diff --git a/app/ui/blank.js b/app/ui/blank.js
index 8364ca80..8eb4e26c 100644
--- a/app/ui/blank.js
+++ b/app/ui/blank.js
@@ -2,6 +2,11 @@ const html = require('choo/html');
 
 module.exports = function() {
   return html`
-    <main class="main container"></main>
+    <main class="main relative">
+      <section class="h-full w-full p-6 md:flex md:flex-row z-10">
+        <div class="md:mr-6 md:w-1/2 w-full"></div>
+        <div class="md:w-1/2 mt-6 md:mt-0 w-full"></div>
+      </section>
+    </main>
   `;
 };
diff --git a/app/ui/download.js b/app/ui/download.js
index 06e94804..2650eaee 100644
--- a/app/ui/download.js
+++ b/app/ui/download.js
@@ -2,6 +2,7 @@
 const html = require('choo/html');
 const archiveTile = require('./archiveTile');
 const intro = require('./intro');
+const notFound = require('./notFound');
 
 function password(state, emit) {
   const fileInfo = state.fileInfo;
@@ -81,6 +82,9 @@ module.exports = function(state, emit) {
   let content = '';
   if (!state.fileInfo) {
     state.fileInfo = createFileInfo(state);
+    if (!state.fileInfo.nonce) {
+      return notFound(state);
+    }
   }
 
   if (!state.transfer && !state.fileInfo.requiresPassword) {
diff --git a/server/routes/pages.js b/server/routes/pages.js
index dd54d25b..b923967b 100644
--- a/server/routes/pages.js
+++ b/server/routes/pages.js
@@ -11,7 +11,7 @@ function stripEvents(str) {
 module.exports = {
   index: async function(req, res) {
     const appState = await state(req);
-    res.send(stripEvents(routes().toString('/', appState)));
+    res.send(stripEvents(routes().toString('/blank', appState)));
   },
 
   blank: async function(req, res) {