Share2Me

Under the Hood

How Share2Me Works

Every transfer is end-to-end encrypted, peer-to-peer, and completely ephemeral. Here's exactly what happens — from the moment you drop a file to the moment the receiver saves it.

Transfer Architecture

The complete flow — sender, signaling, and receiver

Sender
Browser / Device
📄 File selected
🔑 AES-256 key gen
🔒 Chunks encrypted
OTC / QR
Signaling Server
WebRTC handshake only.
Never sees your file.
offer / answer / ICE
ECDH keys
Receiver
Browser / Device
📷 Scan QR / enter OTC
🔑 ECDH key pair gen
🔓 Chunks decrypted
WebRTC P2P DataChannel— Encrypted chunks only

Step-by-Step Breakdown

What happens at each stage of the transfer

STEP 01

Drop your file

Select any file. It stays entirely on your device — nothing is uploaded at this point.

STEP 02

Local AES-GCM-256 encryption

A random 256-bit key is generated in your browser. The file is split into chunks; each is encrypted with a unique IV.

STEP 03

Share OTC or QR code

A 6-digit one-time code and QR code are generated from file metadata. Share verbally or let the receiver scan.

STEP 04

ECDH key exchange

The receiver generates an ephemeral P-256 key pair and sends the public key. The sender wraps the AES key — the raw key never leaves either device.

STEP 05

WebRTC P2P tunnel

A direct RTCDataChannel is established. The signaling server is only used for the WebRTC handshake — it never sees your file or keys.

STEP 06

Encrypted transfer + NACK retry

Chunks stream directly peer-to-peer. Missing chunks are automatically re-requested via NACK until all arrive and the file is assembled.

Cryptography Spec

File Encryption
AES-GCM-256
Random IV per chunk
Key Agreement
ECDH P-256
Ephemeral pair per transfer
Key Wrapping
Web Crypto API
wrapKey / unwrapKey

Security Guarantees

What you get out-of-the-box — no configuration required.

Zero server storage

No file, chunk, or key touches our servers. The signaling server only relays WebRTC handshake messages.

No interception possible

Every byte is AES-GCM-256 encrypted with a random IV per chunk before it leaves your device.

Forward secrecy

Each transfer uses a freshly generated AES key and ECDH pair. No long-lived secrets exist.

No installs needed

Runs entirely in your browser using Web Crypto API and WebRTC — both built into every modern browser.

Frequently Asked Questions

What is the maximum file size limit on Share2Me?
There are absolutely no file size limits on Share2Me. Because the transfer is established directly peer-to-peer (P2P) between the sender and receiver browsers via WebRTC, the data does not pass through or store on any intermediate cloud server.
Is my data secure when transferring files and text?
Yes, completely secure. All transfers are end-to-end encrypted using military-grade AES-GCM-256 encryption. The encryption key is derived locally on your device via ephemeral ECDH (P-256) key exchange, meaning the raw key never leaves your browser and cannot be read by anyone, including the signaling server.
Do both devices need to be online at the same time?
Yes. Because Share2Me uses direct WebRTC peer-to-peer tunnels to transfer data, both the sending device and the receiving device must have the page open and be online concurrently to perform the transfer.
Can I transfer files between different operating systems?
Absolutely. Share2Me is entirely browser-native and cross-platform. It works seamlessly between iOS, Android, macOS, Windows, Linux, and any other operating system running a modern web browser, without needing any software installations.
Can I send clipboard text and messages securely?
Yes. Share2Me offers a dedicated Text Transfer mode. Copy-paste any text, passwords, or code snippets, and it will be encrypted and streamed securely through the same WebRTC pipeline, complete with a convenient 'Copy All' button for the receiver.
What if the transfer fails halfway?
Share2Me uses a built-in NACK (Negative Acknowledgement) chunk retry algorithm. If a chunk is lost in transit due to network jitter, the receiver's browser automatically requests just the missing sequence numbers from the sender, recovering the transfer automatically without starting over.
Can I self-host Share2Me?
Yes. The codebase is designed to be easily self-hosted. The backend is built using standard Node.js, Express, and Socket.io, and works perfectly in a single container or in clustered environments via the integrated Redis adapter configuration.

Ready to try it?

No account. No upload. No waiting. Drop your file and share the code.