else.
Fast because it's yours. Safe because it's sealed.
OWL Cache keeps the encrypted bytes you've already earned close to you — verified, budgeted and blind to what they contain. Speed and zero-knowledge, at the same time.