Direct transfer between devices, with no upload and no storage.
Both parties open the page and connect using a session code. Files travel AES-256 encrypted, straight between the browsers, in both directions, with no account and no size limit.
The application generates a six-digit session code and an invitation link. No file is uploaded to the server.
Technical detailA random code, valid for 10 minutes, single use. The link carries a secret held in the URL fragment, which is never sent to the server.
Pairing the devices
The second party enters the code or opens the invitation link. The server sees that both devices present the same code and connects them.
Technical detailSignaling carries only the WebRTC connection data: SDP session descriptions and ICE candidates. The code is consumed on first use.
Deriving the encryption key
The two devices negotiate the encryption key locally. The key never crosses the server and is not known to Synaptic Systems.
Technical detailECDH on the P-256 curve through WebCrypto, followed by HKDF-SHA256 with the session code as salt. The result is distinct AES-256-GCM keys for each direction.
Confirming the connection
Both devices display the same key fingerprint. If the values differ, the connection is refused. Joining through an invitation link is validated automatically.
Technical detailThe fingerprint is a 48-bit cryptographic digest of the shared key. The invitation link authenticates the exchange with HMAC-SHA256 using the secret from the URL fragment.
The transfer itself
The channel runs directly between the two devices. Both parties can send and receive at the same time, with progress shown per file.
Technical detailWebRTC DataChannel. The file is split into blocks of up to 64 KB, each encrypted individually with AES-256-GCM and its own nonce. The receiver writes straight to disk.
The diagram advances on its own. Select a stage for the details.
Transfer session
Open a transfer session
You will receive a session code and an invitation link to pass to the other party through whichever channel you prefer.
What happens if the page is closed during a transfer?
The transfer stops and has to be restarted. Resuming from the point of interruption is in development.
How secure is the session code?
The code expires in 10 minutes and can be used only once. Beyond that, the connection is confirmed by hand and the two parties compare the key fingerprint.
Why is the connection not always established?
Some networks, corporate ones in particular and a share of mobile ones, do not allow direct connections between two devices. Files are not routed through our servers, so in those cases the transfer cannot take place. The answer is a different network, or the classic transfer.
Does it work on mobile devices?
Yes, in any modern browser. The screen has to stay on during the transfer, otherwise the operating system may suspend the page.
Is there a size limit?
In Chrome and Edge you choose a save location and files are written straight to disk, with no limit. In Firefox and Safari incoming files are held in memory, so the practical limit is around 1.5 GB.
