Every transfer is end-to-end encrypted, peer-to-peer, and completely ephemeral. Here's exactly what happens — from the moment you drop a file to the moment the receiver saves it.
The complete flow — sender, signaling, and receiver
What happens at each stage of the transfer
Select any file. It stays entirely on your device — nothing is uploaded at this point.
A random 256-bit key is generated in your browser. The file is split into chunks; each is encrypted with a unique IV.
A 6-digit one-time code and QR code are generated from file metadata. Share verbally or let the receiver scan.
The receiver generates an ephemeral P-256 key pair and sends the public key. The sender wraps the AES key — the raw key never leaves either device.
A direct RTCDataChannel is established. The signaling server is only used for the WebRTC handshake — it never sees your file or keys.
Chunks stream directly peer-to-peer. Missing chunks are automatically re-requested via NACK until all arrive and the file is assembled.
What you get out-of-the-box — no configuration required.
No file, chunk, or key touches our servers. The signaling server only relays WebRTC handshake messages.
Every byte is AES-GCM-256 encrypted with a random IV per chunk before it leaves your device.
Each transfer uses a freshly generated AES key and ECDH pair. No long-lived secrets exist.
Runs entirely in your browser using Web Crypto API and WebRTC — both built into every modern browser.
No account. No upload. No waiting. Drop your file and share the code.